🐛 fix roles names for projects with multi-group layout

kubernetes-sigs · Apr 5, 2024 · 96274c6 · 96274c6
1 parent 4e206d8
commit 96274c6
Show file tree

Hide file tree

Showing 38 changed files with 70 additions and 38 deletions.
diff --git a/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/rbac/crd_editor_role.go b/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/rbac/crd_editor_role.go
@@ -14,10 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+//nolint:dupl
 package rbac
 
 import (
+	"fmt"
 	"path/filepath"
+	"strings"
 
 	"sigs.k8s.io/kubebuilder/v3/pkg/machinery"
 )
@@ -30,6 +33,8 @@ type CRDEditorRole struct {
 	machinery.MultiGroupMixin
 	machinery.ResourceMixin
 	machinery.ProjectNameMixin
+
+	RoleName string
 }
 
 // SetTemplateDefaults implements file.Template
@@ -44,6 +49,17 @@ func (f *CRDEditorRole) SetTemplateDefaults() error {
 	}
 	f.Path = f.Resource.Replacer().Replace(f.Path)
 
+	if f.RoleName == "" {
+		if f.MultiGroup && f.Resource.Group != "" {
+			f.RoleName = fmt.Sprintf("%s-%s-editor-role",
+				strings.ToLower(f.Resource.Group),
+				strings.ToLower(f.Resource.Kind))
+		} else {
+			f.RoleName = fmt.Sprintf("%s-editor-role",
+				strings.ToLower(f.Resource.Kind))
+		}
+	}
+
 	f.TemplateBody = crdRoleEditorTemplate
 
 	return nil
@@ -60,7 +76,7 @@ metadata:
     app.kubernetes.io/created-by: {{ .ProjectName }}
     app.kubernetes.io/part-of: {{ .ProjectName }}
     app.kubernetes.io/managed-by: kustomize
-  name: {{ lower .Resource.Kind }}-editor-role
+  name: {{ .RoleName }}
 rules:
 - apiGroups:
   - {{ .Resource.QualifiedGroup }}

diff --git a/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/rbac/crd_viewer_role.go b/pkg/plugins/common/kustomize/v2/scaffolds/internal/templates/config/rbac/crd_viewer_role.go
@@ -14,10 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+//nolint:dupl
 package rbac
 
 import (
+	"fmt"
 	"path/filepath"
+	"strings"
 
 	"sigs.k8s.io/kubebuilder/v3/pkg/machinery"
 )
@@ -30,6 +33,8 @@ type CRDViewerRole struct {
 	machinery.MultiGroupMixin
 	machinery.ResourceMixin
 	machinery.ProjectNameMixin
+
+	RoleName string
 }
 
 // SetTemplateDefaults implements file.Template
@@ -44,6 +49,17 @@ func (f *CRDViewerRole) SetTemplateDefaults() error {
 	}
 	f.Path = f.Resource.Replacer().Replace(f.Path)
 
+	if f.RoleName == "" {
+		if f.MultiGroup && f.Resource.Group != "" {
+			f.RoleName = fmt.Sprintf("%s-%s-viewer-role",
+				strings.ToLower(f.Resource.Group),
+				strings.ToLower(f.Resource.Kind))
+		} else {
+			f.RoleName = fmt.Sprintf("%s-viewer-role",
+				strings.ToLower(f.Resource.Kind))
+		}
+	}
+
 	f.TemplateBody = crdRoleViewerTemplate
 
 	return nil
@@ -60,7 +76,7 @@ metadata:
     app.kubernetes.io/created-by: {{ .ProjectName }}
     app.kubernetes.io/part-of: {{ .ProjectName }}
     app.kubernetes.io/managed-by: kustomize
-  name: {{ lower .Resource.Kind }}-viewer-role
+  name: {{ .RoleName }}
 rules:
 - apiGroups:
   - {{ .Resource.QualifiedGroup }}

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/crew_captain_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/crew_captain_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: captain-editor-role
+  name: crew-captain-editor-role
 rules:
 - apiGroups:
   - crew.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/crew_captain_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/crew_captain_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: captain-viewer-role
+  name: crew-captain-viewer-role
 rules:
 - apiGroups:
   - crew.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/fiz_bar_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/fiz_bar_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: bar-editor-role
+  name: fiz-bar-editor-role
 rules:
 - apiGroups:
   - fiz.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/fiz_bar_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/fiz_bar_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: bar-viewer-role
+  name: fiz-bar-viewer-role
 rules:
 - apiGroups:
   - fiz.testproject.org

diff --git a/...v4-multigroup-with-deploy-image/config/rbac/foo.policy_healthcheckpolicy_editor_role.yaml b/...v4-multigroup-with-deploy-image/config/rbac/foo.policy_healthcheckpolicy_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: healthcheckpolicy-editor-role
+  name: foo.policy-healthcheckpolicy-editor-role
 rules:
 - apiGroups:
   - foo.policy.testproject.org

diff --git a/...v4-multigroup-with-deploy-image/config/rbac/foo.policy_healthcheckpolicy_viewer_role.yaml b/...v4-multigroup-with-deploy-image/config/rbac/foo.policy_healthcheckpolicy_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: healthcheckpolicy-viewer-role
+  name: foo.policy-healthcheckpolicy-viewer-role
 rules:
 - apiGroups:
   - foo.policy.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/foo_bar_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/foo_bar_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: bar-editor-role
+  name: foo-bar-editor-role
 rules:
 - apiGroups:
   - foo.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/foo_bar_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/foo_bar_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: bar-viewer-role
+  name: foo-bar-viewer-role
 rules:
 - apiGroups:
   - foo.testproject.org

diff --git a/...project-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_kraken_editor_role.yaml b/...project-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_kraken_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: kraken-editor-role
+  name: sea-creatures-kraken-editor-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/...project-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_kraken_viewer_role.yaml b/...project-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_kraken_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: kraken-viewer-role
+  name: sea-creatures-kraken-viewer-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/...ject-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_leviathan_editor_role.yaml b/...ject-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_leviathan_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: leviathan-editor-role
+  name: sea-creatures-leviathan-editor-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/...ject-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_leviathan_viewer_role.yaml b/...ject-v4-multigroup-with-deploy-image/config/rbac/sea-creatures_leviathan_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: leviathan-viewer-role
+  name: sea-creatures-leviathan-viewer-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_cruiser_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_cruiser_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: cruiser-editor-role
+  name: ship-cruiser-editor-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_cruiser_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_cruiser_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: cruiser-viewer-role
+  name: ship-cruiser-viewer-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_destroyer_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_destroyer_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: destroyer-editor-role
+  name: ship-destroyer-editor-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_destroyer_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_destroyer_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: destroyer-viewer-role
+  name: ship-destroyer-viewer-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_frigate_editor_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_frigate_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: frigate-editor-role
+  name: ship-frigate-editor-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_frigate_viewer_role.yaml b/testdata/project-v4-multigroup-with-deploy-image/config/rbac/ship_frigate_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/part-of: project-v4-multigroup-with-deploy-image
     app.kubernetes.io/managed-by: kustomize
-  name: frigate-viewer-role
+  name: ship-frigate-viewer-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/crew_captain_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/crew_captain_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: captain-editor-role
+  name: crew-captain-editor-role
 rules:
 - apiGroups:
   - crew.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/crew_captain_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/crew_captain_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: captain-viewer-role
+  name: crew-captain-viewer-role
 rules:
 - apiGroups:
   - crew.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/fiz_bar_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/fiz_bar_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: bar-editor-role
+  name: fiz-bar-editor-role
 rules:
 - apiGroups:
   - fiz.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/fiz_bar_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/fiz_bar_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: bar-viewer-role
+  name: fiz-bar-viewer-role
 rules:
 - apiGroups:
   - fiz.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/foo.policy_healthcheckpolicy_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/foo.policy_healthcheckpolicy_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: healthcheckpolicy-editor-role
+  name: foo.policy-healthcheckpolicy-editor-role
 rules:
 - apiGroups:
   - foo.policy.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/foo.policy_healthcheckpolicy_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/foo.policy_healthcheckpolicy_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: healthcheckpolicy-viewer-role
+  name: foo.policy-healthcheckpolicy-viewer-role
 rules:
 - apiGroups:
   - foo.policy.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/foo_bar_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/foo_bar_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: bar-editor-role
+  name: foo-bar-editor-role
 rules:
 - apiGroups:
   - foo.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/foo_bar_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/foo_bar_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: bar-viewer-role
+  name: foo-bar-viewer-role
 rules:
 - apiGroups:
   - foo.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/sea-creatures_kraken_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/sea-creatures_kraken_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: kraken-editor-role
+  name: sea-creatures-kraken-editor-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/sea-creatures_kraken_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/sea-creatures_kraken_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: kraken-viewer-role
+  name: sea-creatures-kraken-viewer-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/sea-creatures_leviathan_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/sea-creatures_leviathan_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: leviathan-editor-role
+  name: sea-creatures-leviathan-editor-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/sea-creatures_leviathan_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/sea-creatures_leviathan_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: leviathan-viewer-role
+  name: sea-creatures-leviathan-viewer-role
 rules:
 - apiGroups:
   - sea-creatures.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/ship_cruiser_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/ship_cruiser_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: cruiser-editor-role
+  name: ship-cruiser-editor-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/ship_cruiser_viewer_role.yaml b/testdata/project-v4-multigroup/config/rbac/ship_cruiser_viewer_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: cruiser-viewer-role
+  name: ship-cruiser-viewer-role
 rules:
 - apiGroups:
   - ship.testproject.org

diff --git a/testdata/project-v4-multigroup/config/rbac/ship_destroyer_editor_role.yaml b/testdata/project-v4-multigroup/config/rbac/ship_destroyer_editor_role.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/created-by: project-v4-multigroup
     app.kubernetes.io/part-of: project-v4-multigroup
     app.kubernetes.io/managed-by: kustomize
-  name: destroyer-editor-role
+  name: ship-destroyer-editor-role
 rules:
 - apiGroups:
   - ship.testproject.org