draft: move some privileges from clusterpermissions to permissions

rabbitmq_olm_package_repo/cluster_operator_bundle.py

@@ -8,11 +8,11 @@
     get_operator_last_tag,
     replace_rabbitmq_cluster_operator_image,
     replace_rabbitmq_cluster_operator_version_overlay,
+    replace_rabbitmq_security_overlay,
 )
 
 
 def create_cluster_operator_bundle(operator_release_file, version, output_directory):
-
     logger = logging.getLogger(__name__)
     logger.setLevel(logging.INFO)
 
@@ -59,43 +59,59 @@ def _set_replace_version(version, replaces):
 
 # creates overlay for permission, and cluster-operator-permission
 def _create_and_finalize_overlays(version, operator_release_file):
-
     # Finalize the overlay
     create_overlay(
         operator_release_file,
         "kind: Role",
         "rules:",
         "---",
         "./rabbitmq_olm_package_repo/generators/cluster_operator_generators/overlay-permission-generator.yaml",
+        "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-permissiontmp.yaml",
+        [],
+    )
+    filters = ["get", "list", "watch"]
+    create_overlay(
+        operator_release_file,
+        "kind: ClusterRole",
+        "rules:",
+        "---",
+        "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-permissiontmp.yaml",
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-permission.yaml",
+        filters,
     )
+    filters = ["create", "update", "delete", "patch"]
     create_overlay(
         operator_release_file,
         "kind: ClusterRole",
         "rules:",
         "---",
         "./rabbitmq_olm_package_repo/generators/cluster_operator_generators/overlay-cluster-permission-generator.yaml",
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-cluster-permission.yaml",
+        filters,
     )
+
     create_overlay(
         operator_release_file,
         "kind: Deployment",
         "spec:",
         "---",
         "./rabbitmq_olm_package_repo/generators/cluster_operator_generators/overlay-deployment-generator.yaml",
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-deployment.yaml",
+        [],
     )
 
     replace_rabbitmq_cluster_operator_version_overlay(
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-permission.yaml",
         "rabbitmq-cluster-operator.v*",
         "rabbitmq-cluster-operator.v" + version,
     )
+
     replace_rabbitmq_cluster_operator_version_overlay(
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-cluster-permission.yaml",
         "rabbitmq-cluster-operator.v*",
         "rabbitmq-cluster-operator.v" + version,
     )
+
     replace_rabbitmq_cluster_operator_version_overlay(
         "./rabbitmq_olm_package_repo/overlays/cluster-operator-overlay-deployment.yaml",
         "rabbitmq-cluster-operator.v*",

rabbitmq_olm_package_repo/main.py

@@ -12,7 +12,6 @@
 
 
 def main():
-
     logging.basicConfig()
     logger = logging.getLogger(__name__)
     logger.setLevel(logging.INFO)
@@ -73,8 +72,8 @@ def main():
         )
 
     logger.info("Clean up")
-    os.system("rm -fR ./rabbitmq_olm_package_repo/overlays")
-    os.system("rm -fR ./rabbitmq_olm_package_repo/tmpmanifests")
+    # os.system("rm -fR ./rabbitmq_olm_package_repo/overlays")
+    # os.system("rm -fR ./rabbitmq_olm_package_repo/tmpmanifests")
 
 
 # start main function

rabbitmq_olm_package_repo/topology_operator_bundle.py

@@ -15,7 +15,6 @@
 def create_messaging_topology_operator_bundle(
     operator_release_file, version, output_directory
 ):
-
     logger = logging.getLogger(__name__)
     logger.setLevel(logging.INFO)
 
@@ -37,7 +36,6 @@ def create_messaging_topology_operator_bundle(
 
 
 def _set_replace_version(version, replaces):
-
     now = datetime.now()
     createdAt = now.strftime("%m/%d/%Y")
 
@@ -59,22 +57,35 @@ def _set_replace_version(version, replaces):
 
 
 def _create_and_finalize_overlays(version, operator_release_file):
-
     create_overlay(
         operator_release_file,
         "kind: Role",
         "rules:",
         "---",
         "./rabbitmq_olm_package_repo/generators/messaging_topology_operator_generators/overlay-permission-generator.yaml",
+        "./rabbitmq_olm_package_repo/overlays/topology-operator-overlay-permissiontmp.yaml",
+        [],
+    )
+
+    filters = ["get", "list", "watch"]
+    create_overlay(
+        operator_release_file,
+        "kind: ClusterRole",
+        "rules:",
+        "---",
+        "./rabbitmq_olm_package_repo/overlays/topology-operator-overlay-permissiontmp.yaml",
         "./rabbitmq_olm_package_repo/overlays/topology-operator-overlay-permission.yaml",
+        filters,
     )
+    filters = ["create", "update", "delete", "patch"]
     create_overlay(
         operator_release_file,
         "kind: ClusterRole",
         "rules:",
         "---",
         "./rabbitmq_olm_package_repo/generators/messaging_topology_operator_generators/overlay-cluster-permission-generator.yaml",
         "./rabbitmq_olm_package_repo/overlays/topology-operator-overlay-cluster-permission.yaml",
+        filters,
     )
     create_overlay(
         operator_release_file,
@@ -83,6 +94,7 @@ def _create_and_finalize_overlays(version, operator_release_file):
         "---",
         "./rabbitmq_olm_package_repo/generators/messaging_topology_operator_generators/overlay-deployment-generator.yaml",
         "./rabbitmq_olm_package_repo/overlays/topology-operator-overlay-deployment.yaml",
+        [],
     )
 
     replace_rabbitmq_cluster_operator_version_overlay(
@@ -121,7 +133,6 @@ def _create_and_finalize_overlays(version, operator_release_file):
 
 
 def _create_olm_bundle(version, output_directory):
-
     rabbitmq_cluster_operator_dir = output_directory + "/" + version
     rabbitmq_cluster_operator_dir_manifests = (
         rabbitmq_cluster_operator_dir + "/manifests"

rabbitmq_olm_package_repo/utils.py

@@ -10,18 +10,51 @@ class OperatorType(Enum):
 
 # This function complete an overlay generator file (in ./generators) for Role, Clusterrole and Deployment
 def create_overlay(
-    release_file, kind, firstString, endString, file_generator, file_output
+    release_file, kind, firstString, endString, file_generator, file_output, filters
 ):
-
     found = False
     parsing = False
 
     with open(release_file, "r") as myfile:
-
         filestring = ""
 
+        security_verbs = [
+            "get",
+            "list",
+            "watch",
+            "update",
+            "create",
+            "delete",
+            "patch",
+            "watch",
+        ]
+        special_cases = False
         for line in myfile:
             if parsing == True:
+                if (
+                    "pods/exec" in line
+                    or "endpoints" in line
+                    or "finalizers" in line
+                    or "rabbitmqclusters" in line
+                    or "services" in line
+                ):
+                    special_cases = True
+
+                line_filtered = False
+                for filter in filters:
+                    if filter in line:
+                        line_filtered = True
+
+                if line_filtered is True:
+                    if special_cases is False:
+                        continue
+                    else:
+                        special_cases = False
+
+                if special_cases is True:
+                    for security_verb in security_verbs:
+                        if security_verb in line:
+                            special_cases = False
 
                 if line.find(endString) >= 0:
                     if found == True:
@@ -45,21 +78,27 @@ def create_overlay(
 
 # This function complete an overlay generator file (in ./generators) for Role, Clusterrole and Deployment
 def replace_rabbitmq_cluster_operator_version_overlay(file_input, pattern1, pattern2):
-
     with fileinput.FileInput(file_input, inplace=True, backup=".bak") as file:
         for line in file:
             print(line.replace(pattern1, pattern2), end="")
 
 
-def replace_rabbitmq_cluster_operator_image(file_input, pattern1, pattern2):
+# This function complete an overlay generator file (in ./generators) for Role, Clusterrole and Deployment
+def replace_rabbitmq_security_overlay(file_input, securities):
+    with fileinput.FileInput(file_input, inplace=True, backup=".bak") as file:
+        for line in file:
+            for security in securities:
+                if security in line:
+                    print(line.replace(pattern1, ""), end="")
+
 
+def replace_rabbitmq_cluster_operator_image(file_input, pattern1, pattern2):
     with fileinput.FileInput(file_input, inplace=True, backup=".bak") as file:
         for line in file:
             print(line.replace(pattern1, pattern2), end="")
 
 
 def replace_if_rabbitmq_webhook(file_input):
-
     with fileinput.FileInput(file_input, inplace=True, backup=".bak") as file:
         for line in file:
             print(
@@ -71,7 +110,6 @@ def replace_if_rabbitmq_webhook(file_input):
 
 
 def get_operator_name(file_input):
-
     with open(file_input) as f:
         if "rabbitmqoperator/messaging-topology-operator" in f.read():
             return OperatorType.MESSAGING_TOPOLOGY_OPERATOR
@@ -80,7 +118,6 @@ def get_operator_name(file_input):
 
 
 def get_operator_last_tag(operator):
-
     last_tag_file = "./last_tag_file"
     os.system(
         "curl https://api.github.com/repos/rabbitmq/"

testfiles/og.yaml

@@ -2,7 +2,7 @@ apiVersion: operators.coreos.com/v1
 kind: OperatorGroup
 metadata:
   name: test-og
-  namespace: rabbitmq-system-olm 
+  namespace: rabbitmq-system-olm
 spec:
   targetNamespaces:
-  - rabbitmq-system-olm 
+  - rabbitmq-system-olm

testfiles/rabbitmq-messaging-operator-subscription-template.yaml

@@ -3,7 +3,7 @@ apiVersion: operators.coreos.com/v1alpha1
 kind: Subscription
 metadata:
   name: rabbitmq-messaging-operator
-  namespace: rabbitmq-system-olm 
+  namespace: rabbitmq-system-olm
 spec:
   channel: stable 
   installPlanApproval: Automatic

testfiles/rabbitmq-operator-subscription-template.yaml

@@ -3,7 +3,7 @@ apiVersion: operators.coreos.com/v1alpha1
 kind: Subscription
 metadata:
   name: rabbitmq-operator
-  namespace: rabbitmq-system-olm 
+  namespace: rabbitmq-system-olm
 spec:
   channel: stable 
   installPlanApproval: Automatic

tests/test_cluster_operator_bundle.py

@@ -19,7 +19,6 @@
 
 
 def test_cluster_operator_bundle():
-
     operator_release_file = (
         "./rabbitmq_olm_package_repo/manifests_crds/cluster-operator.yaml"
     )
@@ -51,7 +50,6 @@ def test_cluster_operator_bundle():
 
 # validate the bundle with operator-sdk
 def validate_all_bundle(output_directory):
-
     os.system(
         "operator-sdk bundle validate "
         + output_directory
@@ -65,7 +63,6 @@ def validate_all_bundle(output_directory):
 
 # Check at least that the crd has been generated and two main fields (kind and metadata->name are created)
 def validate_operator_crd(output_directory):
-
     # check if crd is present in the bundle
     assert os.path.isfile(output_directory + "/manifests/crds.yaml")
 
@@ -80,7 +77,6 @@ def validate_operator_crd(output_directory):
 
 # Check at least that the crd has been generated and two main fields (kind and metadata->name are created)
 def validate_operator_manifest(output_directory, version):
-
     # check if crd is present in the bundle
     assert os.path.isfile(
         output_directory + "/manifests/rabbitmq.clusterserviceversion.yaml"

tests/test_topology_operator_bundle.py

@@ -16,7 +16,6 @@
 
 
 def test_cluster_operator_bundle():
-
     topology_operator_release_file = "./rabbitmq_olm_package_repo/manifests_crds_messaging_topology_operator/messaging-topology-operator-with-certmanager.yaml"
     version = "1.13.0"
     output_directory = "./tests/test-bundle"
@@ -73,7 +72,6 @@ def test_cluster_operator_bundle():
 
 # validate the bundle with operator-sdk
 def validate_all_bundle(output_directory):
-
     os.system(
         "operator-sdk bundle validate "
         + output_directory
@@ -87,7 +85,6 @@ def validate_all_bundle(output_directory):
 
 # Check at least that the crd has been generated and two main fields (kind and metadata->name are created)
 def validate_operator_crds(output_directory, crds_file_names, crds_names):
-
     output_directory = output_directory + "/manifests"
 
     directory = os.fsencode(output_directory)
@@ -114,7 +111,6 @@ def validate_operator_crds(output_directory, crds_file_names, crds_names):
 
 # Check at least that the crd has been generated and two main fields (kind and metadata->name are created)
 def validate_operator_manifest(output_directory, version):
-
     # check if crd is present in the bundle
     assert os.path.isfile(
         output_directory + "/manifests/rabbitmq.clusterserviceversion.yaml"

tests/utils.py

@@ -2,7 +2,6 @@
 
 
 def validate_bundle_struct(output_directory):
-
     validate_folder_structure(output_directory)