Skip to content

Commit a5240a6

Browse files
supreme-gg-ggsupreme-gg-gg
authored
feat(helm): support namespaced RBAC for MCP controller (#127)
Sibling of kagent-dev/tools#53 and kagent-dev/kagent#1549 Fixes a CI issue. Also separates out the build step in CI before running E2E tests. --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
1 parent c20b91f commit a5240a6

21 files changed

Lines changed: 3923 additions & 137 deletions

File tree

‎.github/workflows/test-e2e.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,15 @@ jobs:
2121

2222
- name: Create k8s Kind Cluster
2323
uses: helm/kind-action@v1
24-
- name: Running Test e2e
24+
with:
25+
cluster_name: kind
26+
27+
- name: Build controller image
28+
run: make docker-build CONTROLLER_IMG=ghcr.io/kagent-dev/kmcp/controller:e2e-test
29+
timeout-minutes: 15
30+
31+
- name: Run e2e tests
2532
run: |
26-
kind create cluster
2733
go mod tidy
2834
make test-e2e
35+
timeout-minutes: 20

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ HELM_REPO ?= oci://ghcr.io/kagent-dev
77

88
BUILD_DATE := $(shell date -u '+%Y-%m-%d')
99
GIT_COMMIT := $(shell git rev-parse --short HEAD || echo "unknown")
10-
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/-dirty//' | grep v || echo "v0.0.1+$(GIT_COMMIT)")
10+
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null | sed 's/-dirty//' | grep v || echo "v0.0.1-$(GIT_COMMIT)")
1111

1212

1313
# Version information for the build
@@ -166,7 +166,7 @@ test-e2e: manifests generate fmt vet ## Run the e2e tests. Expected an isolated
166166
echo "No Kind cluster is running. Please start a Kind cluster before running the e2e tests."; \
167167
exit 1; \
168168
}
169-
go test ./test/e2e/ -v
169+
go test ./test/e2e/ -v -timeout 30m
170170

171171
.PHONY: lint
172172
lint: golangci-lint ## Run golangci-lint linter

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/rbac/role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ rules:
88
- ""
99
resources:
1010
- configmaps
11+
- serviceaccounts
1112
- services
1213
verbs:
1314
- create

‎helm/kmcp-crds/templates/mcpserver-crd.yaml‎

Lines changed: 3309 additions & 41 deletions
Large diffs are not rendered by default.

‎helm/kmcp/templates/_helpers.tpl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,5 +83,9 @@ Create controller manager container args
8383
{{- if .Values.controller.metrics.enabled }}
8484
{{- $args = append $args (printf "--metrics-bind-address=%s" .Values.controller.metrics.bindAddress) }}
8585
{{- end }}
86+
{{- if not .Values.rbac.clusterScoped }}
87+
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
88+
{{- $args = append $args (printf "--watch-namespaces=%s" (join "," $namespaces)) }}
89+
{{- end }}
8690
{{- toYaml $args }}
8791
{{- end }}

‎helm/kmcp/templates/rbac/clusterrole.yaml‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,4 @@
1-
{{- if .Values.rbac.create }}
2-
apiVersion: rbac.authorization.k8s.io/v1
3-
kind: ClusterRole
4-
metadata:
5-
name: {{ include "kmcp.fullname" . }}-manager-role
6-
labels:
7-
{{- include "kmcp.labels" . | nindent 4 }}
8-
rules:
1+
{{- define "kmcp.manager.rules" -}}
92
- apiGroups:
103
- ""
114
resources:
@@ -58,4 +51,32 @@ rules:
5851
- get
5952
- patch
6053
- update
54+
{{- end -}}
55+
56+
{{- if .Values.rbac.create }}
57+
58+
{{- if .Values.rbac.clusterScoped }}
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: ClusterRole
61+
metadata:
62+
name: {{ include "kmcp.fullname" . }}-manager-role
63+
labels:
64+
{{- include "kmcp.labels" . | nindent 4 }}
65+
rules:
66+
{{- include "kmcp.manager.rules" . | nindent 2 }}
67+
{{- else }}
68+
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
69+
{{- range $namespace := $namespaces }}
70+
---
71+
apiVersion: rbac.authorization.k8s.io/v1
72+
kind: Role
73+
metadata:
74+
name: {{ include "kmcp.fullname" $ }}-manager-role
75+
namespace: {{ $namespace }}
76+
labels:
77+
{{- include "kmcp.labels" $ | nindent 4 }}
78+
rules:
79+
{{- include "kmcp.manager.rules" $ | nindent 2 }}
80+
{{- end }}
81+
{{- end }}
6182
{{- end }}

‎helm/kmcp/templates/rbac/clusterrolebinding.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- if .Values.rbac.create }}
2+
{{- if .Values.rbac.clusterScoped }}
23
apiVersion: rbac.authorization.k8s.io/v1
34
kind: ClusterRoleBinding
45
metadata:
@@ -13,4 +14,25 @@ subjects:
1314
- kind: ServiceAccount
1415
name: {{ include "kmcp.serviceAccountName" . }}
1516
namespace: {{ include "kmcp.namespace" . }}
17+
{{- else }}
18+
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kmcp.namespace" .)) }}
19+
{{- range $namespace := $namespaces }}
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
kind: RoleBinding
23+
metadata:
24+
name: {{ include "kmcp.fullname" $ }}-manager-rolebinding
25+
namespace: {{ $namespace }}
26+
labels:
27+
{{- include "kmcp.labels" $ | nindent 4 }}
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: {{ include "kmcp.fullname" $ }}-manager-role
32+
subjects:
33+
- kind: ServiceAccount
34+
name: {{ include "kmcp.serviceAccountName" $ }}
35+
namespace: {{ include "kmcp.namespace" $ }}
36+
{{- end }}
37+
{{- end }}
1638
{{- end }}

‎helm/kmcp/tests/__snapshot__/deployment_test.yaml.snap‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ should create deployment with default values:
88
app.kubernetes.io/managed-by: Helm
99
app.kubernetes.io/name: kmcp
1010
control-plane: controller-manager
11-
helm.sh/chart: kmcp-0.1.0
11+
helm.sh/chart: kmcp-1.0.0
1212
name: RELEASE-NAME-controller-manager
1313
namespace: NAMESPACE
1414
spec:
@@ -73,7 +73,7 @@ should create deployment with default values:
7373
runAsNonRoot: true
7474
seccompProfile:
7575
type: RuntimeDefault
76-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
76+
serviceAccountName: RELEASE-NAME-controller-manager
7777
terminationGracePeriodSeconds: 10
7878
volumes: []
7979
should include health probe ports when health probe enabled:
@@ -86,7 +86,7 @@ should include health probe ports when health probe enabled:
8686
app.kubernetes.io/managed-by: Helm
8787
app.kubernetes.io/name: kmcp
8888
control-plane: controller-manager
89-
helm.sh/chart: kmcp-0.1.0
89+
helm.sh/chart: kmcp-1.0.0
9090
name: RELEASE-NAME-controller-manager
9191
namespace: NAMESPACE
9292
spec:
@@ -151,7 +151,7 @@ should include health probe ports when health probe enabled:
151151
runAsNonRoot: true
152152
seccompProfile:
153153
type: RuntimeDefault
154-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
154+
serviceAccountName: RELEASE-NAME-controller-manager
155155
terminationGracePeriodSeconds: 10
156156
volumes: []
157157
should include image pull secrets when specified:
@@ -164,7 +164,7 @@ should include image pull secrets when specified:
164164
app.kubernetes.io/managed-by: Helm
165165
app.kubernetes.io/name: kmcp
166166
control-plane: controller-manager
167-
helm.sh/chart: kmcp-0.1.0
167+
helm.sh/chart: kmcp-1.0.0
168168
name: RELEASE-NAME-controller-manager
169169
namespace: NAMESPACE
170170
spec:
@@ -231,7 +231,7 @@ should include image pull secrets when specified:
231231
runAsNonRoot: true
232232
seccompProfile:
233233
type: RuntimeDefault
234-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
234+
serviceAccountName: RELEASE-NAME-controller-manager
235235
terminationGracePeriodSeconds: 10
236236
volumes: []
237237
should include metrics port when metrics enabled:
@@ -244,7 +244,7 @@ should include metrics port when metrics enabled:
244244
app.kubernetes.io/managed-by: Helm
245245
app.kubernetes.io/name: kmcp
246246
control-plane: controller-manager
247-
helm.sh/chart: kmcp-0.1.0
247+
helm.sh/chart: kmcp-1.0.0
248248
name: RELEASE-NAME-controller-manager
249249
namespace: NAMESPACE
250250
spec:
@@ -309,7 +309,7 @@ should include metrics port when metrics enabled:
309309
runAsNonRoot: true
310310
seccompProfile:
311311
type: RuntimeDefault
312-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
312+
serviceAccountName: RELEASE-NAME-controller-manager
313313
terminationGracePeriodSeconds: 10
314314
volumes: []
315315
should include node selector when specified:
@@ -322,7 +322,7 @@ should include node selector when specified:
322322
app.kubernetes.io/managed-by: Helm
323323
app.kubernetes.io/name: kmcp
324324
control-plane: controller-manager
325-
helm.sh/chart: kmcp-0.1.0
325+
helm.sh/chart: kmcp-1.0.0
326326
name: RELEASE-NAME-controller-manager
327327
namespace: NAMESPACE
328328
spec:
@@ -389,7 +389,7 @@ should include node selector when specified:
389389
runAsNonRoot: true
390390
seccompProfile:
391391
type: RuntimeDefault
392-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
392+
serviceAccountName: RELEASE-NAME-controller-manager
393393
terminationGracePeriodSeconds: 10
394394
volumes: []
395395
should include pod annotations when specified:
@@ -402,7 +402,7 @@ should include pod annotations when specified:
402402
app.kubernetes.io/managed-by: Helm
403403
app.kubernetes.io/name: kmcp
404404
control-plane: controller-manager
405-
helm.sh/chart: kmcp-0.1.0
405+
helm.sh/chart: kmcp-1.0.0
406406
name: RELEASE-NAME-controller-manager
407407
namespace: NAMESPACE
408408
spec:
@@ -469,7 +469,7 @@ should include pod annotations when specified:
469469
runAsNonRoot: true
470470
seccompProfile:
471471
type: RuntimeDefault
472-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
472+
serviceAccountName: RELEASE-NAME-controller-manager
473473
terminationGracePeriodSeconds: 10
474474
volumes: []
475475
should include tolerations when specified:
@@ -482,7 +482,7 @@ should include tolerations when specified:
482482
app.kubernetes.io/managed-by: Helm
483483
app.kubernetes.io/name: kmcp
484484
control-plane: controller-manager
485-
helm.sh/chart: kmcp-0.1.0
485+
helm.sh/chart: kmcp-1.0.0
486486
name: RELEASE-NAME-controller-manager
487487
namespace: NAMESPACE
488488
spec:
@@ -547,7 +547,7 @@ should include tolerations when specified:
547547
runAsNonRoot: true
548548
seccompProfile:
549549
type: RuntimeDefault
550-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
550+
serviceAccountName: RELEASE-NAME-controller-manager
551551
terminationGracePeriodSeconds: 10
552552
tolerations:
553553
- effect: NoSchedule
@@ -565,7 +565,7 @@ should set custom replica count:
565565
app.kubernetes.io/managed-by: Helm
566566
app.kubernetes.io/name: kmcp
567567
control-plane: controller-manager
568-
helm.sh/chart: kmcp-0.1.0
568+
helm.sh/chart: kmcp-1.0.0
569569
name: RELEASE-NAME-controller-manager
570570
namespace: NAMESPACE
571571
spec:
@@ -630,7 +630,7 @@ should set custom replica count:
630630
runAsNonRoot: true
631631
seccompProfile:
632632
type: RuntimeDefault
633-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
633+
serviceAccountName: RELEASE-NAME-controller-manager
634634
terminationGracePeriodSeconds: 10
635635
volumes: []
636636
should set custom resources:
@@ -643,7 +643,7 @@ should set custom resources:
643643
app.kubernetes.io/managed-by: Helm
644644
app.kubernetes.io/name: kmcp
645645
control-plane: controller-manager
646-
helm.sh/chart: kmcp-0.1.0
646+
helm.sh/chart: kmcp-1.0.0
647647
name: RELEASE-NAME-controller-manager
648648
namespace: NAMESPACE
649649
spec:
@@ -708,7 +708,7 @@ should set custom resources:
708708
runAsNonRoot: true
709709
seccompProfile:
710710
type: RuntimeDefault
711-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
711+
serviceAccountName: RELEASE-NAME-controller-manager
712712
terminationGracePeriodSeconds: 10
713713
volumes: []
714714
should set pod security context:
@@ -721,7 +721,7 @@ should set pod security context:
721721
app.kubernetes.io/managed-by: Helm
722722
app.kubernetes.io/name: kmcp
723723
control-plane: controller-manager
724-
helm.sh/chart: kmcp-0.1.0
724+
helm.sh/chart: kmcp-1.0.0
725725
name: RELEASE-NAME-controller-manager
726726
namespace: NAMESPACE
727727
spec:
@@ -786,7 +786,7 @@ should set pod security context:
786786
runAsNonRoot: true
787787
seccompProfile:
788788
type: RuntimeDefault
789-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
789+
serviceAccountName: RELEASE-NAME-controller-manager
790790
terminationGracePeriodSeconds: 10
791791
volumes: []
792792
should set security context:
@@ -799,7 +799,7 @@ should set security context:
799799
app.kubernetes.io/managed-by: Helm
800800
app.kubernetes.io/name: kmcp
801801
control-plane: controller-manager
802-
helm.sh/chart: kmcp-0.1.0
802+
helm.sh/chart: kmcp-1.0.0
803803
name: RELEASE-NAME-controller-manager
804804
namespace: NAMESPACE
805805
spec:
@@ -864,7 +864,7 @@ should set security context:
864864
runAsNonRoot: true
865865
seccompProfile:
866866
type: RuntimeDefault
867-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
867+
serviceAccountName: RELEASE-NAME-controller-manager
868868
terminationGracePeriodSeconds: 10
869869
volumes: []
870870
should set termination grace period:
@@ -877,7 +877,7 @@ should set termination grace period:
877877
app.kubernetes.io/managed-by: Helm
878878
app.kubernetes.io/name: kmcp
879879
control-plane: controller-manager
880-
helm.sh/chart: kmcp-0.1.0
880+
helm.sh/chart: kmcp-1.0.0
881881
name: RELEASE-NAME-controller-manager
882882
namespace: NAMESPACE
883883
spec:
@@ -942,6 +942,6 @@ should set termination grace period:
942942
runAsNonRoot: true
943943
seccompProfile:
944944
type: RuntimeDefault
945-
serviceAccountName: RELEASE-NAME-kmcp-controller-manager
945+
serviceAccountName: RELEASE-NAME-controller-manager
946946
terminationGracePeriodSeconds: 10
947947
volumes: []

0 commit comments

Comments
 (0)