remove rbac auth proxy from manifests #123
Conversation
Signed-off-by: Riccardo Piccoli <rpiccoli@redhat.com>
WalkthroughThe changes remove multiple Kubernetes RBAC definitions and service configurations while simplifying deployment specifications. Both the bootstrap and control plane projects had their auth proxy components removed: ClusterRoles, ClusterRoleBindings, and Services that provided metrics access and RBAC-enabled proxying were deleted. Additionally, corresponding patch files and extra commented configuration lines in kustomization files were eliminated, resulting in a streamlined deployment setup without the dedicated sidecar proxy for authorization. Changes
Sequence Diagram(s)sequenceDiagram
participant C as Client
participant AP as Auth Proxy (old)
participant CM as Controller Manager
alt Old Flow
C->>AP: Send metrics request
AP->>CM: Forward request after RBAC check
CM-->>AP: Return metrics
AP-->>C: Forward metrics
else New Flow
C->>CM: Send metrics request directly
CM-->>C: Return metrics
end
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
openshift-ci
bot
added
the
approved
|
/hold testing this locally while we fix the e2e test |
openshift-ci
bot
added
size/XL
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
bootstrap/config/rbac/kustomization.yaml (1)
1-13: Confirm Removal of Deprecated RBAC Auth Proxy ResourcesThe modifications correctly remove references to the deprecated RBAC auth proxy. The resources list now excludes files such as
auth_proxy_service.yaml,auth_proxy_role.yaml,auth_proxy_role_binding.yaml, andauth_proxy_client_clusterrole.yaml, in line with the PR objectives.Please ensure that:
- Any dependent configurations or documentation referring to these removed resources are updated.
- The remaining RBAC definitions (e.g.,
service_account.yaml,role.yaml, etc.) are sufficient for the intended operational scope without the auth proxy.bootstrap/config/default/kustomization.yaml (1)
4-4: YAML Formatting – Missing Newline at End of File
YAMLlint has flagged that there is no newline at the end of the file. Adding a newline is a recommended best practice to ensure compatibility with various tools.Consider applying the following diff to fix the issue:
@@ -../manager \ No newline at end of file +../manager +🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (16)
bootstrap-components.yaml(0 hunks)bootstrap/config/default/kustomization.yaml(1 hunks)bootstrap/config/default/manager_auth_proxy_patch.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role_binding.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_service.yaml(0 hunks)bootstrap/config/rbac/kustomization.yaml(1 hunks)controlplane-components.yaml(0 hunks)controlplane/config/default/kustomization.yaml(0 hunks)controlplane/config/default/manager_auth_proxy_patch.yaml(0 hunks)controlplane/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role_binding.yaml(0 hunks)controlplane/config/rbac/auth_proxy_service.yaml(0 hunks)controlplane/config/rbac/kustomization.yaml(0 hunks)
💤 Files with no reviewable changes (14)
- bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml
- controlplane/config/rbac/auth_proxy_client_clusterrole.yaml
- controlplane/config/default/kustomization.yaml
- bootstrap/config/rbac/auth_proxy_role.yaml
- controlplane/config/rbac/auth_proxy_service.yaml
- controlplane/config/default/manager_auth_proxy_patch.yaml
- bootstrap/config/rbac/auth_proxy_role_binding.yaml
- bootstrap/config/default/manager_auth_proxy_patch.yaml
- controlplane/config/rbac/kustomization.yaml
- controlplane/config/rbac/auth_proxy_role_binding.yaml
- bootstrap-components.yaml
- controlplane-components.yaml
- bootstrap/config/rbac/auth_proxy_service.yaml
- controlplane/config/rbac/auth_proxy_role.yaml
🧰 Additional context used
🪛 YAMLlint (1.35.1)
bootstrap/config/default/kustomization.yaml
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (1)
bootstrap/config/default/kustomization.yaml (1)
1-4: Removal of Deprecated RBAC Auth Proxy Reference
The removal of the../managerresource from the resources list is consistent with the PR objective of removing the deprecated RBAC auth proxy configuration. This change simplifies the manifest and eliminates unused references. Please double-check that no other parts of the configuration rely on this reference.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
bootstrap/config/rbac/kustomization.yaml (1)
12-13: Add Newline at End of File.
Static analysis flagged that there is no new line character at the end of this file. Please add a newline at the end to adhere to YAML formatting standards.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (16)
bootstrap-components.yaml(0 hunks)bootstrap/config/default/kustomization.yaml(1 hunks)bootstrap/config/default/manager_auth_proxy_patch.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role_binding.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_service.yaml(0 hunks)bootstrap/config/rbac/kustomization.yaml(1 hunks)controlplane-components.yaml(0 hunks)controlplane/config/default/kustomization.yaml(0 hunks)controlplane/config/default/manager_auth_proxy_patch.yaml(0 hunks)controlplane/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role_binding.yaml(0 hunks)controlplane/config/rbac/auth_proxy_service.yaml(0 hunks)controlplane/config/rbac/kustomization.yaml(0 hunks)
💤 Files with no reviewable changes (14)
- controlplane/config/rbac/auth_proxy_client_clusterrole.yaml
- controlplane/config/rbac/auth_proxy_role.yaml
- controlplane/config/rbac/auth_proxy_service.yaml
- bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml
- bootstrap/config/rbac/auth_proxy_role_binding.yaml
- controlplane/config/rbac/auth_proxy_role_binding.yaml
- bootstrap/config/rbac/auth_proxy_role.yaml
- bootstrap/config/rbac/auth_proxy_service.yaml
- controlplane/config/default/kustomization.yaml
- controlplane/config/rbac/kustomization.yaml
- controlplane/config/default/manager_auth_proxy_patch.yaml
- bootstrap/config/default/manager_auth_proxy_patch.yaml
- controlplane-components.yaml
- bootstrap-components.yaml
🧰 Additional context used
🪛 YAMLlint (1.35.1)
bootstrap/config/default/kustomization.yaml
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (2)
bootstrap/config/rbac/kustomization.yaml (1)
1-13: Removal of Deprecated Auth Proxy RBAC Configurations Confirmed.
The removal of references to the auth proxy (e.g., related toauth_proxy_service.yaml,auth_proxy_role.yaml, etc.) is in line with the PR objectives. The remaining RBAC resources (service account, role, role binding, and leader election resources) appear to be the only ones now applied, which simplifies the configuration as intended.bootstrap/config/default/kustomization.yaml (1)
1-4: Manager Resource Reference Removal.
The reference to the manager resource (../manager) has been removed from the resources list, which aligns with the removal of deprecated components in this manifest. Please verify that no other parts of the configuration depend on the manager resource.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
bootstrap/config/default/kustomization.yaml (1)
4-4: Formatting: Ensure Newline at End of FileThe static analysis tool flagged that there is no newline character at the end of the file. Adding a newline will improve compatibility with various YAML parsers.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (16)
bootstrap-components.yaml(0 hunks)bootstrap/config/default/kustomization.yaml(1 hunks)bootstrap/config/default/manager_auth_proxy_patch.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_role_binding.yaml(0 hunks)bootstrap/config/rbac/auth_proxy_service.yaml(0 hunks)bootstrap/config/rbac/kustomization.yaml(1 hunks)controlplane-components.yaml(0 hunks)controlplane/config/default/kustomization.yaml(0 hunks)controlplane/config/default/manager_auth_proxy_patch.yaml(0 hunks)controlplane/config/rbac/auth_proxy_client_clusterrole.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role.yaml(0 hunks)controlplane/config/rbac/auth_proxy_role_binding.yaml(0 hunks)controlplane/config/rbac/auth_proxy_service.yaml(0 hunks)controlplane/config/rbac/kustomization.yaml(0 hunks)
💤 Files with no reviewable changes (14)
- controlplane/config/rbac/auth_proxy_client_clusterrole.yaml
- controlplane/config/default/kustomization.yaml
- controlplane/config/rbac/auth_proxy_role.yaml
- bootstrap/config/rbac/auth_proxy_role.yaml
- bootstrap/config/rbac/auth_proxy_client_clusterrole.yaml
- bootstrap/config/rbac/auth_proxy_role_binding.yaml
- bootstrap/config/default/manager_auth_proxy_patch.yaml
- bootstrap/config/rbac/auth_proxy_service.yaml
- controlplane/config/rbac/kustomization.yaml
- controlplane/config/rbac/auth_proxy_role_binding.yaml
- controlplane/config/rbac/auth_proxy_service.yaml
- bootstrap-components.yaml
- controlplane-components.yaml
- controlplane/config/default/manager_auth_proxy_patch.yaml
🧰 Additional context used
🪛 YAMLlint (1.35.1)
bootstrap/config/default/kustomization.yaml
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (2)
bootstrap/config/rbac/kustomization.yaml (1)
1-13: Removal of Deprecated Auth Proxy ConfigurationsThe changes correctly remove the deprecated auth proxy RBAC configurations. The kustomization file now cleanly lists only the necessary RBAC resources (i.e.
service_account.yaml,role.yaml,role_binding.yaml,leader_election_role.yaml, andleader_election_role_binding.yaml), which aligns with the deprecation of the RBAC auth proxy in kubebuilder.Please ensure that any documentation or additional configuration files that previously referenced the removed auth proxy resources are updated accordingly.
bootstrap/config/default/kustomization.yaml (1)
1-4: Confirm Removal of Auth Proxy Manager ReferenceThe removal of the manager reference (
../manager) from the resources section is in line with the PR objective to deprecate the RBAC auth proxy. Please verify that no other components require this resource, and that its removal does not affect any dependent configurations.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 4-4: no new line character at the end of file
(new-line-at-end-of-file)
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: carbonin, rccrdpccl The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/unhold |
openshift-ci
bot
removed
the
do-not-merge/hold
openshift-merge-bot
bot
merged commit 961ae13
into
openshift-assisted:master
RBAC auth proxy is deprecated in kubebuilder, and should be removed.
We do not care enough to replace it with in-controller replacement, so we'll just remove it
Summary by CodeRabbit
Refactor
Chores