controller/vmagent: properly assign OwnerReference to Role and RB

Previously, operator assigned VMAgent as Owner for Role and Rolebindg at VMAgent. But the problem is, that at single-namespace mode operator cannot access CRD and assing proper Owner. It led to empty OwnerRefence and created role/rolebinding could be deleted by ARGOCD with enabled pruning. This commit properly assign OwnerReference to VMAgent CR object not cluster CRD. Signed-off-by: f41gh7 <[email protected]>
VictoriaMetrics · Oct 15, 2024 · 2a6817d · 2a6817d
1 parent a62852a
commit 2a6817d
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 7 deletions.
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
@@ -14,6 +14,7 @@ aliases:
 - [api](https://docs.victoriametrics.com/operator/api): adds new fields `maxDiskUsagePerUrl` and`forceVMProto` to the `VMagent` `remoteWriteSpec`
 - [vmuser](https://docs.victoriametrics.com/operator/resources/vmuser/): fixes the protocol of generated CRD target access url for vminsert and vmstorage when TLS is enabled.
 - [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): properly make transition to `statefulMode`. See [this issue](https://github.com/VictoriaMetrics/operator/issues/1127) for details.
+- [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): properly assign `OwnerRefrence` for `Role` and `RoleBinding` at `single-namespace` operator mode.
 - [operator](https://docs.victoriametrics.com/operator/): fixes pod scheduling with `useStrictSecurity` enabled by removing default values for `AppArmorProfile` and `SeccompProfile`. See [this issue](https://github.com/VictoriaMetrics/operator/issues/1120) for details.
 
 ## [v0.48.3](https://github.com/VictoriaMetrics/operator/releases/tag/v0.48.3) - 29 Sep 2024

diff --git a/internal/controller/operator/factory/reconcile/rbac.go b/internal/controller/operator/factory/reconcile/rbac.go
@@ -23,7 +23,7 @@ func RoleBinding(ctx context.Context, rclient client.Client, rb *rbacv1.RoleBind
 		if errors.IsNotFound(err) {
 			return rclient.Create(ctx, rb)
 		}
-		return fmt.Errorf("cannot get rolebinding for vmauth: %w", err)
+		return fmt.Errorf("cannot get exist rolebinding: %w", err)
 	}
 	if err := finalize.FreeIfNeeded(ctx, rclient, &existRoleBinding); err != nil {
 		return err
@@ -34,14 +34,16 @@ func RoleBinding(ctx context.Context, rclient client.Client, rb *rbacv1.RoleBind
 	if equality.Semantic.DeepEqual(rb.Subjects, existRoleBinding.Subjects) &&
 		equality.Semantic.DeepEqual(rb.RoleRef, existRoleBinding.RoleRef) &&
 		equality.Semantic.DeepEqual(rb.Labels, existRoleBinding.Labels) &&
-		equality.Semantic.DeepEqual(rb.Annotations, existRoleBinding.Annotations) {
+		equality.Semantic.DeepEqual(rb.Annotations, existRoleBinding.Annotations) &&
+		equality.Semantic.DeepEqual(rb.OwnerReferences, existRoleBinding.OwnerReferences) {
 		return nil
 	}
 	logger.WithContext(ctx).Info("updating rolebinding configuration", "rolebinding_name", rb.Name)
 
 	existRoleBinding.Labels = rb.Labels
 	existRoleBinding.Subjects = rb.Subjects
 	existRoleBinding.RoleRef = rb.RoleRef
+	existRoleBinding.OwnerReferences = rb.OwnerReferences
 	vmv1beta1.AddFinalizer(&existRoleBinding, &existRoleBinding)
 
 	return rclient.Update(ctx, &existRoleBinding)
@@ -54,23 +56,24 @@ func Role(ctx context.Context, rclient client.Client, rl *rbacv1.Role) error {
 		if errors.IsNotFound(err) {
 			return rclient.Create(ctx, rl)
 		}
-		return fmt.Errorf("cannot get role for vmauth: %w", err)
+		return fmt.Errorf("cannot get exist role: %w", err)
 	}
 	if err := finalize.FreeIfNeeded(ctx, rclient, &existRole); err != nil {
 		return err
 	}
 	existRole.Annotations = labels.Merge(existRole.Annotations, rl.Annotations)
-	existRole.OwnerReferences = rl.OwnerReferences
 
 	if equality.Semantic.DeepEqual(rl.Rules, existRole.Rules) &&
 		equality.Semantic.DeepEqual(rl.Labels, existRole.Labels) &&
-		equality.Semantic.DeepEqual(rl.Annotations, existRole.Annotations) {
+		equality.Semantic.DeepEqual(rl.Annotations, existRole.Annotations) &&
+		equality.Semantic.DeepEqual(rl.OwnerReferences, existRole.OwnerReferences) {
 		return nil
 	}
 	logger.WithContext(ctx).Info("updating role configuration", "role_name", rl.Name)
 
 	existRole.Labels = rl.Labels
 	existRole.Rules = rl.Rules
+	existRole.OwnerReferences = rl.OwnerReferences
 	vmv1beta1.AddFinalizer(&existRole, &existRole)
 
 	return rclient.Update(ctx, &existRole)

diff --git a/internal/controller/operator/factory/vmagent/rbac.go b/internal/controller/operator/factory/vmagent/rbac.go
@@ -258,7 +258,7 @@ func buildVMAgentNamespaceRole(cr *vmv1beta1.VMAgent) *rbacv1.Role {
 			Labels:          cr.AllLabels(),
 			Annotations:     cr.AnnotationsFiltered(),
 			Finalizers:      []string{vmv1beta1.FinalizerName},
-			OwnerReferences: cr.AsCRDOwner(),
+			OwnerReferences: cr.AsOwner(),
 		},
 		Rules: singleNSPolicyRules,
 	}
@@ -272,7 +272,7 @@ func buildVMAgentNamespaceRoleBinding(cr *vmv1beta1.VMAgent) *rbacv1.RoleBinding
 			Labels:          cr.AllLabels(),
 			Annotations:     cr.AnnotationsFiltered(),
 			Finalizers:      []string{vmv1beta1.FinalizerName},
-			OwnerReferences: cr.AsCRDOwner(),
+			OwnerReferences: cr.AsOwner(),
 		},
 		Subjects: []rbacv1.Subject{
 			{