Skip to content

OCPBUGS-97605: Use static ServiceAccount for operand #535

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bentito wants to merge 3 commits into
base: main
Choose a base branch
from
Open

OCPBUGS-97605: Use static ServiceAccount for operand #535

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
80a5ece
OCPBUGS-97605: Use static ServiceAccount for operand
bentito Jul 17, 2026
f3aee26
build: update golangci-lint script for Apple Silicon support
bentito Jul 17, 2026
0e98973
OCPBUGS-97605: Remove overly permissive Group subject from RBAC
bentito Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions bundle/manifests/external-dns_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,6 @@ roleRef:
kind: ClusterRole
name: external-dns
subjects:
- kind: Group
name: system:serviceaccounts:external-dns
namespace: external-dns
- kind: Group
name: system:serviceaccounts:external-dns-operator
- kind: ServiceAccount
name: external-dns
namespace: external-dns-operator
7 changes: 2 additions & 5 deletions config/rbac/operand_rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,6 @@ roleRef:
kind: ClusterRole
name: external-dns
subjects:
- kind: Group
name: system:serviceaccounts:external-dns
namespace: external-dns
- kind: Group
name: system:serviceaccounts:external-dns-operator
- kind: ServiceAccount
name: external-dns
namespace: external-dns-operator
Comment thread
coderabbitai[bot] marked this conversation as resolved.
27 changes: 19 additions & 8 deletions hack/golangci-lint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,27 +10,38 @@ GOARCH=$(go env GOARCH)

case $GOOS in
linux)
CHECKSUM="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"
if [ "$GOARCH" = "amd64" ]; then
CHECKSUM="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"
else
echo "Unsupported architecture $GOARCH for $GOOS"
exit 1
fi
;;
darwin)
CHECKSUM="66fb0da81b8033b477f97eea420d4b46b230ca172b8bb87c6610109f3772b6b6"
if [ "$GOARCH" = "amd64" ]; then
CHECKSUM="66fb0da81b8033b477f97eea420d4b46b230ca172b8bb87c6610109f3772b6b6"
elif [ "$GOARCH" = "arm64" ]; then
CHECKSUM="03bfadf67e52b441b7ec21305e501c717df93c959836d66c7f97312654acb297"
else
echo "Unsupported architecture $GOARCH for $GOOS"
exit 1
fi
;;
*)
echo "Unsupported OS $GOOS"
exit 1
;;
esac

if [ "$GOARCH" != "amd64" ]; then
echo "Unsupported architecture $GOARCH"
exit 1
fi

TEMPDIR=$(mktemp -d)
curl --silent --location -o "$TEMPDIR/golangci-lint.tar.gz" "https://github.com/golangci/golangci-lint/releases/download/v$GOLANGCI_VERSION/golangci-lint-$GOLANGCI_VERSION-$GOOS-$GOARCH.tar.gz"
tar xzf "$TEMPDIR/golangci-lint.tar.gz" --directory="$TEMPDIR"

echo "$CHECKSUM" "$TEMPDIR/golangci-lint.tar.gz" | sha256sum -c --quiet
if [ "$GOOS" = "darwin" ]; then
echo "$CHECKSUM $TEMPDIR/golangci-lint.tar.gz" | shasum -a 256 -c
else
echo "$CHECKSUM $TEMPDIR/golangci-lint.tar.gz" | sha256sum -c --quiet
fi

BIN=$TEMPDIR/golangci-lint-$GOLANGCI_VERSION-$GOOS-$GOARCH/golangci-lint
mv "$BIN" "$OUTPUT_PATH"
Expand Down
7 changes: 4 additions & 3 deletions pkg/operator/controller/externaldns/controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/reconcile"

operatorv1beta1 "github.com/openshift/external-dns-operator/api/v1beta1"
controller "github.com/openshift/external-dns-operator/pkg/operator/controller"
"github.com/openshift/external-dns-operator/pkg/operator/controller/utils/test"
)

Expand Down Expand Up @@ -90,7 +91,7 @@ func TestReconcile(t *testing.T) {
ObjType: serviceAccountResource,
NamespacedName: types.NamespacedName{
Namespace: test.OperandNamespace,
Name: test.OperandName,
Name: controller.ExternalDNSOperandServiceAccountName(),
},
},
{
Expand Down Expand Up @@ -129,7 +130,7 @@ func TestReconcile(t *testing.T) {
ObjType: serviceAccountResource,
NamespacedName: types.NamespacedName{
Namespace: test.OperandNamespace,
Name: test.OperandName,
Name: controller.ExternalDNSOperandServiceAccountName(),
},
},
{
Expand Down Expand Up @@ -161,7 +162,7 @@ func TestReconcile(t *testing.T) {
ObjType: serviceAccountResource,
NamespacedName: types.NamespacedName{
Namespace: test.OperandNamespace,
Name: test.OperandName,
Name: controller.ExternalDNSOperandServiceAccountName(),
},
},
{
Expand Down
4 changes: 2 additions & 2 deletions pkg/operator/controller/externaldns/service_account.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ import (

// ensureExternalDNSServiceAccount ensures that the externalDNS service account exists.
func (r *reconciler) ensureExternalDNSServiceAccount(ctx context.Context, namespace string, externalDNS *operatorv1beta1.ExternalDNS) (bool, *corev1.ServiceAccount, error) {
nsName := types.NamespacedName{Namespace: namespace, Name: controller.ExternalDNSResourceName(externalDNS)}
nsName := types.NamespacedName{Namespace: namespace, Name: controller.ExternalDNSOperandServiceAccountName()}

desired := desiredExternalDNSServiceAccount(namespace, externalDNS)

Expand Down Expand Up @@ -72,7 +72,7 @@ func desiredExternalDNSServiceAccount(namespace string, externalDNS *operatorv1b
return &corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Namespace: namespace,
Name: controller.ExternalDNSResourceName(externalDNS),
Name: controller.ExternalDNSOperandServiceAccountName(),
},
}
}
Expand Down
6 changes: 3 additions & 3 deletions pkg/operator/controller/externaldns/service_account_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func TestEnsureExternalDNSServiceAccount(t *testing.T) {
expectedExist: true,
expectedSA: corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Name: controller.ExternalDNSResourceName(test.ExternalDNS),
Name: controller.ExternalDNSOperandServiceAccountName(),
Namespace: test.OperandNamespace,
OwnerReferences: []metav1.OwnerReference{
{
Expand All @@ -67,7 +67,7 @@ func TestEnsureExternalDNSServiceAccount(t *testing.T) {
existingObjects: []runtime.Object{
&corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Name: controller.ExternalDNSResourceName(test.ExternalDNS),
Name: controller.ExternalDNSOperandServiceAccountName(),
Namespace: test.OperandNamespace,
OwnerReferences: []metav1.OwnerReference{
{
Expand All @@ -84,7 +84,7 @@ func TestEnsureExternalDNSServiceAccount(t *testing.T) {
expectedExist: true,
expectedSA: corev1.ServiceAccount{
ObjectMeta: metav1.ObjectMeta{
Name: controller.ExternalDNSResourceName(test.ExternalDNS),
Name: controller.ExternalDNSOperandServiceAccountName(),
Namespace: test.OperandNamespace,
OwnerReferences: []metav1.OwnerReference{
{
Expand Down
5 changes: 5 additions & 0 deletions pkg/operator/controller/names.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,11 @@ func ExternalDNSResourceName(externalDNS *operatorv1beta1.ExternalDNS) string {
return ExternalDNSBaseName + "-" + externalDNS.Name
}

// ExternalDNSOperandServiceAccountName returns the static ServiceAccount name for all operands.
func ExternalDNSOperandServiceAccountName() string {
return ExternalDNSBaseName
}

// ExternalDNSGlobalResourceName returns the name for the resources shared among ExternalDNS instances.
func ExternalDNSGlobalResourceName() string {
return ExternalDNSBaseName
Expand Down