-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Name ClusterRole objects to be namespace-specific #1295
Conversation
FWIW the relevant integration tests passed on the community cluster, though failed with something unrelated, confirmed this also happens on master:
|
@siggy Interesting. I think that integration test failure that you're seeing is: #1265 (comment) -- my guess is that the grafana pod is taking longer than 1-minute to enter the Ready state. |
Why are these |
Also, I think every object we create should have the product name in it, so that we can minimize the likelihood that our objects will clash with users' objects if/when they install the conduit control plane into a namespace where they have other objects (e.g. because they are only able to create objects in one namespace). |
Unfortunately we need
Yeah, because we don't want objects conflicting between multiple control-plane namespaces, I ended up putting the namespace in the names, but you are right that this would create objects like /cc @briansmith |
@siggy Thanks for explaining that. I think that in the future we may be able to do something more fine-grained than I do think that |
f6e3789
to
23f229b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⭐️ Looks good to me. Thanks for fixing this!
The control-plane's `ClusterRole` and `ClusterRoleBinding` objects are global. Because their names did not vary across multiple control-plane deployments, it prevented multiple control-planes from coexisting (when RBAC is enabled). Modify the `ClusterRole` and `ClusterRoleBinding` objects to include the control-plane's namespace in their names. Also modify the integration test to first install two control-planes, and then perform its full suite of tests, to prevent regression. Fixes #1292. Signed-off-by: Andrew Seigner <siggy@buoyant.io>
23f229b
to
66d5e8b
Compare
The control-plane's
ClusterRole
andClusterRoleBinding
objects areglobal. Because their names did not vary across multiple control-plane
deployments, it prevented multiple control-planes from coexisting (when
RBAC is enabled).
Modify the
ClusterRole
andClusterRoleBinding
objects to include thecontrol-plane's namespace in their names. Also modify the integration
test to first install two control-planes, and then perform its full
suite of tests, to prevent regression.
Fixes #1292.
Signed-off-by: Andrew Seigner siggy@buoyant.io