feat: Add required RBAC for k8s cluster receiver

config/development/kustomization.yaml

@@ -24,6 +24,9 @@ patches:
       - op: add
         path: /spec/template/spec/containers/0/args/-
         value: --kyma-input-allowed=true
+      - op: add
+        path: /spec/template/spec/containers/0/args/-
+        value: --k8s-cluster-receiver-allowed=true
     target:
       kind: Deployment
       name: manager

config/rbac/role.yaml

@@ -26,7 +26,10 @@ rules:
   - events
   verbs:
   - create
+  - get
+  - list
   - patch
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -35,6 +38,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces/status
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -51,6 +62,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes/spec
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -67,6 +86,38 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/status
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - replicationcontrollers
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - replicationcontrollers/status
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - resourcequotas
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -106,6 +157,78 @@ rules:
 - apiGroups:
   - apps
   resources:
+  - daemonsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - daemonsets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
   - replicasets
   verbs:
   - get

controllers/telemetry/metricpipeline_controller.go

@@ -81,7 +81,7 @@ func NewMetricPipelineController(client client.Client, reconcileTriggerChan <-ch
 	}
 
 	agentRBAC := otelcollector.MakeMetricAgentRBAC(types.NamespacedName{Name: config.Agent.BaseName, Namespace: config.Agent.Namespace})
-	gatewayRBAC := otelcollector.MakeMetricGatewayRBAC(types.NamespacedName{Name: config.Gateway.BaseName, Namespace: config.Gateway.Namespace}, config.KymaInputAllowed)
+	gatewayRBAC := otelcollector.MakeMetricGatewayRBAC(types.NamespacedName{Name: config.Gateway.BaseName, Namespace: config.Gateway.Namespace}, config.KymaInputAllowed, config.K8sClusterReceiverAllowed)
 
 	reconciler := metricpipeline.New(
 		client,

internal/reconciler/metricpipeline/reconciler.go

@@ -29,11 +29,12 @@ import (
 const defaultReplicaCount int32 = 2
 
 type Config struct {
-	Agent            otelcollector.AgentConfig
-	Gateway          otelcollector.GatewayConfig
-	MaxPipelines     int
-	ModuleVersion    string
-	KymaInputAllowed bool
+	Agent                     otelcollector.AgentConfig
+	Gateway                   otelcollector.GatewayConfig
+	MaxPipelines              int
+	ModuleVersion             string
+	KymaInputAllowed          bool
+	K8sClusterReceiverAllowed bool
 }
 
 type AgentConfigBuilder interface {

internal/resources/otelcollector/rbac.go

@@ -31,9 +31,9 @@ func MakeMetricAgentRBAC(name types.NamespacedName) Rbac {
 	}
 }
 
-func MakeMetricGatewayRBAC(name types.NamespacedName, kymaInputAllowed bool) Rbac {
+func MakeMetricGatewayRBAC(name types.NamespacedName, kymaInputAllowed bool, k8sClusterReceiverAllowed bool) Rbac {
 	return Rbac{
-		clusterRole:        makeMetricGatewayClusterRole(name, kymaInputAllowed),
+		clusterRole:        makeMetricGatewayClusterRole(name, kymaInputAllowed, k8sClusterReceiverAllowed),
 		clusterRoleBinding: makeClusterRoleBinding(name),
 		role:               makeMetricGatewayRole(name, kymaInputAllowed),
 		roleBinding:        makeMetricGatewayRoleBinding(name, kymaInputAllowed),
@@ -83,7 +83,7 @@ func makeMetricAgentClusterRole(name types.NamespacedName) *rbacv1.ClusterRole {
 	}
 }
 
-func makeMetricGatewayClusterRole(name types.NamespacedName, kymaInputAllowed bool) *rbacv1.ClusterRole {
+func makeMetricGatewayClusterRole(name types.NamespacedName, kymaInputAllowed bool, k8sClusterReceiverAllowed bool) *rbacv1.ClusterRole {
 	clusterRole := rbacv1.ClusterRole{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name.Name,
@@ -112,6 +112,32 @@ func makeMetricGatewayClusterRole(name types.NamespacedName, kymaInputAllowed bo
 		})
 	}
 
+	if k8sClusterReceiverAllowed {
+		clusterRules := []rbacv1.PolicyRule{{
+			APIGroups: []string{""},
+			Resources: []string{"events", "namespaces", "namespaces/status", "nodes", "nodes/spec", "pods", "pods/status", "replicationcontrollers", "replicationcontrollers/status", "resourcequotas", "services"},
+			Verbs:     []string{"get", "list", "watch"},
+		}, {
+			APIGroups: []string{"apps"},
+			Resources: []string{"daemonsets", "deployments", "replicasets", "statefulsets"},
+			Verbs:     []string{"get", "list", "watch"},
+		}, {
+			APIGroups: []string{"extensions"},
+			Resources: []string{"daemonsets", "deployments", "replicasets"},
+			Verbs:     []string{"get", "list", "watch"},
+		}, {
+			APIGroups: []string{"batch"},
+			Resources: []string{"jobs", "cronjobs"},
+			Verbs:     []string{"get", "list", "watch"},
+		}, {
+			APIGroups: []string{"autoscaling"},
+			Resources: []string{"horizontalpodautoscalers"},
+			Verbs:     []string{"get", "list", "watch"},
+		}}
+
+		clusterRole.Rules = append(clusterRole.Rules, clusterRules...)
+	}
+
 	return &clusterRole
 }
 

internal/resources/otelcollector/rbac_test.go

@@ -103,7 +103,7 @@ func TestMakeMetricGatewayRBAC(t *testing.T) {
 	name := "test-gateway"
 	namespace := "test-namespace"
 
-	rbac := MakeMetricGatewayRBAC(types.NamespacedName{Name: name, Namespace: namespace}, false)
+	rbac := MakeMetricGatewayRBAC(types.NamespacedName{Name: name, Namespace: namespace}, false, false)
 
 	t.Run("should have a cluster role", func(t *testing.T) {
 		cr := rbac.clusterRole
@@ -149,7 +149,7 @@ func TestMakeMetricGatewayRBACWithKymaInputAllowed(t *testing.T) {
 	name := "test-gateway"
 	namespace := "test-namespace"
 
-	rbac := MakeMetricGatewayRBAC(types.NamespacedName{Name: name, Namespace: namespace}, true)
+	rbac := MakeMetricGatewayRBAC(types.NamespacedName{Name: name, Namespace: namespace}, true, false)
 
 	t.Run("should have a cluster role", func(t *testing.T) {
 		cr := rbac.clusterRole
@@ -225,6 +225,60 @@ func TestMakeMetricGatewayRBACWithKymaInputAllowed(t *testing.T) {
 	})
 }
 
+func TestMakeMetricGatewayRBACWithK8sClusterReceiverAllowed(t *testing.T) {
+	name := "test-gateway"
+	namespace := "test-namespace"
+
+	metricGWRBAC := MakeMetricGatewayRBAC(types.NamespacedName{Name: name, Namespace: namespace}, false, true)
+	t.Run("should have a cluster role", func(t *testing.T) {
+		cr := metricGWRBAC.clusterRole
+		expectedRules := []rbacv1.PolicyRule{
+			{
+				APIGroups: []string{""},
+				Resources: []string{"namespaces", "pods"},
+				Verbs:     []string{"get", "list", "watch"},
+			},
+			{
+				APIGroups: []string{"apps"},
+				Resources: []string{"replicasets"},
+				Verbs:     []string{"get", "list", "watch"},
+			},
+			{
+				APIGroups: []string{""},
+				Resources: []string{"events", "namespaces", "namespaces/status", "nodes", "nodes/spec", "pods", "pods/status", "replicationcontrollers", "replicationcontrollers/status", "resourcequotas", "services"},
+				Verbs:     []string{"get", "list", "watch"},
+			}, {
+				APIGroups: []string{"apps"},
+				Resources: []string{"daemonsets", "deployments", "replicasets", "statefulsets"},
+				Verbs:     []string{"get", "list", "watch"},
+			}, {
+				APIGroups: []string{"extensions"},
+				Resources: []string{"daemonsets", "deployments", "replicasets"},
+				Verbs:     []string{"get", "list", "watch"},
+			}, {
+				APIGroups: []string{"batch"},
+				Resources: []string{"jobs", "cronjobs"},
+				Verbs:     []string{"get", "list", "watch"},
+			}, {
+				APIGroups: []string{"autoscaling"},
+				Resources: []string{"horizontalpodautoscalers"},
+				Verbs:     []string{"get", "list", "watch"},
+			}}
+
+		require.Equal(t, expectedRules, cr.Rules)
+		require.Equal(t, name, cr.Name)
+		require.Equal(t, namespace, cr.Namespace)
+		require.Equal(t, map[string]string{
+			"app.kubernetes.io/name": name,
+		}, cr.Labels)
+	})
+
+	t.Run("should have a cluster role binding", func(t *testing.T) {
+		crb := metricGWRBAC.clusterRoleBinding
+		checkClusterRoleBinding(t, crb, name, namespace)
+	})
+}
+
 func checkClusterRoleBinding(t *testing.T, crb *rbacv1.ClusterRoleBinding, name, namespace string) {
 	require.NotNil(t, crb)
 	require.Equal(t, name, crb.Name)