Keep roles needed for running tests out of deployment manifest

Author: ewoutp

Makefile

@@ -50,6 +50,7 @@ endif
 endif
 MANIFESTPATHDEPLOYMENT := manifests/arango-deployment$(MANIFESTSUFFIX).yaml
 MANIFESTPATHSTORAGE := manifests/arango-storage$(MANIFESTSUFFIX).yaml
+MANIFESTPATHTEST := manifests/arango-test$(MANIFESTSUFFIX).yaml
 ifndef DEPLOYMENTNAMESPACE
 	DEPLOYMENTNAMESPACE := default
 endif
@@ -251,6 +252,7 @@ endif
 	kubectl apply -f manifests/crd.yaml
 	kubectl apply -f $(MANIFESTPATHSTORAGE)
 	kubectl apply -f $(MANIFESTPATHDEPLOYMENT)
+	kubectl apply -f $(MANIFESTPATHTEST)
 	$(ROOTDIR)/scripts/kube_create_storage.sh $(DEPLOYMENTNAMESPACE)
 	$(ROOTDIR)/scripts/kube_run_tests.sh $(DEPLOYMENTNAMESPACE) $(TESTIMAGE) "$(ENTERPRISEIMAGE)" $(TESTTIMEOUT) $(TESTLENGTHOPTIONS)
 ifneq ($(DEPLOYMENTNAMESPACE), default)
@@ -312,6 +314,7 @@ minikube-start:
 
 .PHONY: delete-operator
 delete-operator:
+	kubectl delete -f $(MANIFESTPATHTEST) --ignore-not-found
 	kubectl delete -f $(MANIFESTPATHDEPLOYMENT) --ignore-not-found
 	kubectl delete -f $(MANIFESTPATHSTORAGE) --ignore-not-found
 
@@ -320,4 +323,5 @@ redeploy-operator: delete-operator manifests
 	kubectl apply -f manifests/crd.yaml
 	kubectl apply -f $(MANIFESTPATHSTORAGE)
 	kubectl apply -f $(MANIFESTPATHDEPLOYMENT)
+	kubectl apply -f $(MANIFESTPATHTEST)
 	kubectl get pods 

manifests/.gitignore

@@ -1,2 +1,3 @@
 arango-deployment-dev.yaml
-arango-storage-dev.yaml
+arango-storage-dev.yaml
+arango-test-dev.yaml

manifests/templates/deployment/rbac.yaml

@@ -8,9 +8,6 @@ rules:
 - apiGroups: ["database.arangodb.com"]
   resources: ["arangodeployments"]
   verbs: ["*"]
-- apiGroups: [""]
-  resources: ["nodes"]
-  verbs: ["*"]
 
 ---
 

manifests/templates/test/rbac.yaml

@@ -0,0 +1,31 @@
+{{- if .RBAC -}}
+
+## Cluster role granting access to resources needed by the integration tests.
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ .Test.RoleName }}
+rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["list"]
+
+---
+
+## Bind the cluster role granting access to ArangoLocalStorage resources
+## to the default service account of the configured namespace.
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Test.RoleBindingName }}
+  namespace: {{ .Test.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Test.RoleName }}
+subjects:
+- kind: ServiceAccount
+  name: {{ .Test.ServiceAccountName }}
+  namespace: {{ .Test.Namespace }}
+
+{{- end -}}

tools/manifests/manifest_builder.go

@@ -57,6 +57,9 @@ var (
 		"rbac.yaml",
 		"deployment.yaml",
 	}
+	testTemplateNames = []string{
+		"rbac.yaml",
+	}
 )
 
 func init() {
@@ -79,6 +82,7 @@ type TemplateOptions struct {
 	RBAC            bool
 	Deployment      ResourceOptions
 	Storage         ResourceOptions
+	Test            CommonOptions
 }
 
 type CommonOptions struct {
@@ -123,6 +127,7 @@ func main() {
 	templateNameSet := map[string][]string{
 		"deployment": deploymentTemplateNames,
 		"storage":    storageTemplateNames,
+		"test":       testTemplateNames,
 	}
 
 	// Process templates
@@ -160,6 +165,12 @@ func main() {
 			},
 			OperatorDeploymentName: "arango-storage-operator",
 		},
+		Test: CommonOptions{
+			Namespace:          options.Namespace,
+			RoleName:           "arango-operator-test",
+			RoleBindingName:    "arango-operator-test",
+			ServiceAccountName: "default",
+		},
 	}
 	for group, templateNames := range templateNameSet {
 		output := &bytes.Buffer{}