Repository navigation
Conversation
…p role - Add config/laptop-rbac, a ClusterRole for kubedial forward mode bound to the multigres-operator:laptop group, so the deployed operator never holds pods/portforward. - Publish it as install-laptop-rbac.yaml, kept out of config/default and install-rbac.yaml so only dev and staging install it. - Pin the role to kubedial's documented forward-mode verbs and fail if pods/portforward leaks into the manager role. Signed-off-by: Verónica López <veronica.lopez@supabase.io>
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
graveland
approved these changes
Oct 24, 2026
| - apiGroups: | ||
| - discovery.k8s.io | ||
| resources: | ||
| - endpointslices |
Contributor
There was a problem hiding this comment.
We should be able to get rid of this by updating kubedial- I updated that today too to move towards this basic PR :D so pinning v0.3.0 should help
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
this PR gives laptop mode the RBAC that kubedial's forward mode needs, through a separate ClusterRole bound to a group, so a laptop run on a shared cluster can impersonate the operator ServiceAccount without
system:masters.After #743 a laptop run impersonating the operator ServiceAccount gets past the startup lease check, claims its namespace and applies children, then fails at topology registration:
kubedial: list endpointslices for service ...: endpointslices.discovery.k8s.io is forbidden. kubedial v0.1.0 documents forward mode as needingcreateonpods/portforward,getonservices,listonendpointslices.discovery.k8s.ioand cluster-widelistonpods. The manager role has the services and pods verbs but not the other two, so the only way through today is--as-group system:masters.Adding the two missing verbs to the manager role would give every production operator cluster-wide
pods/portforward, which reaches any port of any pod, Postgres included, and which the in-cluster operator never uses. The verbs go inconfig/laptop-rbacinstead, bound to the groupmultigres-operator:laptop, and are published as a separateinstall-laptop-rbac.yamlthat neitherconfig/defaultnorinstall-rbac.yamlincludes. A laptop run then impersonates the ServiceAccount plus that group. The repo carries no dependency on any particular impersonation tool; the doc shows the kubeconfigasandas-groupsfields.Rollout notes: the impersonated identity gains nothing until a deploy applies
install-laptop-rbac.yamlon the dev and staging clusters, and the person running it also needsimpersonateon themultigres-operator:laptopgroup. The internal scmultigres-operatorskill says to drop--as-grouponce #743 is deployed, which is not enough on its own; it should say to use--as-group multigres-operator:laptoponce this role is installed (@graveland owns it).Main changes
config/laptop-rbacwith a ClusterRole granting kubedial's four forward-mode verbs and a ClusterRoleBinding to themultigres-operator:laptopgroup.dist/install-laptop-rbac.yamlinmake build-installerand upload it with the other install manifests, so thecurrentpre-release and GoReleaser pick it up through their existinginstall*.yamlglobs.pods/portforwardappears in the generated manager role.docs/development/reconcile-gating.md, including that naming a group replaces the ServiceAccount's implicit groups while its name-bound permissions still apply.Testing
Ran
make manifests(no change to generated files, since no markers changed),make build-installer,kustomize build config/laptop-rbac,make lint, andgo test ./cmd/... ./config/.... Confirmedconfig/installer-rbacrenders nopods/portforward. Did not run a laptop session against a cluster with the new role, since nothing is applied to any cluster until the deployed manifests are bumped.