chore: kyverno to assign roles to users from user group #9482

Omeramsc · 2025-12-04T16:38:49Z

Add a new policy that watches the konflux-support Group and automatically creates/updates a ClusterRoleBinding with individual User subjects.

This enables the namespace-lister service to grant access based on users in the group.

github-actions · 2025-12-04T16:38:58Z

🤖 Gemini AI Assistant Available

Hi @Omeramsc! I'm here to help with your pull request. You can interact with me using the following commands:

Available Commands

@gemini-cli /review - Request a comprehensive code review
- Example: @gemini-cli /review Please focus on security and performance
@gemini-cli <your question> - Ask me anything about the codebase
- Example: @gemini-cli How can I improve this function?
- Example: @gemini-cli What are the best practices for error handling here?

How to Use

Simply type one of the commands above in a comment on this PR
I'll analyze your code and provide detailed feedback
You can track my progress in the workflow logs

Permissions

Only OWNER, MEMBER, or COLLABORATOR users can trigger my responses. This ensures secure and appropriate usage.

This message was automatically added to help you get started with the Gemini AI assistant. Feel free to delete this comment if you don't need assistance.

github-actions · 2025-12-04T16:38:59Z

🤖 Hi @Omeramsc, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

...flux-support-nslister-access/generate-support-nslister-clusterrolebinding-clusterpolicy.yaml

filariow

Thanks for implementing this. This PR is updating dev/stg and prod environments at the same time. We should split it in two: one for dev/stg and a follow up one for prod

sadlerap

Policy looks good, but I think we may want some chainsaw tests to ensure future changes to this policy doesn't break our use-cases.

...s/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/chainsaw-test.yaml

filariow · 2025-12-10T11:55:22Z

...flux-support-nslister-access/generate-support-nslister-clusterrolebinding-clusterpolicy.yaml

+          subjects: "{{ userSubjects }}"
+          roleRef:
+            kind: ClusterRole
+            name: view


I'm not sure if we should use this one or the everyone-can-view. @hugares may I ask your feedback here?

I thought the plan was to give kflux permissions to the support people. Either konflux-contributor-user-actions or konflux-viewer-user-actions. All people in konflux development teams already have the view and view-everything clusterrole, those 2 are not what is needed so namespace lister return the NS in the list

changed to konflux-viewer-user-actions, I believe this should be good enough, isn't it?

Omeramsc · 2025-12-10T14:18:49Z

I'm not sure about the chainsaw tests; they fail as it seems Kyverno on CI cannot generate cluster-scoped resource. the other policies on infra check namespaced resources. is there a solution we can develop for it? should we create manual tests? @filariow

...s/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/chainsaw-test.yaml

Add a new policy that watches the konflux-support Group and automatically creates/updates a ClusterRoleBinding with individual User subjects. This enables the namespace-lister service to grant access based on users in the group. This change reflects on dev and stg envs only Signed-off-by: Omer Turner <[email protected]>

openshift-ci · 2025-12-15T13:16:26Z

@Omeramsc: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/appstudio-e2e-tests	`0922dbd`	link	true	`/test appstudio-e2e-tests`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

filariow

/lgtm
/approve

openshift-ci · 2025-12-15T14:30:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: filariow, Omeramsc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~components/policies/OWNERS~~ [filariow]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

filariow · 2025-12-15T14:32:16Z

overall the PR looks good to me. However e2e tests are failing with

 policies-in-cluster-local                           OutOfSync   Healthy
Waiting 10 seconds for application sync

Do we have the Group CRD as part of e2e tests?

openshift-ci bot requested review from filariow and sadlerap December 4, 2025 16:38

filariow reviewed Dec 4, 2025

View reviewed changes

...flux-support-nslister-access/generate-support-nslister-clusterrolebinding-clusterpolicy.yaml Outdated Show resolved Hide resolved

filariow requested changes Dec 4, 2025

View reviewed changes

Omeramsc force-pushed the remove_kyverno branch from 130eec3 to 30bd863 Compare December 7, 2025 08:29

Omeramsc requested a review from filariow December 8, 2025 15:31

sadlerap reviewed Dec 8, 2025

View reviewed changes

Omeramsc force-pushed the remove_kyverno branch 6 times, most recently from a2142d1 to 4c6f051 Compare December 10, 2025 11:30

filariow requested changes Dec 10, 2025

View reviewed changes

Omeramsc force-pushed the remove_kyverno branch from 4c6f051 to 9ee9e2a Compare December 10, 2025 13:58

filariow mentioned this pull request Dec 10, 2025

add nslister label to everyone-view #9449

Closed

Omeramsc force-pushed the remove_kyverno branch 2 times, most recently from 87bcc0e to f0e7168 Compare December 10, 2025 15:18

filariow reviewed Dec 10, 2025

View reviewed changes

...s/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/chainsaw-test.yaml Show resolved Hide resolved

Omeramsc force-pushed the remove_kyverno branch 2 times, most recently from 1ad9704 to 92bed8f Compare December 10, 2025 16:05

Omeramsc force-pushed the remove_kyverno branch from 92bed8f to e84f397 Compare December 11, 2025 16:38

Omeramsc added 2 commits December 12, 2025 01:51

Merge branch 'main' into remove_kyverno

462ba77

Merge branch 'main' into remove_kyverno

0922dbd

Omeramsc requested a review from filariow December 15, 2025 10:57

filariow approved these changes Dec 15, 2025

View reviewed changes

openshift-ci bot assigned filariow Dec 15, 2025

openshift-ci bot added the lgtm label Dec 15, 2025

openshift-ci bot added the approved label Dec 15, 2025

chore: kyverno to assign roles to users from user group #9482

Are you sure you want to change the base?

chore: kyverno to assign roles to users from user group #9482

Conversation

Omeramsc commented Dec 4, 2025

Uh oh!

github-actions bot commented Dec 4, 2025

🤖 Gemini AI Assistant Available

Available Commands

How to Use

Permissions

Uh oh!

github-actions bot commented Dec 4, 2025

Uh oh!

Uh oh!

filariow left a comment

Choose a reason for hiding this comment

Uh oh!

sadlerap left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

filariow Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

hugares Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Omeramsc Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Omeramsc commented Dec 10, 2025

Uh oh!

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

filariow left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 15, 2025

Uh oh!

filariow commented Dec 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants