Skip to content

Commit 2ab2a50

Browse files
leandroberettaleandroberetta
committed
fix permissions when informers false
1 parent df60582 commit 2ab2a50

5 files changed

Lines changed: 84 additions & 20 deletions

File tree

‎internal/controller/flp/flp_common_objects.go‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,13 @@ const (
9696
)
9797

9898
// validatePortConflicts checks if any user-configured ports conflict with the hardcoded k8scache port
99+
// Only validates when centralized informers are enabled (when k8scache port is actually used)
99100
func validatePortConflicts(desired *flowslatest.FlowCollectorSpec) error {
101+
// Only check port conflicts when centralized informers are enabled
102+
if desired.Processor.Informers == nil || desired.Processor.Informers.Enabled == nil || !*desired.Processor.Informers.Enabled {
103+
return nil
104+
}
105+
100106
advancedConfig := helper.GetAdvancedProcessorConfig(desired)
101107

102108
// Check FLP port
@@ -157,11 +163,14 @@ func podTemplate(
157163
Name: prometheusPortName,
158164
ContainerPort: desired.Processor.GetMetricsPort(),
159165
})
160-
ports = append(ports, corev1.ContainerPort{
161-
Name: "k8scache",
162-
ContainerPort: k8scachePort,
163-
Protocol: corev1.ProtocolTCP,
164-
})
166+
// Only expose k8scache port when centralized informers are enabled
167+
if desired.Processor.Informers != nil && desired.Processor.Informers.Enabled != nil && *desired.Processor.Informers.Enabled {
168+
ports = append(ports, corev1.ContainerPort{
169+
Name: "k8scache",
170+
ContainerPort: k8scachePort,
171+
Protocol: corev1.ProtocolTCP,
172+
})
173+
}
165174

166175
if advancedConfig.ProfilePort != nil {
167176
ports = append(ports, corev1.ContainerPort{
@@ -196,15 +205,22 @@ func podTemplate(
196205

197206
envs = helper.EnvFromReqsLimits(envs, &desired.Processor.Resources)
198207

208+
// Build args - only include k8scache flags when centralized informers are enabled
209+
args := []string{
210+
fmt.Sprintf(`--config=%s/%s`, configPath, configFile),
211+
}
212+
if desired.Processor.Informers != nil && desired.Processor.Informers.Enabled != nil && *desired.Processor.Informers.Enabled {
213+
args = append(args,
214+
fmt.Sprintf("--k8scache.port=%d", k8scachePort),
215+
"--k8scache.address=0.0.0.0",
216+
)
217+
}
218+
199219
container := corev1.Container{
200220
Name: constants.FLPName,
201221
Image: imageName,
202222
ImagePullPolicy: corev1.PullPolicy(desired.Processor.ImagePullPolicy),
203-
Args: []string{
204-
fmt.Sprintf(`--config=%s/%s`, configPath, configFile),
205-
fmt.Sprintf("--k8scache.port=%d", k8scachePort),
206-
"--k8scache.address=0.0.0.0",
207-
},
223+
Args: args,
208224
Resources: *desired.Processor.Resources.DeepCopy(),
209225
VolumeMounts: volumeMounts,
210226
Ports: ports,

‎internal/controller/flp/flp_monolith_objects.go‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -180,15 +180,18 @@ func (b *monolithBuilder) service() *corev1.Service {
180180
Protocol: corev1.ProtocolTCP,
181181
TargetPort: intstr.FromInt32(port),
182182
},
183-
{
184-
Name: "k8scache",
185-
Port: k8scachePort,
186-
Protocol: corev1.ProtocolTCP,
187-
TargetPort: intstr.FromInt(k8scachePort),
188-
},
189183
},
190184
},
191185
}
186+
// Only expose k8scache port when centralized informers are enabled
187+
if b.desired.Processor.Informers != nil && b.desired.Processor.Informers.Enabled != nil && *b.desired.Processor.Informers.Enabled {
188+
svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{
189+
Name: "k8scache",
190+
Port: k8scachePort,
191+
Protocol: corev1.ProtocolTCP,
192+
TargetPort: intstr.FromInt(k8scachePort),
193+
})
194+
}
192195
if b.info.ClusterInfo.IsOpenShift() && (b.desired.Processor.Service == nil || b.desired.Processor.Service.TLSType == flowslatest.TLSAuto) {
193196
svc.Annotations[constants.OpenShiftCertificateAnnotation] = monoCertSecretName
194197
}

‎internal/controller/flp/flp_monolith_reconciler.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ type monolithReconciler struct {
3333
rbConfigWatcher *rbacv1.RoleBinding
3434
rbHostNetwork *rbacv1.ClusterRoleBinding
3535
rbLokiWriter *rbacv1.ClusterRoleBinding
36+
rbInformers *rbacv1.ClusterRoleBinding
3637
serviceMonitor *monitoringv1.ServiceMonitor
3738
prometheusRule *monitoringv1.PrometheusRule
3839
}
@@ -50,6 +51,7 @@ func newMonolithReconciler(cmn *reconcilers.Instance) *monolithReconciler {
5051
rbConfigWatcher: cmn.Managed.NewRB(resources.GetRoleBindingName(monoShortName, constants.ConfigWatcherRole)),
5152
rbHostNetwork: cmn.Managed.NewCRB(resources.GetClusterRoleBindingName(monoShortName, constants.HostNetworkRole)),
5253
rbLokiWriter: cmn.Managed.NewCRB(resources.GetClusterRoleBindingName(monoShortName, constants.LokiWriterRole)),
54+
rbInformers: cmn.Managed.NewCRB(resources.GetClusterRoleBindingName(monoShortName, constants.FLPInformersRole)),
5355
}
5456
if cmn.ClusterInfo.HasSvcMonitor() {
5557
rec.serviceMonitor = cmn.Managed.NewServiceMonitor(monoServiceMonitor)
@@ -259,6 +261,21 @@ func (r *monolithReconciler) reconcilePermissions(ctx context.Context, builder *
259261
r.Managed.TryDelete(ctx, r.rbLokiWriter)
260262
}
261263

264+
// Informers - when centralized informers are disabled, flowlogs-pipeline needs direct K8s API access
265+
informersEnabled := builder.desired.Processor.Informers != nil &&
266+
builder.desired.Processor.Informers.Enabled != nil &&
267+
*builder.desired.Processor.Informers.Enabled
268+
if !informersEnabled {
269+
// Local informers mode - grant K8s API permissions to flowlogs-pipeline ServiceAccount
270+
r.rbInformers = resources.GetClusterRoleBinding(r.Namespace, monoShortName, monoName, monoName, constants.FLPInformersRole)
271+
if err := r.ReconcileClusterRoleBinding(ctx, r.rbInformers); err != nil {
272+
return err
273+
}
274+
} else {
275+
// Centralized informers mode - permissions handled by flp-informers ServiceAccount
276+
r.Managed.TryDelete(ctx, r.rbInformers)
277+
}
278+
262279
// Config watcher
263280
r.rbConfigWatcher = resources.GetRoleBinding(r.Namespace, monoShortName, monoName, monoName, constants.ConfigWatcherRole, true)
264281
if err := r.ReconcileRoleBinding(ctx, r.rbConfigWatcher); err != nil {

‎internal/controller/flp/flp_test.go‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -815,34 +815,45 @@ func TestPortConflictValidation(t *testing.T) {
815815
assert := assert.New(t)
816816
info := reconcilers.Common{Namespace: "ns", ClusterInfo: &cluster.Info{}}
817817

818-
// Test FLP port conflict
818+
// Test FLP port conflict (only when informers enabled)
819819
cfg := getConfig()
820820
cfg.Processor.Advanced.Port = ptr.To(int32(9090))
821+
cfg.Processor.Informers = &flowslatest.FlowCollectorInformers{Enabled: ptr.To(true)}
821822
_, err := newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)
822823
assert.Error(err)
823824
assert.Contains(err.Error(), "flowlogs-pipeline port 9090 conflicts with reserved k8scache port")
824825

825-
// Test health port conflict
826+
// Test health port conflict (only when informers enabled)
826827
cfg = getConfig()
827828
cfg.Processor.Advanced.HealthPort = ptr.To(int32(9090))
829+
cfg.Processor.Informers = &flowslatest.FlowCollectorInformers{Enabled: ptr.To(true)}
828830
_, err = newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)
829831
assert.Error(err)
830832
assert.Contains(err.Error(), "flowlogs-pipeline health port 9090 conflicts with reserved k8scache port")
831833

832-
// Test metrics port conflict
834+
// Test metrics port conflict (only when informers enabled)
833835
cfg = getConfig()
834836
cfg.Processor.Metrics.Server.Port = ptr.To(int32(9090))
837+
cfg.Processor.Informers = &flowslatest.FlowCollectorInformers{Enabled: ptr.To(true)}
835838
_, err = newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)
836839
assert.Error(err)
837840
assert.Contains(err.Error(), "flowlogs-pipeline metrics port 9090 conflicts with reserved k8scache port")
838841

839-
// Test profile port conflict
842+
// Test profile port conflict (only when informers enabled)
840843
cfg = getConfig()
841844
cfg.Processor.Advanced.ProfilePort = ptr.To(int32(9090))
845+
cfg.Processor.Informers = &flowslatest.FlowCollectorInformers{Enabled: ptr.To(true)}
842846
_, err = newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)
843847
assert.Error(err)
844848
assert.Contains(err.Error(), "flowlogs-pipeline profile port 9090 conflicts with reserved k8scache port")
845849

850+
// Test port 9090 is allowed when informers disabled (no conflict)
851+
cfg = getConfig()
852+
cfg.Processor.Advanced.Port = ptr.To(int32(9090))
853+
cfg.Processor.Informers = nil // or &FlowCollectorInformers{Enabled: false}
854+
_, err = newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)
855+
assert.NoError(err)
856+
846857
// Test valid configuration (no conflicts)
847858
cfg = getConfig()
848859
_, err = newMonolithBuilder(info.NewInstance(image, status.Instance{}), &cfg, &metricslatest.FlowMetricList{}, nil, nil)

‎internal/controller/flp/flp_transfo_reconciler.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ type transformerReconciler struct {
3232
dynamicConfigMap *corev1.ConfigMap
3333
rbConfigWatcher *rbacv1.RoleBinding
3434
rbLokiWriter *rbacv1.ClusterRoleBinding
35+
rbInformers *rbacv1.ClusterRoleBinding
3536
serviceMonitor *monitoringv1.ServiceMonitor
3637
prometheusRule *monitoringv1.PrometheusRule
3738
}
@@ -47,6 +48,7 @@ func newTransformerReconciler(cmn *reconcilers.Instance) *transformerReconciler
4748
dynamicConfigMap: cmn.Managed.NewConfigMap(transfoDynConfigMap),
4849
rbConfigWatcher: cmn.Managed.NewRB(resources.GetRoleBindingName(transfoShortName, constants.ConfigWatcherRole)),
4950
rbLokiWriter: cmn.Managed.NewCRB(resources.GetClusterRoleBindingName(transfoShortName, constants.LokiWriterRole)),
51+
rbInformers: cmn.Managed.NewCRB(resources.GetClusterRoleBindingName(transfoShortName, constants.FLPInformersRole)),
5052
}
5153
if cmn.ClusterInfo.HasSvcMonitor() {
5254
rec.serviceMonitor = cmn.Managed.NewServiceMonitor(transfoServiceMonitor)
@@ -227,6 +229,21 @@ func (r *transformerReconciler) reconcilePermissions(ctx context.Context, builde
227229
r.Managed.TryDelete(ctx, r.rbLokiWriter)
228230
}
229231

232+
// Informers - when centralized informers are disabled, flowlogs-pipeline needs direct K8s API access
233+
informersEnabled := builder.desired.Processor.Informers != nil &&
234+
builder.desired.Processor.Informers.Enabled != nil &&
235+
*builder.desired.Processor.Informers.Enabled
236+
if !informersEnabled {
237+
// Local informers mode - grant K8s API permissions to flowlogs-pipeline ServiceAccount
238+
r.rbInformers = resources.GetClusterRoleBinding(r.Namespace, transfoShortName, transfoName, transfoName, constants.FLPInformersRole)
239+
if err := r.ReconcileClusterRoleBinding(ctx, r.rbInformers); err != nil {
240+
return err
241+
}
242+
} else {
243+
// Centralized informers mode - permissions handled by flp-informers ServiceAccount
244+
r.Managed.TryDelete(ctx, r.rbInformers)
245+
}
246+
230247
// Config watcher
231248
r.rbConfigWatcher = resources.GetRoleBinding(r.Namespace, transfoShortName, transfoName, transfoName, constants.ConfigWatcherRole, true)
232249
if err := r.ReconcileRoleBinding(ctx, r.rbConfigWatcher); err != nil {

0 commit comments

Comments
 (0)