Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updates webhook cluster role to work with Owner References #4269

Merged
merged 1 commit into from
Oct 1, 2021
Merged

Updates webhook cluster role to work with Owner References #4269

merged 1 commit into from
Oct 1, 2021

Conversation

skaegi
Copy link
Contributor

@skaegi skaegi commented Oct 1, 2021 •
edited

When running on Kubernetes platforms like OpenShift where the OwnerReferencesPermissionEnforcement is "on" we need to have additional ClusterRole rules added. In particular the knative tooling for our webhooks is assigning the OwnerRef of the (mutating/validating)webhookconfiguration resources to the tekton-pipelines namespace.

Fixes #4258

Changes

We need to update the webhooks ClusterRole to allow "delete" for both mutatingwebhookconfigurations and validatingwebhookconfigurations as well as "update" for namespaces/finalizers for the tekton-pipelines namespace.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

  • Docs included if any changes are user facing
  • Tests included if any functionality added or changed
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including
    functionality, content, code)
  • Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

NONE

@skaegi
Updates webhook cluster role to work with OwnerReferencesPermissionEn…
de44ac1 
…forcement

When running on Kubernetes platforms like OpenShift where the OwnerReferencesPermissionEnforcement is "on" we need to have additional ClusterRole rules added. In particular our knative tooling for our webhooks is assigning the OwnerRef of the (mutating/validating)webhookconfiguration resources to the tekton-pipelines namespace.

We need to update the webhooks ClusterRole to allow "delete" for both `mutatingwebhookconfigurations` and `validatingwebhookconfigurations` as well as "update" for `namespaces/finalizers` for the tekton-pipelines namespace.
@tekton-robot tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Oct 1, 2021
@tekton-robot tekton-robot requested review from a user and vdemeester October 1, 2021 05:49
@tekton-robot tekton-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 1, 2021
@skaegi
Copy link
Contributor Author

skaegi commented Oct 1, 2021

/kind bug

@tekton-robot tekton-robot added the kind/bug Categorizes issue or PR as related to a bug. label Oct 1, 2021
afrittoli
afrittoli approved these changes Oct 1, 2021
View reviewed changes
Copy link
Member

@afrittoli afrittoli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@tekton-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: afrittoli

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 1, 2021
@afrittoli
Copy link
Member

/test pull-tekton-pipeline-integration-tests

@ghost
Copy link

ghost commented Oct 1, 2021

/lgtm

@tekton-robot tekton-robot assigned ghost Oct 1, 2021
@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 1, 2021
@tekton-robot tekton-robot merged commit 02a2c15 into tektoncd:main Oct 1, 2021
nikhil-thomas added a commit to nikhil-thomas/tektoncd-operator that referenced this pull request Oct 20, 2021
@nikhil-thomas
Add additional permission to Operator role
ad74963 
Add additional permissions to operator based on Pipelines v0.29.0
release. (new permissions from: tektoncd/pipeline pr
tektoncd/pipeline#4269)

Signed-off-by: Nikhil Thomas <nikthoma@redhat.com>
@nikhil-thomas nikhil-thomas mentioned this pull request Oct 20, 2021
Merged
3 tasks
nikhil-thomas added a commit to nikhil-thomas/tektoncd-operator that referenced this pull request Oct 20, 2021
@nikhil-thomas
Add additional permission to Operator role
87c210d 
Add additional permissions to operator based on Pipelines v0.29.0
release. (new permissions from: tektoncd/pipeline pr
tektoncd/pipeline#4269)

Signed-off-by: Nikhil Thomas <nikthoma@redhat.com>
(cherry picked from commit ad74963)
This was referenced Oct 20, 2021
Closed
Closed
tekton-robot pushed a commit to tektoncd/operator that referenced this pull request Oct 20, 2021
@nikhil-thomas @tekton-robot
Add additional permission to Operator role
e9fb0ab 
Add additional permissions to operator based on Pipelines v0.29.0
release. (new permissions from: tektoncd/pipeline pr
tektoncd/pipeline#4269)

Signed-off-by: Nikhil Thomas <nikthoma@redhat.com>
sm43 pushed a commit to sm43/tektoncd-operator that referenced this pull request Oct 25, 2021
@nikhil-thomas
Add additional permission to Operator role
dae6ad9 
Add additional permissions to operator based on Pipelines v0.29.0
release. (new permissions from: tektoncd/pipeline pr
tektoncd/pipeline#4269)

Signed-off-by: Nikhil Thomas <nikthoma@redhat.com>
tekton-robot pushed a commit to tektoncd/operator that referenced this pull request Oct 26, 2021
@nikhil-thomas @tekton-robot
Add additional permission to Operator role
159df47 
Add additional permissions to operator based on Pipelines v0.29.0
release. (new permissions from: tektoncd/pipeline pr
tektoncd/pipeline#4269)

Signed-off-by: Nikhil Thomas <nikthoma@redhat.com>
vdemeester added a commit to vdemeester/tektoncd-operator that referenced this pull request Oct 29, 2021
@vdemeester
Updates webhook cluster role to work with Owner References
81db17a 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
@vdemeester vdemeester mentioned this pull request Oct 29, 2021
Merged
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 2, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
eb78453 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 2, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
dfd1ff1 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 2, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
6e08a10 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 2, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
b0d9963 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 3, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
d6476c4 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 11, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
362e785 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 15, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
1fb41db 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 16, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
2fd3cda 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 17, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
f869a28 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 18, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
9eb83b2 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
nikhil-thomas pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 19, 2021
@vdemeester @nikhil-thomas
Updates webhook cluster role to work with Owner References
bc8b09a 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 22, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
7aa940b 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 22, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
1d8646d 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 22, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
cb3e6f4 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 23, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
37a69f2 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 24, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
bc75084 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 24, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
694563e 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
@savitaashture savitaashture mentioned this pull request Nov 24, 2021
Merged
4 tasks
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Nov 24, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
9740884 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Dec 9, 2021
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
bf230d1 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Jan 20, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
c614388 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Jan 28, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
4f8d4d6 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Feb 1, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
ce3c722 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Feb 2, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
fadfbe4 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
@nikhil-thomas nikhil-thomas mentioned this pull request Feb 5, 2022
Merged
3 tasks
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Feb 5, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
33d5098 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Feb 7, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
ce0dc05 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Feb 9, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
2dafbb2 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request May 17, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
2dad95e 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request May 23, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
15f8a79 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request May 25, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
bf72bec 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
concaf pushed a commit to openshift/tektoncd-operator that referenced this pull request Sep 2, 2022
@vdemeester @concaf
Updates webhook cluster role to work with Owner References
ea1a185 
Backport tektoncd/pipeline#4269 to fix deployment of the
webhook on OpenShift.

Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@afrittoli afrittoli afrittoli approved these changes

@vdemeester vdemeester Awaiting requested review from vdemeester

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/bug Categorizes issue or PR as related to a bug. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesnt merit a release note. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

PipelineRun validation error for params without a type
3 participants
@skaegi @tekton-robot @afrittoli