Add test for disabled ServiceAccount and permissions

charts/hivemq-platform-operator/templates/bindings.yml

@@ -3,22 +3,27 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: "hivemq-platform-operator-view-{{.Release.Name}}"
+  name: "hivemq-platform-operator-view-binding-{{.Release.Name}}"
+  labels:
+    {{- include "hivemq-platform-operator.labels" . | nindent 4 }}
 roleRef:
-  kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
   name: view
 subjects:
   - kind: ServiceAccount
     name: {{ include "hivemq-platform-operator.serviceAccountName" . }}
+    namespace: {{.Release.Namespace}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: "hivemq-platform-operator-role-binding-{{.Release.Name}}"
+  labels:
+    {{- include "hivemq-platform-operator.labels" . | nindent 4 }}
 roleRef:
-  kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
   name: "hivemq-platform-operator-role-{{.Release.Name}}"
 subjects:
   - kind: ServiceAccount

charts/hivemq-platform-operator/templates/deployment.yml

@@ -1,9 +1,9 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  name: {{include "hivemq-platform-operator.name" . }}
   labels:
     {{- include "hivemq-platform-operator.labels" . | nindent 4 }}
-  name: {{include "hivemq-platform-operator.name" . }}
 spec:
   # The Operator cannot have more than one replica
   replicas: 1

charts/hivemq-platform-operator/templates/service-account.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  name: {{ include "hivemq-platform-operator.serviceAccountName" . }}
   labels:
     {{- include "hivemq-platform-operator.labels" . | nindent 4 }}
-  name: {{ include "hivemq-platform-operator.serviceAccountName" . }}
 {{- end }}

charts/hivemq-platform-operator/templates/service.yml

@@ -3,9 +3,9 @@
 apiVersion: v1
 kind: Service
 metadata:
+  name: "hivemq-platform-operator-{{.Release.Name}}"
   labels:
     {{- include "hivemq-platform-operator.labels" . | nindent 4 }}
-  name: "hivemq-platform-operator-{{.Release.Name}}"
 spec:
   ports:
     - name: {{ printf "http-%s" .Release.Name }}

manifests/hivemq-platform-operator/bindings.yml

@@ -4,9 +4,13 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: "hivemq-platform-operator-role-binding-my-operator"
+  labels:
+    app.kubernetes.io/name: "hivemq-platform-operator"
+    app.kubernetes.io/instance: "my-operator"
+    app.kubernetes.io/version: "1.3.1"
 roleRef:
-  kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
   name: "hivemq-platform-operator-role-my-operator"
 subjects:
   - kind: ServiceAccount
@@ -17,11 +21,16 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: "hivemq-platform-operator-view-my-operator"
+  name: "hivemq-platform-operator-view-binding-my-operator"
+  labels:
+    app.kubernetes.io/name: "hivemq-platform-operator"
+    app.kubernetes.io/instance: "my-operator"
+    app.kubernetes.io/version: "1.3.1"
 roleRef:
-  kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
   name: view
 subjects:
   - kind: ServiceAccount
     name: hivemq-platform-operator-my-operator
+    namespace: default

manifests/hivemq-platform-operator/deployment.yml

@@ -3,11 +3,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  name: hivemq-my-operator
   labels:
     app.kubernetes.io/name: "hivemq-platform-operator"
     app.kubernetes.io/instance: "my-operator"
     app.kubernetes.io/version: "1.3.1"
-  name: hivemq-my-operator
 spec:
   # The Operator cannot have more than one replica
   replicas: 1

manifests/hivemq-platform-operator/service-account.yml

@@ -3,8 +3,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
+  name: hivemq-platform-operator-my-operator
   labels:
     app.kubernetes.io/name: "hivemq-platform-operator"
     app.kubernetes.io/instance: "my-operator"
     app.kubernetes.io/version: "1.3.1"
-  name: hivemq-platform-operator-my-operator

manifests/hivemq-platform-operator/service.yml

@@ -3,11 +3,11 @@
 apiVersion: v1
 kind: Service
 metadata:
+  name: "hivemq-platform-operator-my-operator"
   labels:
     app.kubernetes.io/name: "hivemq-platform-operator"
     app.kubernetes.io/instance: "my-operator"
     app.kubernetes.io/version: "1.3.1"
-  name: "hivemq-platform-operator-my-operator"
 spec:
   ports:
     - name: http-my-operator

tests-hivemq-platform-operator/src/integrationTest/java/com/hivemq/helmcharts/single/HelmCustomServiceAccountIT.java

@@ -16,6 +16,7 @@
 import java.util.concurrent.TimeUnit;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.awaitility.Awaitility.await;
 
 @Tag("CustomConfig")
 @Tag("ServiceAccount")
@@ -52,6 +53,9 @@ void platformCharts_withNonExistingCustomServiceAccountThenCreate_hivemqRunning(
         K8sUtil.createServiceAccount(client, platformNamespace, SERVICE_ACCOUNT_NAME);
 
         K8sUtil.waitForHiveMQPlatformStateRunning(client, platformNamespace, PLATFORM_RELEASE_NAME);
+
+        // assert that the ServiceAccount and permissions are working
+        assertPlatformPodAnnotations();
     }
 
     @Test
@@ -88,6 +92,9 @@ void platformCharts_withNonExistingPermissionsThenCreate_hivemqRunning() throws
         createRoleBinding();
 
         K8sUtil.waitForHiveMQPlatformStateRunning(client, platformNamespace, PLATFORM_RELEASE_NAME);
+
+        // assert that the ServiceAccount and permissions are working
+        assertPlatformPodAnnotations();
     }
 
     @Test
@@ -118,6 +125,42 @@ void platformCharts_withCreationAndValidationDisabled_withCorrectExternalPermiss
                 platformNamespace);
 
         K8sUtil.waitForHiveMQPlatformStateRunning(client, platformNamespace, PLATFORM_RELEASE_NAME);
+
+        // assert that the ServiceAccount and permissions are working
+        assertPlatformPodAnnotations();
+    }
+
+    @Test
+    @Timeout(value = 5, unit = TimeUnit.MINUTES)
+    void platformCharts_withCreateAndValidateDisabled_hivemqRunning() throws Exception {
+        helmChartContainer.installOperatorChart(OPERATOR_RELEASE_NAME,
+                "--set",
+                "hivemqPlatformServiceAccount.create=false",
+                "--set",
+                "hivemqPlatformServiceAccount.validate=false",
+                "--set",
+                "hivemqPlatformServiceAccount.permissions.create=false",
+                "--set",
+                "hivemqPlatformServiceAccount.permissions.validate=false",
+                "--namespace",
+                operatorNamespace);
+        helmChartContainer.installPlatformChart(PLATFORM_RELEASE_NAME,
+                "--set",
+                "nodes.serviceAccountName=" + SERVICE_ACCOUNT_NAME,
+                "--set",
+                "nodes.replicaCount=1",
+                "--namespace",
+                platformNamespace);
+
+        // create the ServiceAccount and permissions correctly
+        K8sUtil.createServiceAccount(client, platformNamespace, SERVICE_ACCOUNT_NAME);
+        createRole();
+        createRoleBinding();
+
+        K8sUtil.waitForHiveMQPlatformStateRunning(client, platformNamespace, PLATFORM_RELEASE_NAME);
+
+        // assert that the ServiceAccount and permissions are working
+        assertPlatformPodAnnotations();
     }
 
     private void createRole() {
@@ -146,4 +189,15 @@ private void createRoleBinding() {
                 .build()).create();
         assertThat(roleBinding).isNotNull();
     }
+
+    private void assertPlatformPodAnnotations() {
+        // asserts an annotation that is set by the PodReconciler in the Platform Pods
+        // when the ServiceAccount and permissions are set up correctly
+        await().untilAsserted(() -> client.pods()
+                .inNamespace(platformNamespace)
+                .list()
+                .getItems()
+                .forEach(pod -> assertThat(pod.getMetadata().getAnnotations()) //
+                        .containsKey("hivemq/platform-operator-init-app-version")));
+    }
 }