Repository navigation
add-WATCH_NAMESPACE-env-var-with-RBAC-scoping - #1172
Open
nickozilla wants to merge 1 commit into
Open
nickozilla wants to merge 1 commit into
nickozilla wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an optional
WATCH_NAMESPACEenvironment variable to the operator component. It accepts a comma-separated list of namespaces; when unset or empty, behaviour is unchanged (cluster-wide).When set, the manager cache is restricted to the listed namespaces via
cache.Options.DefaultNamespaces, so the plugin no longer lists or watches anything outside them. This allows running with a namespacedRoleandRoleBindinginstead of the currentClusterRole(cluster-wide access to Secrets, Roles and RoleBindings).The env var name and format match
WATCH_NAMESPACEin cloudnative-pg. Unlike cloudnative-pg, this uses plainDefaultNamespacesrather than the custom multicache, since all operator-side reads use the Cluster's own namespace. A Cluster outside the watched namespaces will get an error from the Pre hook.This is the Go side only. The namespaced RBAC and passing
WATCH_NAMESPACEthrough the Deployment need a follow-up in cloudnative-pg/charts. Part of cloudnative-pg/charts#1056.Context: https://cloud-native.slack.com/archives/C08MW1HKF40/p1791888507120499
Testing: unit tests for the namespace parsing. Not yet tested against a live cluster with namespaced-only RBAC.