adestis-mf opened a new pull request, #14690: URL: https://github.com/apache/cloudstack/pull/14690
### Description For a cluster in a project, the CloudStack Kubernetes Provider uses the API keys of the service account that CKS creates there. The role of that account (`Project Kubernetes Service Role`) does not allow several APIs the provider calls: - `listCapabilities`: the provider reads the CloudStack version with it when it starts, unless the cloud config sets `version`, which the one written by CKS does not. Reading the code, provider v1.3.0 fails to initialize without it. - `listNetworkACLLists`: needed before the provider adds an ACL rule for a LoadBalancer Service on a VPC tier (since provider v1.2.0). - `updateNetworkACLItem`: takes over ACL rules of earlier provider releases (v1.3.0). - `listLBStickinessPolicies`, `createLBStickinessPolicy`, `deleteLBStickinessPolicy`: stickiness policies (v1.3.0). - `listVPCs`: to find out whether a VPC has the Firewall service (4.23 and later), see apache/cloudstack-kubernetes-provider#114. This PR adds them to the role. CKS creates the role only once, so existing installations have to add them by hand, before the rule that denies everything else. A few colleagues and I worked on this, since CKS in VPCs with the Firewall service matters for our cloud environment. ### Types of changes - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) - [ ] Build/CI - [ ] Test (unit or integration test code) ### Feature/Enhancement Scale or Bug Severity #### Feature/Enhancement Scale - [ ] Major - [ ] Minor #### Bug Severity - [ ] BLOCKER - [ ] Critical - [x] Major - [ ] Minor - [ ] Trivial ### Screenshots (if appropriate): ### How Has This Been Tested? A new unit test checks that the role allows these APIs and still ends with the deny rule; it fails without the new entries. `mvn -pl plugins/integrations/kubernetes-service -am test`: 129 tests pass, checkstyle clean. On a 4.23.0.0 installation, adding `listVPCs` by hand to an existing role was enough for the provider change for apache/cloudstack-kubernetes-provider#114 to read the VPC; before, the call was refused with error 432. #### How did you try to break this feature and the system with this change? Only roles created after this change get the new permissions. Existing roles are not changed, and the deny rule stays last. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
