chore: Update vm-console-proxy to v0.5.0

config/rbac/role.yaml

@@ -438,3 +438,9 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - token.kubevirt.io
+  resources:
+  - virtualmachines/vnc
+  verbs:
+  - get

data/olm-catalog/ssp-operator.clusterserviceversion.yaml

@@ -496,6 +496,12 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - token.kubevirt.io
+          resources:
+          - virtualmachines/vnc
+          verbs:
+          - get
         serviceAccountName: ssp-operator
       deployments:
       - label:

data/vm-console-proxy-bundle/vm-console-proxy.yaml

@@ -9,16 +9,20 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: vm-console-proxy
+  name: token.kubevirt.io:generate
 rules:
 - apiGroups:
-  - ""
+  - token.kubevirt.io
   resources:
-  - pods
+  - virtualmachines/vnc
   verbs:
   - get
-  - list
-  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vm-console-proxy
+rules:
 - apiGroups:
   - kubevirt.io
   resources:
@@ -152,7 +156,7 @@ spec:
       - args: []
         command:
         - /console
-        image: quay.io/kubevirt/vm-console-proxy:v0.4.0
+        image: quay.io/kubevirt/vm-console-proxy:v0.5.0
         imagePullPolicy: Always
         name: console
         ports:

internal/operands/vm-console-proxy/defaults.go

@@ -3,6 +3,6 @@ package vm_console_proxy
 // This file is updated by GitHub action defined in .github/workflows/release-vm-console-proxy.yaml
 
 const (
-	defaultVmConsoleProxyImageTag = "v0.4.0"
+	defaultVmConsoleProxyImageTag = "v0.5.0"
 	defaultVmConsoleProxyImage    = "quay.io/kubevirt/vm-console-proxy:" + defaultVmConsoleProxyImageTag
 )

internal/operands/vm-console-proxy/reconcile.go

@@ -43,6 +43,7 @@ const (
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;watch;create;update;delete;patch
 // +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
 // +kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create
+// +kubebuilder:rbac:groups=token.kubevirt.io,resources=virtualmachines/vnc,verbs=get
 
 func init() {
 	utilruntime.Must(routev1.Install(common.Scheme))
@@ -69,7 +70,7 @@ func WatchTypes() []operands.WatchType {
 
 type vmConsoleProxy struct {
 	serviceAccount     *core.ServiceAccount
-	clusterRole        *rbac.ClusterRole
+	clusterRoles       []rbac.ClusterRole
 	clusterRoleBinding *rbac.ClusterRoleBinding
 	roleBinding        *rbac.RoleBinding
 	service            *core.Service
@@ -80,10 +81,10 @@ type vmConsoleProxy struct {
 
 var _ operands.Operand = &vmConsoleProxy{}
 
-func New(bundle *vm_console_proxy_bundle.Bundle) *vmConsoleProxy {
+func New(bundle *vm_console_proxy_bundle.Bundle) operands.Operand {
 	return &vmConsoleProxy{
 		serviceAccount:     bundle.ServiceAccount,
-		clusterRole:        bundle.ClusterRole,
+		clusterRoles:       bundle.ClusterRoles,
 		clusterRoleBinding: bundle.ClusterRoleBinding,
 		roleBinding:        bundle.RoleBinding,
 		service:            bundle.Service,
@@ -120,15 +121,21 @@ func (v *vmConsoleProxy) Reconcile(request *common.Request) ([]common.ReconcileR
 		return results, nil
 	}
 
-	reconcileResults, err := common.CollectResourceStatus(request,
+	reconcileFuncs := []common.ReconcileFunc{
 		reconcileServiceAccount(*v.serviceAccount.DeepCopy()),
-		reconcileClusterRole(*v.clusterRole.DeepCopy()),
+	}
+	for i := range v.clusterRoles {
+		reconcileFuncs = append(reconcileFuncs, reconcileClusterRole(*v.clusterRoles[i].DeepCopy()))
+	}
+	reconcileFuncs = append(reconcileFuncs,
 		reconcileClusterRoleBinding(*v.clusterRoleBinding.DeepCopy()),
 		reconcileRoleBinding(v.roleBinding.DeepCopy()),
 		reconcileConfigMap(*v.configMap.DeepCopy()),
 		reconcileService(*v.service.DeepCopy()),
 		reconcileDeployment(*v.deployment.DeepCopy()),
 		reconcileApiService(v.apiService.DeepCopy()))
+
+	reconcileResults, err := common.CollectResourceStatus(request, reconcileFuncs...)
 	if err != nil {
 		return nil, err
 	}
@@ -202,8 +209,11 @@ func (v *vmConsoleProxy) Cleanup(request *common.Request) ([]common.CleanupResul
 	}
 	objectsToDelete = append(objectsToDelete, deployments...)
 
+	for i := range v.clusterRoles {
+		objectsToDelete = append(objectsToDelete, v.clusterRoles[i].DeepCopy())
+	}
+
 	objectsToDelete = append(objectsToDelete,
-		v.clusterRole.DeepCopy(),
 		v.clusterRoleBinding.DeepCopy(),
 		v.roleBinding.DeepCopy(),
 		v.apiService.DeepCopy())

internal/operands/vm-console-proxy/reconcile_test.go

@@ -28,6 +28,7 @@ import (
 
 	ssp "kubevirt.io/ssp-operator/api/v1beta2"
 	"kubevirt.io/ssp-operator/internal/common"
+	"kubevirt.io/ssp-operator/internal/operands"
 	. "kubevirt.io/ssp-operator/internal/test-utils"
 	vm_console_proxy_bundle "kubevirt.io/ssp-operator/internal/vm-console-proxy-bundle"
 )
@@ -52,7 +53,7 @@ var _ = Describe("VM Console Proxy Operand", func() {
 
 	var (
 		bundle  *vm_console_proxy_bundle.Bundle
-		operand *vmConsoleProxy
+		operand operands.Operand
 		request common.Request
 	)
 
@@ -72,7 +73,9 @@ var _ = Describe("VM Console Proxy Operand", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		ExpectResourceExists(bundle.ServiceAccount, request)
-		ExpectResourceExists(bundle.ClusterRole, request)
+		for _, clusterRole := range bundle.ClusterRoles {
+			ExpectResourceExists(&clusterRole, request)
+		}
 		ExpectResourceExists(bundle.ClusterRoleBinding, request)
 		ExpectResourceExists(bundle.RoleBinding, request)
 		ExpectResourceExists(bundle.ConfigMap, request)
@@ -117,7 +120,9 @@ var _ = Describe("VM Console Proxy Operand", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		ExpectResourceExists(bundle.ServiceAccount, request)
-		ExpectResourceExists(bundle.ClusterRole, request)
+		for _, clusterRole := range bundle.ClusterRoles {
+			ExpectResourceExists(&clusterRole, request)
+		}
 		ExpectResourceExists(bundle.ClusterRoleBinding, request)
 		ExpectResourceExists(bundle.RoleBinding, request)
 		ExpectResourceExists(bundle.ConfigMap, request)
@@ -129,7 +134,9 @@ var _ = Describe("VM Console Proxy Operand", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		ExpectResourceNotExists(bundle.ServiceAccount, request)
-		ExpectResourceNotExists(bundle.ClusterRole, request)
+		for _, clusterRole := range bundle.ClusterRoles {
+			ExpectResourceNotExists(&clusterRole, request)
+		}
 		ExpectResourceNotExists(bundle.ClusterRoleBinding, request)
 		ExpectResourceNotExists(bundle.RoleBinding, request)
 		ExpectResourceNotExists(bundle.ConfigMap, request)
@@ -246,7 +253,9 @@ var _ = Describe("VM Console Proxy Operand", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		ExpectResourceExists(bundle.ServiceAccount, request)
-		ExpectResourceExists(bundle.ClusterRole, request)
+		for _, clusterRole := range bundle.ClusterRoles {
+			ExpectResourceExists(&clusterRole, request)
+		}
 		ExpectResourceExists(bundle.ClusterRoleBinding, request)
 		ExpectResourceExists(bundle.RoleBinding, request)
 		ExpectResourceExists(bundle.ConfigMap, request)
@@ -260,7 +269,9 @@ var _ = Describe("VM Console Proxy Operand", func() {
 		Expect(err).ToNot(HaveOccurred())
 
 		ExpectResourceNotExists(bundle.ServiceAccount, request)
-		ExpectResourceNotExists(bundle.ClusterRole, request)
+		for _, clusterRole := range bundle.ClusterRoles {
+			ExpectResourceNotExists(&clusterRole, request)
+		}
 		ExpectResourceNotExists(bundle.ClusterRoleBinding, request)
 		ExpectResourceNotExists(bundle.RoleBinding, request)
 		ExpectResourceNotExists(bundle.ConfigMap, request)
@@ -323,7 +334,7 @@ func getMockedTestBundle() *vm_console_proxy_bundle.Bundle {
 				Labels:    map[string]string{"control-plane": "vm-console-proxy"},
 			},
 		},
-		ClusterRole: &rbac.ClusterRole{
+		ClusterRoles: []rbac.ClusterRole{{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      clusterRoleName,
 				Namespace: namespace,
@@ -346,7 +357,18 @@ func getMockedTestBundle() *vm_console_proxy_bundle.Bundle {
 				Resources: []string{"subjectaccessreviews"},
 				Verbs:     []string{"create"},
 			}},
-		},
+		}, {
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "token-generate",
+				Namespace: namespace,
+				Labels:    map[string]string{},
+			},
+			Rules: []rbac.PolicyRule{{
+				APIGroups: []string{"token.kubevirt.io"},
+				Resources: []string{"virtualmachines/vnc"},
+				Verbs:     []string{"get"},
+			}},
+		}},
 		ClusterRoleBinding: &rbac.ClusterRoleBinding{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      clusterRoleBindingName,

internal/vm-console-proxy-bundle/bundle-test.yaml

@@ -9,16 +9,20 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: vm-console-proxy
+  name: token.kubevirt.io:generate
 rules:
 - apiGroups:
-  - ""
+  - token.kubevirt.io
   resources:
-  - pods
+  - virtualmachines/vnc
   verbs:
   - get
-  - list
-  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vm-console-proxy
+rules:
 - apiGroups:
   - kubevirt.io
   resources:
@@ -152,7 +156,7 @@ spec:
       - args: []
         command:
         - /console
-        image: quay.io/kubevirt/vm-console-proxy:v0.3.1
+        image: quay.io/kubevirt/vm-console-proxy:v0.5.0
         imagePullPolicy: Always
         name: console
         ports:

internal/vm-console-proxy-bundle/bundle.go

@@ -33,7 +33,7 @@ const (
 
 type Bundle struct {
 	ServiceAccount     *core.ServiceAccount
-	ClusterRole        *rbac.ClusterRole
+	ClusterRoles       []rbac.ClusterRole
 	ClusterRoleBinding *rbac.ClusterRoleBinding
 	RoleBinding        *rbac.RoleBinding
 	Service            *core.Service
@@ -83,7 +83,9 @@ func loadBundleFromBytes(data []byte) (*Bundle, error) {
 		case rbac.ServiceAccountKind:
 			destObj = &(bundle.ServiceAccount)
 		case clusterRoleKind:
-			destObj = &(bundle.ClusterRole)
+			// Add a dummy object to the slice, it will be filled later
+			bundle.ClusterRoles = append(bundle.ClusterRoles, rbac.ClusterRole{})
+			destObj = &(bundle.ClusterRoles[len(bundle.ClusterRoles)-1])
 		case clusterRoleBindingsKind:
 			destObj = &(bundle.ClusterRoleBinding)
 		case roleBindingKind:
@@ -102,7 +104,7 @@ func loadBundleFromBytes(data []byte) (*Bundle, error) {
 			return nil, fmt.Errorf("unsupported Kind found in vm-console-proxy bundle: %s", kind)
 		}
 
-		if !reflect.ValueOf(destObj).Elem().IsNil() {
+		if kind != clusterRoleKind && !reflect.ValueOf(destObj).Elem().IsNil() {
 			return nil, fmt.Errorf("duplicate Kind found in vm-console-proxy bundle: %s", kind)
 		}
 
@@ -118,7 +120,7 @@ func validateBundle(bundle *Bundle) error {
 	if bundle.ServiceAccount == nil {
 		missingFields = append(missingFields, "ServiceAccount")
 	}
-	if bundle.ClusterRole == nil {
+	if len(bundle.ClusterRoles) == 0 {
 		missingFields = append(missingFields, "ClusterRole")
 	}
 	if bundle.ClusterRoleBinding == nil {
@@ -142,5 +144,6 @@ func validateBundle(bundle *Bundle) error {
 	if len(missingFields) > 0 {
 		return fmt.Errorf("bundle is missing these objects: %v", missingFields)
 	}
+
 	return nil
 }

internal/vm-console-proxy-bundle/bundle_test.go

@@ -17,7 +17,7 @@ var _ = Describe("VM Console Proxy Bundle", func() {
 		bundle, err := ReadBundle("bundle-test.yaml")
 		Expect(err).ToNot(HaveOccurred())
 		Expect(bundle.ServiceAccount).ToNot(BeNil(), "service account should not be nil")
-		Expect(bundle.ClusterRole).ToNot(BeNil(), "cluster role should not be nil")
+		Expect(bundle.ClusterRoles).ToNot(BeEmpty(), "cluster role should not be nil")
 		Expect(bundle.ClusterRoleBinding).ToNot(BeNil(), "cluster role binding should not be nil")
 		Expect(bundle.RoleBinding).ToNot(BeNil(), "role binding should not be nil")
 		Expect(bundle.Service).ToNot(BeNil(), "service should not be nil")