✨ rbac: deduplicate having the same groups, resourceNames, URLs and Verbs

[chrischdi]

This improves the output of controller-gens rbac generator to further deduplicate the output.

It now:

• first separates the rules by namespace and resource
• and later deduplicates on the set resources if the rules are otherwise the same (excluding resource).
• and also deduplicates based on apiGroups if possible.

The first commit only adds test data.

The second commit adds the change for deduplicating based on resources

The third commit deduplicates on apiGroups.

[chrischdi]

Note: this change allows to use the directly generated output as golden file. The [1:] is not necessary anymore because the document starts with ---\n

[sbueringer]

A few smaller findings and some ideas to test more before merge

[chrischdi]

Could you also open a PR against core CAPI using this PR? (doesn't have to be a clean install of the binary, just want to validate the differences in generated roles)

(I would also bump to CT main once this PR merges in CAPI)

Example PR: kubernetes-sigs/cluster-api#10612

[sbueringer]

Thx!

CAPI PR looks entirely as expected

Really nice optimization, Roles look much cleaner now

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 3578a43773ef68570ca017fb76ea52b800335039

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chrischdi, sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pmalek]

Just tested 0.16.1 with this change and there's 1 little quirk:

If I have 2 different but logically identical codemarkers:

//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch

and

// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch

I'll get the following generated with 0.16.1:

rules:
- apiGroups:
  - ""
  - ""
  resources:
  - events
  verbs:
  - create
  - patch

The workaround is to use the same apigroup everywhere.

[sbueringer]

Ah interesting. Can you open an issue for that, please?

We should be able to improve this further :)

(cc @chrischdi, maybe you have some time to look into it (let's also add test coverage for this case))

[pmalek]

Ah interesting. Can you open an issue for that, please?

We should be able to improve this further :)

(cc @chrischdi, maybe you have some time to look into it (let's also add test coverage for this case))

@sbueringer #1036

[rakesh-garimella]

Hi @chrischdi I tested the change with 0.16.1. Found one possible issue. We have some codemarker for nonResourceURLs

//+kubebuilder:rbac:urls=/metrics,verbs=get
//+kubebuilder:rbac:urls=/metrics/cadvisor,verbs=get

But after generating the manifests these RBAC are missing.

[chrischdi]

Thanks for reporting @rakesh-garimella .

#1044 should fix this.