Skip to content

Commit 5a5dfa8

Browse files
author
Israel Blancas
committed
Add automatic RBAC creation for k8scluster receiver
Signed-off-by: Israel Blancas <[email protected]>
1 parent 99b6c6f commit 5a5dfa8

File tree

12 files changed

+491
-1
lines changed

12 files changed

+491
-1
lines changed

‎.chloggen/3427.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: collector
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Create RBAC rules for the k8s_cluster receiver automatically.
9+
10+
# One or more tracking issues related to the change
11+
issues: [3427]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext:

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,7 @@ add-rbac-permissions-to-operator: manifests kustomize
206206
# This folder is ignored by .gitignore
207207
mkdir -p config/rbac/extra-permissions-operator
208208
cp -r tests/e2e-automatic-rbac/extra-permissions-operator/* config/rbac/extra-permissions-operator
209+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/clusterresourcequotas.yaml
209210
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/cronjobs.yaml
210211
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/daemonsets.yaml
211212
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/events.yaml

‎internal/components/receivers/helpers.go

+3
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,9 @@ var (
143143
components.NewBuilder[k8seventsConfig]().WithName("k8s_events").
144144
WithRbacGen(generatek8seventsRbacRules).
145145
MustBuild(),
146+
components.NewBuilder[k8sclusterConfig]().WithName("k8s_cluster").
147+
WithRbacGen(generatek8sclusterRbacRules).
148+
MustBuild(),
146149
NewScraperParser("prometheus"),
147150
NewScraperParser("sshcheck"),
148151
NewScraperParser("cloudfoundry"),

‎internal/components/receivers/k8scluster.go

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// Copyright The OpenTelemetry Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package receivers
16+
17+
import (
18+
"github.com/go-logr/logr"
19+
rbacv1 "k8s.io/api/rbac/v1"
20+
)
21+
22+
type k8sclusterConfig struct {
23+
Distribution string `mapstructure:"distribution"`
24+
}
25+
26+
func generatek8sclusterRbacRules(_ logr.Logger, cfg k8sclusterConfig) ([]rbacv1.PolicyRule, error) {
27+
policyRules := []rbacv1.PolicyRule{
28+
{
29+
APIGroups: []string{""},
30+
Resources: []string{
31+
"events",
32+
"namespaces",
33+
"namespaces/status",
34+
"nodes",
35+
"nodes/spec",
36+
"pods",
37+
"pods/status",
38+
"replicationcontrollers",
39+
"replicationcontrollers/status",
40+
"resourcequotas",
41+
"services",
42+
},
43+
Verbs: []string{"get", "list", "watch"},
44+
},
45+
{
46+
APIGroups: []string{"apps"},
47+
Resources: []string{
48+
"daemonsets",
49+
"deployments",
50+
"replicasets",
51+
"statefulsets",
52+
},
53+
Verbs: []string{"get", "list", "watch"},
54+
},
55+
{
56+
APIGroups: []string{"extensions"},
57+
Resources: []string{
58+
"daemonsets",
59+
"deployments",
60+
"replicasets",
61+
},
62+
Verbs: []string{"get", "list", "watch"},
63+
},
64+
{
65+
APIGroups: []string{"batch"},
66+
Resources: []string{
67+
"jobs",
68+
"cronjobs",
69+
},
70+
Verbs: []string{"get", "list", "watch"},
71+
},
72+
{
73+
APIGroups: []string{"autoscaling"},
74+
Resources: []string{"horizontalpodautoscalers"},
75+
Verbs: []string{"get", "list", "watch"},
76+
},
77+
}
78+
79+
if cfg.Distribution == "openshift" {
80+
policyRules = append(policyRules, rbacv1.PolicyRule{
81+
APIGroups: []string{"quota.openshift.io"},
82+
Resources: []string{"clusterresourcequotas"},
83+
Verbs: []string{"get", "list", "watch"},
84+
})
85+
}
86+
return policyRules, nil
87+
}

‎internal/components/receivers/k8scluster_test.go

+164
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
// Copyright The OpenTelemetry Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package receivers
16+
17+
import (
18+
"testing"
19+
20+
"github.com/go-logr/logr"
21+
"github.com/stretchr/testify/assert"
22+
rbacv1 "k8s.io/api/rbac/v1"
23+
)
24+
25+
func Test_generatek8sclusterRbacRules(t *testing.T) {
26+
tests := []struct {
27+
name string
28+
cfg k8sclusterConfig
29+
want []rbacv1.PolicyRule
30+
wantErr bool
31+
}{
32+
{
33+
name: "default configuration",
34+
cfg: k8sclusterConfig{},
35+
want: []rbacv1.PolicyRule{
36+
{
37+
APIGroups: []string{""},
38+
Resources: []string{
39+
"events",
40+
"namespaces",
41+
"namespaces/status",
42+
"nodes",
43+
"nodes/spec",
44+
"pods",
45+
"pods/status",
46+
"replicationcontrollers",
47+
"replicationcontrollers/status",
48+
"resourcequotas",
49+
"services",
50+
},
51+
Verbs: []string{"get", "list", "watch"},
52+
},
53+
{
54+
APIGroups: []string{"apps"},
55+
Resources: []string{
56+
"daemonsets",
57+
"deployments",
58+
"replicasets",
59+
"statefulsets",
60+
},
61+
Verbs: []string{"get", "list", "watch"},
62+
},
63+
{
64+
APIGroups: []string{"extensions"},
65+
Resources: []string{
66+
"daemonsets",
67+
"deployments",
68+
"replicasets",
69+
},
70+
Verbs: []string{"get", "list", "watch"},
71+
},
72+
{
73+
APIGroups: []string{"batch"},
74+
Resources: []string{
75+
"jobs",
76+
"cronjobs",
77+
},
78+
Verbs: []string{"get", "list", "watch"},
79+
},
80+
{
81+
APIGroups: []string{"autoscaling"},
82+
Resources: []string{"horizontalpodautoscalers"},
83+
Verbs: []string{"get", "list", "watch"},
84+
},
85+
},
86+
wantErr: false,
87+
},
88+
{
89+
name: "openshift configuration",
90+
cfg: k8sclusterConfig{
91+
Distribution: "openshift",
92+
},
93+
want: []rbacv1.PolicyRule{
94+
{
95+
APIGroups: []string{""},
96+
Resources: []string{
97+
"events",
98+
"namespaces",
99+
"namespaces/status",
100+
"nodes",
101+
"nodes/spec",
102+
"pods",
103+
"pods/status",
104+
"replicationcontrollers",
105+
"replicationcontrollers/status",
106+
"resourcequotas",
107+
"services",
108+
},
109+
Verbs: []string{"get", "list", "watch"},
110+
},
111+
{
112+
APIGroups: []string{"apps"},
113+
Resources: []string{
114+
"daemonsets",
115+
"deployments",
116+
"replicasets",
117+
"statefulsets",
118+
},
119+
Verbs: []string{"get", "list", "watch"},
120+
},
121+
{
122+
APIGroups: []string{"extensions"},
123+
Resources: []string{
124+
"daemonsets",
125+
"deployments",
126+
"replicasets",
127+
},
128+
Verbs: []string{"get", "list", "watch"},
129+
},
130+
{
131+
APIGroups: []string{"batch"},
132+
Resources: []string{
133+
"jobs",
134+
"cronjobs",
135+
},
136+
Verbs: []string{"get", "list", "watch"},
137+
},
138+
{
139+
APIGroups: []string{"autoscaling"},
140+
Resources: []string{"horizontalpodautoscalers"},
141+
Verbs: []string{"get", "list", "watch"},
142+
},
143+
{
144+
APIGroups: []string{"quota.openshift.io"},
145+
Resources: []string{"clusterresourcequotas"},
146+
Verbs: []string{"get", "list", "watch"},
147+
},
148+
},
149+
wantErr: false,
150+
},
151+
}
152+
153+
for _, tt := range tests {
154+
t.Run(tt.name, func(t *testing.T) {
155+
got, err := generatek8sclusterRbacRules(logr.Discard(), tt.cfg)
156+
if tt.wantErr {
157+
assert.Error(t, err)
158+
return
159+
}
160+
assert.NoError(t, err)
161+
assert.Equal(t, tt.want, got)
162+
})
163+
}
164+
}

‎internal/components/receivers/single_endpoint_receiver_test.go

-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,6 @@ func TestDownstreamParsers(t *testing.T) {
8383
{"awsxray", "awsxray", "__awsxray", 2000, false},
8484
{"tcplog", "tcplog", "__tcplog", 0, true},
8585
{"udplog", "udplog", "__udplog", 0, true},
86-
{"k8s_cluster", "k8s_cluster", "__k8s_cluster", 0, false},
8786
} {
8887
t.Run(tt.receiverName, func(t *testing.T) {
8988
t.Run("builds successfully", func(t *testing.T) {

‎tests/e2e-automatic-rbac/extra-permissions-operator/clusterresourcequotas.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
- op: add
2+
path: /rules/-
3+
value:
4+
apiGroups:
5+
- quota.openshift.io
6+
resources:
7+
- clusterresourcequotas
8+
verbs:
9+
- get
10+
- list
11+
- watch

‎tests/e2e-automatic-rbac/receiver-k8scluster/00-install.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: chainsaw-k8s-cluster

‎tests/e2e-automatic-rbac/receiver-k8scluster/01-assert.yaml

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: simplest-chainsaw-k8s-cluster-cluster-role
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- events
10+
- namespaces
11+
- namespaces/status
12+
- nodes
13+
- nodes/spec
14+
- pods
15+
- pods/status
16+
- replicationcontrollers
17+
- replicationcontrollers/status
18+
- resourcequotas
19+
- services
20+
verbs:
21+
- get
22+
- list
23+
- watch
24+
- apiGroups:
25+
- apps
26+
resources:
27+
- daemonsets
28+
- deployments
29+
- replicasets
30+
- statefulsets
31+
verbs:
32+
- get
33+
- list
34+
- watch
35+
- apiGroups:
36+
- extensions
37+
resources:
38+
- daemonsets
39+
- deployments
40+
- replicasets
41+
verbs:
42+
- get
43+
- list
44+
- watch
45+
- apiGroups:
46+
- batch
47+
resources:
48+
- jobs
49+
- cronjobs
50+
verbs:
51+
- get
52+
- list
53+
- watch
54+
- apiGroups:
55+
- autoscaling
56+
resources:
57+
- horizontalpodautoscalers
58+
verbs:
59+
- get
60+
- list
61+
- watch
62+
---
63+
apiVersion: rbac.authorization.k8s.io/v1
64+
kind: ClusterRoleBinding
65+
metadata:
66+
labels:
67+
app.kubernetes.io/component: opentelemetry-collector
68+
app.kubernetes.io/instance: chainsaw-k8s-cluster.simplest
69+
app.kubernetes.io/managed-by: opentelemetry-operator
70+
app.kubernetes.io/name: simplest-chainsaw-k8s-cluster-collector
71+
app.kubernetes.io/part-of: opentelemetry
72+
name: simplest-chainsaw-k8s-cluster-collector
73+
roleRef:
74+
apiGroup: rbac.authorization.k8s.io
75+
kind: ClusterRole
76+
name: simplest-chainsaw-k8s-cluster-cluster-role
77+
subjects:
78+
- kind: ServiceAccount
79+
name: simplest-collector
80+
namespace: chainsaw-k8s-cluster

0 commit comments

Comments
 (0)