Skip to content

Commit c0b52cd

Browse files
author
Israel Blancas
committed
Add automatic RBAC creation for k8sevents receiver
Signed-off-by: Israel Blancas <[email protected]>
1 parent 49ca805 commit c0b52cd

18 files changed

+307
-23
lines changed

‎.chloggen/3420.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: collector
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Create RBAC rules for the k8s_events receiver automatically.
9+
10+
# One or more tracking issues related to the change
11+
issues: [3420]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext:

‎Makefile

+9-1
Original file line numberDiff line numberDiff line change
@@ -206,12 +206,20 @@ add-rbac-permissions-to-operator: manifests kustomize
206206
# This folder is ignored by .gitignore
207207
mkdir -p config/rbac/extra-permissions-operator
208208
cp -r tests/e2e-automatic-rbac/extra-permissions-operator/* config/rbac/extra-permissions-operator
209+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/cronjobs.yaml
210+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/daemonsets.yaml
211+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/events.yaml
212+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/extensions.yaml
209213
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/namespaces.yaml
214+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/namespaces-status.yaml
210215
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/nodes.yaml
211-
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/nodes-stats.yaml
212216
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/nodes-proxy.yaml
217+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/nodes-spec.yaml
218+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/pod-status.yaml
213219
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/rbac.yaml
214220
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/replicaset.yaml
221+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/replicationcontrollers.yaml
222+
cd config/rbac && $(KUSTOMIZE) edit add patch --kind ClusterRole --name manager-role --path extra-permissions-operator/resourcequotas.yaml
215223

216224
.PHONY: enable-targetallocator-cr
217225
enable-targetallocator-cr:

‎internal/components/receivers/helpers.go

+3
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,9 @@ var (
139139
components.NewBuilder[kubeletStatsConfig]().WithName("kubeletstats").
140140
WithRbacGen(generateKubeletStatsRbacRules).
141141
MustBuild(),
142+
components.NewBuilder[k8seventsConfig]().WithName("k8s_events").
143+
WithRbacGen(generatek8seventsRbacRules).
144+
MustBuild(),
142145
NewScraperParser("prometheus"),
143146
NewScraperParser("sshcheck"),
144147
NewScraperParser("cloudfoundry"),

‎internal/components/receivers/k8sevents.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// Copyright The OpenTelemetry Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package receivers
16+
17+
import (
18+
"github.com/go-logr/logr"
19+
rbacv1 "k8s.io/api/rbac/v1"
20+
)
21+
22+
type k8seventsConfig struct{}
23+
24+
func generatek8seventsRbacRules(_ logr.Logger, _ k8seventsConfig) ([]rbacv1.PolicyRule, error) {
25+
// The k8s Events Receiver needs get permissions on the following resources always.
26+
return []rbacv1.PolicyRule{
27+
{
28+
APIGroups: []string{""},
29+
Resources: []string{
30+
"events",
31+
"namespaces",
32+
"namespaces/status",
33+
"nodes",
34+
"nodes/spec",
35+
"pods",
36+
"pods/status",
37+
"replicationcontrollers",
38+
"replicationcontrollers/status",
39+
"resourcequotas",
40+
"services",
41+
},
42+
Verbs: []string{"get", "list", "watch"},
43+
},
44+
{
45+
APIGroups: []string{"apps"},
46+
Resources: []string{
47+
"daemonsets",
48+
"deployments",
49+
"replicasets",
50+
"statefulsets",
51+
},
52+
Verbs: []string{"get", "list", "watch"},
53+
},
54+
{
55+
APIGroups: []string{"extensions"},
56+
Resources: []string{
57+
"daemonsets",
58+
"deployments",
59+
"replicasets",
60+
},
61+
Verbs: []string{"get", "list", "watch"},
62+
},
63+
{
64+
APIGroups: []string{"batch"},
65+
Resources: []string{
66+
"jobs",
67+
"cronjobs",
68+
},
69+
Verbs: []string{"get", "list", "watch"},
70+
},
71+
{
72+
APIGroups: []string{"autoscaling"},
73+
Resources: []string{
74+
"horizontalpodautoscalers",
75+
},
76+
Verbs: []string{"get", "list", "watch"},
77+
},
78+
}, nil
79+
}

‎tests/e2e-automatic-rbac/extra-permissions-operator/cronjobs.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
- op: add
3+
path: /rules/-
4+
value:
5+
apiGroups:
6+
- batch
7+
resources:
8+
- cronjobs
9+
verbs:
10+
- get
11+
- list
12+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/daemonsets.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
- op: add
2+
path: /rules/-
3+
value:
4+
apiGroups:
5+
- extensions
6+
resources:
7+
- daemonsets
8+
verbs:
9+
- get
10+
- list
11+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/nodes-stats.yaml ‎tests/e2e-automatic-rbac/extra-permissions-operator/events.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
1-
---
21
- op: add
32
path: /rules/-
43
value:
54
apiGroups:
65
- ""
76
resources:
8-
- nodes/stats
7+
- events
98
verbs:
109
- get
10+
- list
11+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/extensions.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
- op: add
3+
path: /rules/-
4+
value:
5+
apiGroups:
6+
- extensions
7+
resources:
8+
- deployments
9+
- replicasets
10+
verbs:
11+
- get
12+
- list
13+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/namespaces-status.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
- op: add
2+
path: /rules/-
3+
value:
4+
apiGroups:
5+
- ""
6+
resources:
7+
- namespaces/status
8+
verbs:
9+
- get
10+
- list
11+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/nodes-proxy.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
apiGroups:
66
- ""
77
resources:
8+
- nodes/stats
89
- nodes/proxy
910
verbs:
1011
- get

‎tests/e2e-automatic-rbac/extra-permissions-operator/nodes-spec.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
- op: add
3+
path: /rules/-
4+
value:
5+
apiGroups:
6+
- ""
7+
resources:
8+
- nodes/spec
9+
verbs:
10+
- get
11+
- list
12+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/nodes.yaml

-20
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,3 @@
1010
- get
1111
- list
1212
- watch
13-
---
14-
- op: add
15-
path: /rules/-
16-
value:
17-
apiGroups:
18-
- ""
19-
resources:
20-
- nodes/proxy
21-
verbs:
22-
- get
23-
---
24-
- op: add
25-
path: /rules/-
26-
value:
27-
apiGroups:
28-
- ""
29-
resources:
30-
- nodes/stats
31-
verbs:
32-
- get

‎tests/e2e-automatic-rbac/extra-permissions-operator/pod-status.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
- op: add
3+
path: /rules/-
4+
value:
5+
apiGroups:
6+
- ""
7+
resources:
8+
- pods/status
9+
verbs:
10+
- get
11+
- list
12+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/replicationcontrollers.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
- op: add
2+
path: /rules/-
3+
value:
4+
apiGroups:
5+
- ""
6+
resources:
7+
- replicationcontrollers
8+
- replicationcontrollers/status
9+
verbs:
10+
- get
11+
- list
12+
- watch

‎tests/e2e-automatic-rbac/extra-permissions-operator/resourcequotas.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
- op: add
2+
path: /rules/-
3+
value:
4+
apiGroups:
5+
- ""
6+
resources:
7+
- resourcequotas
8+
verbs:
9+
- get
10+
- list
11+
- watch

‎tests/e2e-automatic-rbac/receiver-k8sevents/00-install.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: chainsaw-k8s-events

‎tests/e2e-automatic-rbac/receiver-k8sevents/01-assert.yaml

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: simplest-chainsaw-k8s-events-cluster-role
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- events
10+
- namespaces
11+
- namespaces/status
12+
- nodes
13+
- nodes/spec
14+
- pods
15+
- pods/status
16+
- replicationcontrollers
17+
- replicationcontrollers/status
18+
- resourcequotas
19+
- services
20+
verbs:
21+
- get
22+
- list
23+
- watch
24+
- apiGroups:
25+
- apps
26+
resources:
27+
- daemonsets
28+
- deployments
29+
- replicasets
30+
- statefulsets
31+
verbs:
32+
- get
33+
- list
34+
- watch
35+
- apiGroups:
36+
- extensions
37+
resources:
38+
- daemonsets
39+
- deployments
40+
- replicasets
41+
verbs:
42+
- get
43+
- list
44+
- watch
45+
- apiGroups:
46+
- batch
47+
resources:
48+
- jobs
49+
- cronjobs
50+
verbs:
51+
- get
52+
- list
53+
- watch
54+
- apiGroups:
55+
- autoscaling
56+
resources:
57+
- horizontalpodautoscalers
58+
verbs:
59+
- get
60+
- list
61+
- watch
62+
---
63+
apiVersion: rbac.authorization.k8s.io/v1
64+
kind: ClusterRoleBinding
65+
metadata:
66+
labels:
67+
app.kubernetes.io/component: opentelemetry-collector
68+
app.kubernetes.io/instance: chainsaw-k8s-events.simplest
69+
app.kubernetes.io/managed-by: opentelemetry-operator
70+
app.kubernetes.io/name: simplest-chainsaw-k8s-events-collector
71+
app.kubernetes.io/part-of: opentelemetry
72+
name: simplest-chainsaw-k8s-events-collector
73+
roleRef:
74+
apiGroup: rbac.authorization.k8s.io
75+
kind: ClusterRole
76+
name: simplest-chainsaw-k8s-events-cluster-role
77+
subjects:
78+
- kind: ServiceAccount
79+
name: simplest-collector
80+
namespace: chainsaw-k8s-events

‎tests/e2e-automatic-rbac/receiver-k8sevents/01-install.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: opentelemetry.io/v1alpha1
2+
kind: OpenTelemetryCollector
3+
metadata:
4+
name: simplest
5+
namespace: chainsaw-k8s-events
6+
spec:
7+
config: |
8+
receivers:
9+
k8s_events:
10+
processors:
11+
exporters:
12+
debug:
13+
service:
14+
pipelines:
15+
traces:
16+
receivers: [k8s_events]
17+
processors: []
18+
exporters: [debug]

0 commit comments

Comments
 (0)