Skip to content

Commit e1ed503

Browse files
liodo198592周宇tokers
authored
fix: add write permission for leases (#191)
* fix：BUGFIX #182 ,add write permisson of resource:leases in apisix_view_clusterrole.yaml * fix：BUGFIX #182 , add _clusterRole reference in test\e2e\scaffold\ingress.go * fix：BUGFIX #182 , add namespace * fix：BUGFIX #182 , fix format * fix：BUGFIX #182 , fix format * fix * fix * fix: reset finializers Co-authored-by: 周宇 <[email protected]> Co-authored-by: Alex Zhang <[email protected]>
1 parent e2f3541 commit e1ed503

File tree

4 files changed

+165
-3
lines changed

4 files changed

+165
-3
lines changed

‎charts/apisix-ingress-controller/templates/rbac.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,12 @@ rules:
142142
- get
143143
- list
144144
- watch
145+
- apiGroups:
146+
- coordination.k8s.io
147+
resources:
148+
- leases
149+
verbs:
150+
- '*'
145151
---
146152
apiVersion: rbac.authorization.k8s.io/v1
147153
kind: ClusterRoleBinding

‎samples/deploy/rbac/apisix_view_clusterrole.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,9 @@ rules:
142142
- get
143143
- list
144144
- watch
145+
- apiGroups:
146+
- coordination.k8s.io
147+
resources:
148+
- leases
149+
verbs:
150+
- '*'

‎test/e2e/scaffold/ingress.go‎

Lines changed: 152 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020

2121
"github.com/gruntwork-io/terratest/modules/k8s"
2222
"github.com/onsi/ginkgo"
23+
"github.com/stretchr/testify/assert"
2324
coordinationv1 "k8s.io/api/coordination/v1"
2425
corev1 "k8s.io/api/core/v1"
2526
v1 "k8s.io/api/core/v1"
@@ -28,7 +29,142 @@ import (
2829
)
2930

3031
const (
31-
_serviceAccount = "ingress-apisix-e2e-test-service-account"
32+
_serviceAccount = "ingress-apisix-e2e-test-service-account"
33+
_clusterRole = `
34+
apiVersion: rbac.authorization.k8s.io/v1
35+
kind: ClusterRole
36+
metadata:
37+
name: %s-apisix-view-clusterrole
38+
rules:
39+
- apiGroups:
40+
- ""
41+
resources:
42+
- configmaps
43+
- endpoints
44+
- persistentvolumeclaims
45+
- pods
46+
- replicationcontrollers
47+
- replicationcontrollers/scale
48+
- serviceaccounts
49+
- services
50+
verbs:
51+
- get
52+
- list
53+
- watch
54+
- apiGroups:
55+
- ""
56+
resources:
57+
- bindings
58+
- events
59+
- limitranges
60+
- namespaces/status
61+
- pods/log
62+
- pods/status
63+
- replicationcontrollers/status
64+
- resourcequotas
65+
- resourcequotas/status
66+
verbs:
67+
- get
68+
- list
69+
- watch
70+
- apiGroups:
71+
- ""
72+
resources:
73+
- namespaces
74+
verbs:
75+
- get
76+
- list
77+
- watch
78+
- apiGroups:
79+
- apps
80+
resources:
81+
- controllerrevisions
82+
- daemonsets
83+
- deployments
84+
- deployments/scale
85+
- replicasets
86+
- replicasets/scale
87+
- statefulsets
88+
- statefulsets/scale
89+
verbs:
90+
- get
91+
- list
92+
- watch
93+
- apiGroups:
94+
- autoscaling
95+
resources:
96+
- horizontalpodautoscalers
97+
verbs:
98+
- get
99+
- list
100+
- watch
101+
- apiGroups:
102+
- batch
103+
resources:
104+
- cronjobs
105+
- jobs
106+
verbs:
107+
- get
108+
- list
109+
- watch
110+
- apiGroups:
111+
- extensions
112+
resources:
113+
- daemonsets
114+
- deployments
115+
- deployments/scale
116+
- ingresses
117+
- networkpolicies
118+
- replicasets
119+
- replicasets/scale
120+
- replicationcontrollers/scale
121+
verbs:
122+
- get
123+
- list
124+
- watch
125+
- apiGroups:
126+
- policy
127+
resources:
128+
- poddisruptionbudgets
129+
verbs:
130+
- get
131+
- list
132+
- watch
133+
- apiGroups:
134+
- networking.k8s.io
135+
resources:
136+
- ingresses
137+
- networkpolicies
138+
verbs:
139+
- get
140+
- list
141+
- watch
142+
- apiGroups:
143+
- metrics.k8s.io
144+
resources:
145+
- pods
146+
verbs:
147+
- get
148+
- list
149+
- watch
150+
- apiGroups:
151+
- apisix.apache.org
152+
resources:
153+
- apisixroutes
154+
- apisixupstreams
155+
- apisixservices
156+
- apisixtlses
157+
verbs:
158+
- get
159+
- list
160+
- watch
161+
- apiGroups:
162+
- coordination.k8s.io
163+
resources:
164+
- leases
165+
verbs:
166+
- '*'
167+
`
32168
_clusterRoleBinding = `
33169
apiVersion: rbac.authorization.k8s.io/v1
34170
kind: ClusterRoleBinding
@@ -37,7 +173,7 @@ metadata:
37173
roleRef:
38174
apiGroup: rbac.authorization.k8s.io
39175
kind: ClusterRole
40-
name: cluster-admin
176+
name: %s-apisix-view-clusterrole
41177
subjects:
42178
- kind: ServiceAccount
43179
name: ingress-apisix-e2e-test-service-account
@@ -120,10 +256,23 @@ func (s *Scaffold) newIngressAPISIXController() error {
120256
return err
121257
}
122258

123-
crb := fmt.Sprintf(_clusterRoleBinding, s.namespace, s.namespace)
259+
cr := fmt.Sprintf(_clusterRole, s.namespace)
260+
if err := k8s.KubectlApplyFromStringE(s.t, s.kubectlOptions, cr); err != nil {
261+
return err
262+
}
263+
264+
crb := fmt.Sprintf(_clusterRoleBinding, s.namespace, s.namespace, s.namespace)
124265
if err := k8s.KubectlApplyFromStringE(s.t, s.kubectlOptions, crb); err != nil {
125266
return err
126267
}
268+
s.addFinializer(func() {
269+
err := k8s.KubectlDeleteFromStringE(s.t, s.kubectlOptions, crb)
270+
assert.Nil(s.t, err, "deleting ClusterRoleBinding")
271+
})
272+
s.addFinializer(func() {
273+
err := k8s.KubectlDeleteFromStringE(s.t, s.kubectlOptions, cr)
274+
assert.Nil(s.t, err, "deleting ClusterRole")
275+
})
127276
if err := k8s.KubectlApplyFromStringE(s.t, s.kubectlOptions, ingressAPISIXDeployment); err != nil {
128277
return err
129278
}

‎test/e2e/scaffold/scaffold.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ func (s *Scaffold) beforeEach() {
184184
ConfigPath: s.opts.Kubeconfig,
185185
Namespace: s.namespace,
186186
}
187+
s.finializers = nil
187188
k8s.CreateNamespace(s.t, s.kubectlOptions, s.namespace)
188189

189190
s.nodes, err = k8s.GetReadyNodesE(s.t, s.kubectlOptions)

0 commit comments

Comments
 (0)