mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-13 08:05:19 +09:00
Aleksei Sviridkin
62204d4903
The suite's "does not grant a blanket wildcard verb on secrets" assert was a notContains over a rule object. helm-unittest compares every field it is handed by value equality, and `any: true` changes which fields are compared rather than how, so no spelling of that assert bounds what a verbs list may hold: `verbs: ["get", "*"]` satisfies all of them. Measured against the rendered ClusterRole, seven realistic spellings of a widened Secret grant left that assert green: a wildcard in resources, a wildcard in apiGroups, a "*" appended to the declared verb list, an extra field beside the verbs, deletecollection spelled out, and two where the grant is added as a separate rule. Those last two leave the whole suite green - appending apiGroups:['*'] resources:['*'] verbs:['*'] keeps the positive pin satisfied while the controller gains every verb on every Secret cluster-wide. Replace it with a bats guard over the rendered manifests. It unions the verbs that every ClusterRole and Role rule confers on core Secrets, expanding "*" on each of the three axes, and compares that union with the declared set. Equality rather than an upper bound: the controller is cluster-scoped, so a widening reaches every tenant namespace, and a narrowing breaks the two reconcilers that share the grant. The positive pin stays in tests/rbac_test.yaml. Value equality is the right primitive for pinning a rule as written and the wrong one for bounding what the rule may become. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
39 lines
1.5 KiB
YAML
39 lines
1.5 KiB
YAML
suite: cozystack-controller ClusterRole grants the shared Secret write
|
|
templates:
|
|
- templates/rbac.yaml
|
|
|
|
release:
|
|
name: cozystack-controller
|
|
namespace: cozy-system
|
|
|
|
# One Secret write grant serves two reconcilers (WildcardSecret replication and
|
|
# CACert projection, including "delete"); it scopes the platform controller's own
|
|
# ServiceAccount and widens no tenant's RBAC. This rule gates both features, so pin it.
|
|
#
|
|
# This suite pins the rule as written and nothing more. helm-unittest compares
|
|
# every field it is handed by value equality -- `any: true` changes which fields
|
|
# are compared, not how -- which is what a positive pin wants and what an upper
|
|
# bound on the grant cannot use: no spelling of `notContains` bounds what a verbs
|
|
# list may hold, so `verbs: ["get", "*"]` satisfies every one of them. The upper
|
|
# bound therefore lives in
|
|
# hack/cozystack-controller-secret-rbac.bats, which unions the verbs every
|
|
# rendered rule confers on core Secrets and compares that set with the declared
|
|
# one. Extend that file, not this one, when the question is what the controller
|
|
# may do to a Secret.
|
|
|
|
tests:
|
|
- it: grants the ClusterRole every verb both reconcilers need, including delete
|
|
documentSelector:
|
|
path: kind
|
|
value: ClusterRole
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: cozystack-controller
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|