fix(Gateway API): provide expected roles when using namespaced RBAC

traefik · Jul 24, 2024 · abc6310 · abc6310
1 parent a494617
commit abc6310
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 25 deletions.
diff --git a/traefik/templates/rbac/clusterrole.yaml b/traefik/templates/rbac/clusterrole.yaml
@@ -2,6 +2,7 @@
 {{- if .Values.rbac.enabled }}
 {{- if or
        (semverCompare ">=v3.1.0-0" $version)
+       (.Values.providers.kubernetesGateway.enabled)
        (not .Values.rbac.namespaced)
        (and .Values.rbac.namespaced .Values.providers.kubernetesIngress.enabled (not .Values.providers.kubernetesIngress.disableIngressClassLookup))
 }}

diff --git a/traefik/templates/rbac/role.yaml b/traefik/templates/rbac/role.yaml
@@ -108,31 +108,9 @@ rules:
       - use
 {{- end -}}
 {{- if (and (has . $gatewayNamespaces) ($.Values.providers.kubernetesGateway).enabled) }}
-  - apiGroups:
-      - ""
-    resources:
-      - services
-{{- if (semverCompare "<v3.1.0-0" $version) }}
-      - endpoints
-{{- end }}
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-{{- if (semverCompare ">=v3.1.0-0" $version) }}
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - list
-      - watch
-{{- end }}
   - apiGroups:
       - gateway.networking.k8s.io
     resources:
-      - gatewayclasses
       - gateways
       - httproutes
       - referencegrants

diff --git a/traefik/tests/rbac-config_test.yaml b/traefik/tests/rbac-config_test.yaml
@@ -1005,7 +1005,6 @@ tests:
             apiGroups:
               - gateway.networking.k8s.io
             resources:
-              - gatewayclasses
               - gateways
               - httproutes
               - referencegrants
@@ -1022,13 +1021,25 @@ tests:
             apiGroups:
               - ""
             resources:
-              - services
               - endpoints
+              - services
+            verbs:
+              - get
+              - list
+              - watch
+      - template: rbac/role.yaml
+        contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
               - secrets
             verbs:
               - get
               - list
               - watch
+
   - it: should provide expected role rbac when k8s gw api is enabled with rbac namespaced >=v3.1.0
     set:
       image:
@@ -1093,7 +1104,6 @@ tests:
             apiGroups:
               - gateway.networking.k8s.io
             resources:
-              - gatewayclasses
               - gateways
               - httproutes
               - referencegrants
@@ -1111,6 +1121,17 @@ tests:
               - ""
             resources:
               - services
+            verbs:
+              - get
+              - list
+              - watch
+      - template: rbac/role.yaml
+        contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
               - secrets
             verbs:
               - get
@@ -1352,6 +1373,23 @@ tests:
       - template: rbac/clusterrole.yaml
         hasDocuments:
           count: 0
+  - it: should provide cluster-wide RBACS for version < v3.1 when rbac are namespaced and gateway is enabled
+    set:
+      image:
+        tag: v3.0.1
+      rbac:
+        enabled: true
+        namespaced: true
+      providers:
+        kubernetesIngress:
+          disableIngressClassLookup: true
+        kubernetesGateway:
+          enabled: true
+    asserts:
+      - template: rbac/clusterrole.yaml
+        hasDocuments:
+          count: 1
+
   - it: should provide nodes RBACS for version >= v3.1 even if rbac are namespaced
     set:
       image: