Check that the operator works without the NetworkPolicy RBAC permission - #13099
Check that the operator works without the NetworkPolicy RBAC permission#13099KasparMetsa wants to merge 1 commit into
Conversation
Signed-off-by: Kaspar Metsa <kaspar.metsa@axual.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13099 +/- ##
============================================
- Coverage 80.68% 80.68% -0.01%
Complexity 6630 6630
============================================
Files 344 344
Lines 22765 22765
Branches 3116 3116
============================================
- Hits 18368 18367 -1
Misses 3179 3179
- Partials 1218 1219 +1 🚀 New features to boost your workflow:
|
|
/gha run pipeline=regression |
|
⏳ System test verification started: link The following 6 job(s) will be executed:
Tests will start after successful build completion. |
see-quick
left a comment
see-quick
left a comment
There was a problem hiding this comment.
Thanks for the PR, looks good just one nit.
| steps = { | ||
| @Step(value = "Deploy Cluster Operator with STRIMZI_NETWORK_POLICY_GENERATION set to false.", expected = "Cluster Operator is deployed with network policy generation disabled."), | ||
| @Step(value = "Deploy Kafka cluster with Cruise Control.", expected = "Kafka cluster is deployed."), | ||
| @Step(value = "Remove the networkpolicies resource from the Cluster Operator (Cluster)Role and read the role back.", expected = "The role no longer lists networkpolicies."), |
There was a problem hiding this comment.
Can we improve this comment saying why we removing RBAC permissions (i.e., proves that operator never attempts any NetworkPolicy API call ... because if it did I think it would get 4xx error and fail).
|
🎉 System test verification passed: link |
4 participants
Remove the NetworkPolicy RBAC permission in
testNPGenerationEnvironmentVariableand check that the Cluster Operator still works.Fixes #12971
Type of change
Description
testNPGenerationEnvironmentVariablesetsSTRIMZI_NETWORK_POLICY_GENERATION=falseand checks that no Strimzi NetworkPolicy exists. During the test the operator still had the RBAC permission for NetworkPolicies, so the test proved that no network policy was created, not that the operator never asked for one.The test now removes the
networkpoliciesresource from the operator (Cluster)Role after the installation, reads the role back, and checks thatnetworkpoliciesis gone.The change is in the test only. It works for both RBAC scopes:
The test also deploys Kafka Exporter now, because it was the only component that creates a network policy that this test did not deploy.
The reason there was no Kafka Exporter before seems to be because the test is from 2021, and Kafka Exporter got its NetworkPolicy in 2023 (#8236), so the test predates it.
Testing
The test passes on a local kind cluster with cluster-wide RBAC and with
STRIMZI_RBAC_SCOPE=NAMESPACE.I also ran it without the removal step. It failed with "Cluster Operator still has the RBAC permission for NetworkPolicies". The test also logs the resource names it inspected, so a failing run shows what the role really held.
AI assistance (Claude Code) was used for this change, to explore the tests, write it and run it locally against a real Kubernetes cluster. I reviewed everything before submitting and can explain and defend all of it.
Checklist