chore: permissions refactoring #1202
Conversation
tolusha
requested review from
AndrienkoAleksandr,
flacatus,
mmorhun and
nickboldt
as code owners
| @@ -99,6 +99,10 @@ func NewReconciler( | |||
| reconcileManager.RegisterReconciler(openshiftoauth.NewOpenShiftOAuth(openShiftOAuthUser)) | |||
| reconcileManager.RegisterReconciler(tls.NewCertificatesReconciler()) | |||
| reconcileManager.RegisterReconciler(tls.NewTlsSecretReconciler()) | |||
| reconcileManager.RegisterReconciler(devworkspace.NewDevWorkspaceReconciler()) | |||
| reconcileManager.RegisterReconciler(rbac.NewRbacReconciler()) | |||
There was a problem hiding this comment.
Aren't GatewayPermissionsReconciler and WorkspacePermissionsReconciler using RBAC? We should be more clear in names.
There was a problem hiding this comment.
rbac: role-based access control. So it make sense for me to put in that package.
| } | ||
|
|
||
| subscription := &operatorsv1alpha1.Subscription{} | ||
| if err := deployContext.ClusterAPI.NonCachingClient.Get( |
There was a problem hiding this comment.
Looks like this invocation using NonCachingClient is done on each reconcile which is expensive.
There was a problem hiding this comment.
I've just moved the file. It how it was working before.
There was a problem hiding this comment.
I see. I think we should reconsider usage of nonCachingClient in the main controller, but this is out of scope of this refactoring.
| func (c *RbacReconciler) Reconcile(ctx *deploy.DeployContext) (reconcile.Result, bool, error) { | ||
| // Create service account "che" for che-server component. | ||
| // "che" is the one which token is used to create workspace objects. | ||
| // Notice: Also we have on more "che-workspace" SA used by plugins like exec, terminal, metrics with limited privileges. |
|
/retest |
|
/retest |
Signed-off-by: Mykola Morhun <mmorhun@redhat.com>
|
@tolusha: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
| if err != nil { | ||
| return false, err | ||
| return reconcile.Result{Requeue: true}, false, err | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // check if DW exists on the cluster | ||
| devWorkspaceWebHookExistedBeforeSync, err := deploy.Get( |
There was a problem hiding this comment.
I think, here is we ignore error.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: AndrienkoAleksandr, mmorhun, tolusha The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Anatolii Bazko abazko@redhat.com
What does this PR do?
Refactor permissions reconciles
Screenshot/screencast of this PR
N/A
What issues does this PR fix or reference?
eclipse-che/che#19284
How to test this PR?
PR Checklist
As the author of this Pull Request I made sure that:
What issues does this PR fix or referenceandHow to test this PRcompletedReviewers
Reviewers, please comment how you tested the PR when approving it.