Remove unnecessary CRDs and RBAC rules #3491
Conversation
|
/test-multicluster-e2e |
Codecov Report
@@ Coverage Diff @@
## main #3491 +/- ##
===========================================
- Coverage 65.49% 54.41% -11.08%
===========================================
Files 278 392 +114
Lines 27750 42958 +15208
===========================================
+ Hits 18174 23377 +5203
- Misses 7657 17257 +9600
- Partials 1919 2324 +405
Flags with carried forward coverage won't be shown. Click here to find out more.
|
| @@ -7,8 +7,10 @@ resources: | |||
| - service_account.yaml | |||
| - role.yaml | |||
| - role_binding.yaml | |||
| - leader_election_role.yaml | |||
| - leader_election_role_binding.yaml | |||
| # We disabled leader election in manager, so this role and | |||
There was a problem hiding this comment.
What does "manager" refer to here?
There was a problem hiding this comment.
I mean an option in a kubebuilder manager initialization which is used by leader and member controllers. let me change it to controller for easy understanding.
|
@tnqn @luolanzone can we merge #3488 first? Otherwise |
|
Could you explain the following in more details? Does that indicate that in the future, rbac rules for member/leader needs to be manually added (in /config/overlays/member/roles.yml for example)? If so, is |
correct, we need manually add all required roles separately in the future, role.yaml is automatically generated when we run |
| @@ -7,8 +7,11 @@ resources: | |||
| - service_account.yaml | |||
| - role.yaml | |||
| - role_binding.yaml | |||
| - leader_election_role.yaml | |||
| - leader_election_role_binding.yaml | |||
| # We disabled leader election in controller, so this role and | |||
There was a problem hiding this comment.
I think we should make it clearer. Do you mean Multi-cluster Controller or antrea-mc-controller?
There was a problem hiding this comment.
sure, let me change it to Multi-cluster Controller.
| kind: ClusterRole | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: controller-role |
There was a problem hiding this comment.
We could not use a name like "controller-role" which can easily conflicts with other controllers in the cluster. Add "antrea-mc-" prefix for all such K8s standard resources.
There was a problem hiding this comment.
yes, this is a base file, we add a prefix antrea-mc- in kustomization.yml which will add this prefix in final manifest.
|
/test-multicluster-e2e |
luolanzone
changed the title
|
/test-multicluster-e2e |
|
@Dyanngg multicluster e2e passed after I rebased my changes on top of your ACNP e2e. but I checked the ACNP e2e test, it only verify the replicated ACNP's realization, no failed case for event creation, I manually tried it, it works as expected. so I think this PR can work fine with latest ACNP changes. |
|
@luolanzone could you rebase? |
Some CRDs and access control rules are required by member or leader only, so remove unused CRDs and RBAC rules in separate leader and member manifests. Please note: since Kustomize didn't support deleteFromPrimitiveList, it's unable to remove elements in all-in-one RBAC rules through overlay setting, so I added separate rbac files for both leader and member. It means if you use kubebuilder comment marker without adding them into right overlay role files, you will only get the change in all-in-one file which it's the file `multicluster/config/rbac/role.yaml`. Signed-off-by: Lan Luo <[email protected]>
|
/test-multicluster-e2e |
|
@tnqn rebase is done, MC e2e is triggered. thanks. |
|
/skip-all |
Fixes #3489
This PR is based on #3435, only the last commit is relevant to this PR.
Some CRDs and access control rules are required by member or leader
only, so remove unused CRDs and RBAC rules in separate leader and member
manifests.
Please note: since Kustomize didn't support deleteFromPrimitiveList,
it's unable to remove elements in all-in-one RBAC rules through overlay
setting, so I added separate rbac files for both leader and member. It means
if you use kubebuilder comment marker without adding them into right overlay role files, you will only
get the change in all-in-one file which it's the file in
multicluster/config/rbac/role.yaml.Signed-off-by: Lan Luo [email protected]