Merge pull request #292 from /issues/291

fix: added own cluster role binding per authorino instance.

Author: crstrn13

bundle/manifests/authorino-operator.clusterserviceversion.yaml

@@ -83,7 +83,7 @@ metadata:
     capabilities: Basic Install
     categories: Integration & Delivery
     containerImage: quay.io/kuadrant/authorino-operator:latest
-    createdAt: "2025-12-12T16:47:17Z"
+    createdAt: "2026-01-29T13:06:15Z"
     operators.operatorframework.io/builder: operator-sdk-v1.32.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
     repository: https://github.com/Kuadrant/authorino-operator
@@ -259,6 +259,7 @@ spec:
                 - roles
               verbs:
                 - create
+                - delete
                 - get
                 - list
                 - patch

config/deploy/manifests.yaml

@@ -5974,6 +5974,7 @@ rules:
   - roles
   verbs:
   - create
+  - delete
   - get
   - list
   - patch

config/install/manifests.yaml

@@ -457,6 +457,7 @@ rules:
   - roles
   verbs:
   - create
+  - delete
   - get
   - list
   - patch

config/rbac/role.yaml

@@ -139,6 +139,7 @@ rules:
   - roles
   verbs:
   - create
+  - delete
   - get
   - list
   - patch

controllers/authorino_controller.go

@@ -45,10 +45,10 @@ type AuthorinoReconciler struct {
 // +kubebuilder:rbac:groups="apps",resources=deployments,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterroles,verbs=get;list;watch;create;update;
-// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
-// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterrolebindings,verbs=get;list;watch;create;update;patch
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterrolebindings,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
-// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create;
 // +kubebuilder:rbac:groups="authorization.k8s.io",resources=subjectaccessreviews,verbs=create;
 // +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete
@@ -149,8 +149,17 @@ func (r *AuthorinoReconciler) cleanupClusterScopedPermissions(ctx context.Contex
 
 	// we only care about cluster-scoped role bindings for the cleanup
 	// namespaced ones are garbage collected automatically by k8s because of the owner reference
-	r.UnboundAuthorinoServiceAccountFromClusterRole(ctx, reconcilers.AuthorinoManagerClusterRoleBindingName, sa)
-	r.UnboundAuthorinoServiceAccountFromClusterRole(ctx, reconcilers.AuthorinoK8sAuthClusterRoleBindingName, sa)
+
+	// Delete instance-specific ClusterRoleBindings
+	managerBinding := authorinoResources.GetAuthorinoClusterRoleBinding(crName, reconcilers.AuthorinoManagerClusterRoleBindingName, reconcilers.AuthorinoManagerClusterRoleName, sa, labels)
+	if err := r.Client.Delete(ctx, managerBinding); err != nil && !errors.IsNotFound(err) {
+		r.Log.Error(err, "failed to delete ClusterRoleBinding", "name", managerBinding.Name)
+	}
+
+	k8sAuthBinding := authorinoResources.GetAuthorinoClusterRoleBinding(crName, reconcilers.AuthorinoK8sAuthClusterRoleBindingName, reconcilers.AuthorinoK8sAuthClusterRoleName, sa, labels)
+	if err := r.Client.Delete(ctx, k8sAuthBinding); err != nil && !errors.IsNotFound(err) {
+		r.Log.Error(err, "failed to delete ClusterRoleBinding", "name", k8sAuthBinding.Name)
+	}
 }
 
 func (r *AuthorinoReconciler) installationPreflightCheck(authorino *api.Authorino) error {

controllers/authorino_controller_test.go

@@ -120,7 +120,7 @@ var _ = Describe("Authorino controller", func() {
 			var bindingNsdName types.NamespacedName
 			if authorinoInstance.Spec.ClusterWide {
 				binding = &k8srbac.ClusterRoleBinding{}
-				bindingNsdName = types.NamespacedName{Name: "authorino"}
+				bindingNsdName = types.NamespacedName{Name: authorinoInstance.Name + "-" + reconcilers.AuthorinoManagerClusterRoleBindingName}
 			} else {
 				binding = &k8srbac.RoleBinding{}
 				bindingNsdName = namespacedName(testAuthorinoNamespace, authorinoInstance.Name+"-authorino")
@@ -132,7 +132,7 @@ var _ = Describe("Authorino controller", func() {
 
 			// Authorino Auth ClusterRoleBinding
 			k8sAuthBinding := &k8srbac.ClusterRoleBinding{}
-			k8sAuthBindingNsdName := types.NamespacedName{Name: reconcilers.AuthorinoK8sAuthClusterRoleBindingName}
+			k8sAuthBindingNsdName := types.NamespacedName{Name: authorinoInstance.Name + "-" + reconcilers.AuthorinoK8sAuthClusterRoleBindingName}
 
 			Eventually(func(ctx context.Context) error {
 				return k8sClient.Get(ctx, k8sAuthBindingNsdName, k8sAuthBinding)
@@ -378,7 +378,7 @@ var _ = Describe("Authorino controller", func() {
 
 			// Authorino ClusterRoleBinding
 			binding := &k8srbac.ClusterRoleBinding{}
-			bindingNsdName := types.NamespacedName{Name: "authorino"}
+			bindingNsdName := types.NamespacedName{Name: authorinoInstance.Name + "-" + reconcilers.AuthorinoManagerClusterRoleBindingName}
 
 			Eventually(func(g Gomega, ctx context.Context) {
 				g.Expect(k8sClient.Get(ctx, bindingNsdName, binding)).ToNot(HaveOccurred())
@@ -389,7 +389,7 @@ var _ = Describe("Authorino controller", func() {
 
 			// Authorino Auth ClusterRoleBinding
 			k8sAuthBinding := &k8srbac.ClusterRoleBinding{}
-			k8sAuthBindingNsdName := types.NamespacedName{Name: reconcilers.AuthorinoK8sAuthClusterRoleBindingName}
+			k8sAuthBindingNsdName := types.NamespacedName{Name: authorinoInstance.Name + "-" + reconcilers.AuthorinoK8sAuthClusterRoleBindingName}
 
 			Eventually(func(g Gomega, ctx context.Context) {
 				g.Expect(k8sClient.Get(ctx, k8sAuthBindingNsdName, k8sAuthBinding)).ToNot(HaveOccurred())
@@ -416,6 +416,9 @@ var _ = Describe("Authorino controller", func() {
 			authorinoInstance.Spec.ClusterWide = true
 			Expect(k8sClient.Create(ctx, authorinoInstance)).Should(Succeed())
 
+			// Update binding name for the new instance
+			bindingNsdName = types.NamespacedName{Name: authorinoInstance.Name + "-" + reconcilers.AuthorinoManagerClusterRoleBindingName}
+
 			// manager cluster role binding should get service account added
 			Eventually(func(g Gomega, ctx context.Context) {
 				sa := authorinoResources.GetAuthorinoServiceAccount(testAuthorinoNamespace, authorinoInstance.Name, authorinoInstance.Labels)

pkg/reconcilers/authorino_reconciler.go

@@ -156,13 +156,15 @@ func (r *AuthorinoReconciler) reconcileManagerClusterRoleBinding(ctx context.Con
 
 	// if cluster scoped, ensure service account is in the binding
 	if authorinoInstance.Spec.ClusterWide {
-		binding := authorinoResources.GetAuthorinoClusterRoleBinding(AuthorinoManagerClusterRoleBindingName, AuthorinoManagerClusterRoleName, sa)
+		binding := authorinoResources.GetAuthorinoClusterRoleBinding(authorinoInstance.Name, AuthorinoManagerClusterRoleBindingName, AuthorinoManagerClusterRoleName, sa, authorinoInstance.Labels)
 		return r.reconcileClusterRoleBinding(ctx, binding, authorinoInstance)
 	}
 
 	// local namespace scope
-	// ensure the service account is NOT in the binding
-	r.UnboundAuthorinoServiceAccountFromClusterRole(ctx, AuthorinoManagerClusterRoleBindingName, sa)
+	// if switching from cluster-wide to namespaced, delete the ClusterRoleBinding
+	binding := authorinoResources.GetAuthorinoClusterRoleBinding(authorinoInstance.Name, AuthorinoManagerClusterRoleBindingName, AuthorinoManagerClusterRoleName, sa, authorinoInstance.Labels)
+	TagObjectToDelete(binding)
+	r.reconcileClusterRoleBinding(ctx, binding, authorinoInstance)
 
 	return nil
 }
@@ -192,7 +194,7 @@ func (r *AuthorinoReconciler) reconcileManagerAuthClusterRoleBinding(ctx context
 
 	sa := authorinoResources.GetAuthorinoServiceAccount(authorinoInstance.Namespace, authorinoInstance.Name, authorinoInstance.Labels)
 
-	binding := authorinoResources.GetAuthorinoClusterRoleBinding(AuthorinoK8sAuthClusterRoleBindingName, AuthorinoK8sAuthClusterRoleName, sa)
+	binding := authorinoResources.GetAuthorinoClusterRoleBinding(authorinoInstance.Name, AuthorinoK8sAuthClusterRoleBindingName, AuthorinoK8sAuthClusterRoleName, sa, authorinoInstance.Labels)
 	return r.reconcileClusterRoleBinding(ctx, binding, authorinoInstance)
 }
 

pkg/resources/k8s_rbac.go

@@ -13,11 +13,11 @@ func GetAuthorinoServiceAccount(namespace, crName string, labels map[string]stri
 	}
 }
 
-func GetAuthorinoClusterRoleBinding(roleBindingName, clusterRoleName string, serviceAccount *k8score.ServiceAccount) *k8srbac.ClusterRoleBinding {
+func GetAuthorinoClusterRoleBinding(crName, clusterRoleBindingNameSuffix, clusterRoleName string, serviceAccount *k8score.ServiceAccount, labels map[string]string) *k8srbac.ClusterRoleBinding {
 	roleRef, roleSubject := getRoleRefAndSubject(clusterRoleName, "ClusterRole", serviceAccount)
 	return &k8srbac.ClusterRoleBinding{
 		TypeMeta:   k8smeta.TypeMeta{APIVersion: k8srbac.SchemeGroupVersion.String(), Kind: "ClusterRoleBinding"},
-		ObjectMeta: k8smeta.ObjectMeta{Name: roleBindingName},
+		ObjectMeta: k8smeta.ObjectMeta{Name: authorinoClusterRoleBindingName(crName, clusterRoleBindingNameSuffix), Labels: labels},
 		RoleRef:    roleRef,
 		Subjects:   []k8srbac.Subject{roleSubject},
 	}

pkg/resources/k8s_util.go

@@ -24,3 +24,7 @@ func authorinoServiceAccountName(crName string) string {
 func authorinoRoleBindingName(crName, roleBindingNameSuffix string) string {
 	return fmt.Sprintf("%s-%s", crName, roleBindingNameSuffix)
 }
+
+func authorinoClusterRoleBindingName(crName, clusterRoleBindingNameSuffix string) string {
+	return fmt.Sprintf("%s-%s", crName, clusterRoleBindingNameSuffix)
+}