feat: implement cmpd's PolicyRules #8328
Conversation
cjc7373
changed the title
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8328 +/- ##
==========================================
+ Coverage 60.34% 60.65% +0.30%
==========================================
Files 381 382 +1
Lines 46215 46502 +287
==========================================
+ Hits 27889 28204 +315
+ Misses 15654 15619 -35
- Partials 2672 2679 +7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
pkg/controller/factory/builder.go
Outdated
| return nil | ||
| } | ||
| return builder.NewRoleBuilder(synthesizedComp.Namespace, saName). | ||
| AddLabelsInMap(constant.GetCompLabels(synthesizedComp.ClusterName, synthesizedComp.Name)). |
There was a problem hiding this comment.
And these labels become meaningless because they do not belong to any specific object.
There was a problem hiding this comment.
Actually they do belong to one component. When this component is being deleted:
- if there's no other component use the cmpd it uses, these rbac resources will be deleted.
- if there is, these rbac resources' ownership will be transfered to another component.
cjc7373
force-pushed
the
feature/rbac-for-component
branch
from
31d6fc0 to
3851918
Compare
|
/cherry-pick release-1.0-beta |
|
🤖 says: cherry pick action finished successfully 🎉! |
(cherry picked from commit cf9d59b)
Fixes #8310. Things done in this PR:
serviceAccountNamein cluster and component CR. KB now does not create rbac resources if user has specified a service account.kb-<clusterName>-<compName>.Addon changes (like update pg addon's cmpd policyRule since we removed kubeblocks-patroni-pod-role) will be addressed in apecloud/kubeblocks-addons#1197.