-
Notifications
You must be signed in to change notification settings - Fork 8
/
cluster_role_binding.go
70 lines (56 loc) · 1.79 KB
/
cluster_role_binding.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
// Copyright 2021 New Relic Corporation. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
package agent
import (
"context"
"fmt"
rbacv1 "k8s.io/api/rbac/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
)
const (
defaultServiceAccount = "default"
)
// ensureClusterRoleBindingSubject ensures that the clusterRolebinding exists and it is well configured, otherwise
// patches the existing object.
func (i *injector) ensureClusterRoleBindingSubject(
ctx context.Context,
serviceAccountName string,
serviceAccountNamespace string) error {
crb := &rbacv1.ClusterRoleBinding{}
key := client.ObjectKey{
Name: i.clusterRoleBindingName,
}
if err := i.client.Get(ctx, key, crb); err != nil {
return fmt.Errorf("getting ClusterRoleBinding %q: %w", i.clusterRoleBindingName, err)
}
if serviceAccountName == "" {
serviceAccountName = defaultServiceAccount
}
if hasSubject(crb, serviceAccountName, serviceAccountNamespace) {
return nil
}
return i.updateClusterRoleBinding(ctx, crb, serviceAccountName, serviceAccountNamespace)
}
func (i *injector) updateClusterRoleBinding(
ctx context.Context,
crb *rbacv1.ClusterRoleBinding,
serviceAccountName string,
serviceAccountNamespace string) error {
crb.Subjects = append(crb.Subjects, rbacv1.Subject{
Kind: rbacv1.ServiceAccountKind,
Name: serviceAccountName,
Namespace: serviceAccountNamespace,
})
if err := i.client.Update(ctx, crb, &client.UpdateOptions{}); err != nil {
return fmt.Errorf("updating ClusterRoleBinding: %w", err)
}
return nil
}
func hasSubject(crb *rbacv1.ClusterRoleBinding, serviceAccountName string, namespace string) bool {
for _, s := range crb.Subjects {
if s.Name == serviceAccountName && s.Namespace == namespace && s.Kind == rbacv1.ServiceAccountKind {
return true
}
}
return false
}