Skip to content

Commit d192d08

Browse files
camilamacedo86camilamacedo86
committed
test: Add RBAC escalation test for installer ServiceAccount permissions
Add rbac-escalation-operator test bundle and e2e scenario to validate that the ClusterExtension installer ServiceAccount can install operators with diverse RBAC requirements. This operator requires storage.k8s.io and scheduling.k8s.io permissions that differ from the basic test-operator, ensuring the installer SA's bind/escalate verbs are properly exercised per the documented permission model in docs/concepts/permission-model.md. The test validates: - Installer SA can create RBAC for operators with different permissions - Kubernetes escalation prevention works with bind/escalate verbs - OLMv1 permission model supports diverse operator requirements - Regression prevention for RBAC permission issues
1 parent 1fa4169 commit d192d08

File tree

4 files changed

+148
-0
lines changed

4 files changed

+148
-0
lines changed

‎test/e2e/features/rbac-escalation.feature‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
Feature: RBAC Permissions for Extension Installation
2+
3+
Background:
4+
Given OLM is available
5+
And ClusterCatalog "test" serves bundles
6+
And ServiceAccount "olm-sa" with needed permissions is available in ${TEST_NAMESPACE}
7+
8+
# This test verifies that the ClusterExtension installer ServiceAccount has the necessary
9+
# RBAC permissions to install operators with different permission requirements.
10+
#
11+
# The rbac-escalation-operator requires permissions beyond what test-operator needs,
12+
# testing that the installer SA can create ClusterRoleBindings for roles with
13+
# permissions the SA itself doesn't directly possess (via bind/escalate verbs).
14+
#
15+
# See: docs/concepts/permission-model.md for OLMv1 permission requirements
16+
Scenario: Install operator with different RBAC requirements
17+
When ClusterExtension is applied
18+
"""
19+
apiVersion: olm.operatorframework.io/v1
20+
kind: ClusterExtension
21+
metadata:
22+
name: rbac-escalation-test
23+
spec:
24+
namespace: ${TEST_NAMESPACE}
25+
serviceAccount:
26+
name: olm-sa
27+
source:
28+
sourceType: Catalog
29+
catalog:
30+
packageName: rbac-escalation-operator
31+
selector:
32+
matchLabels:
33+
"olm.operatorframework.io/metadata.name": test-catalog
34+
"""
35+
Then ClusterExtension is available
36+
And bundle "rbac-escalation-operator.1.0.0" is installed in version "1.0.0"
37+

‎testdata/images/bundles/rbac-escalation-operator/v1.0.0/manifests/rbac-escalation-operator.clusterserviceversion.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
apiVersion: operators.coreos.com/v1alpha1
2+
kind: ClusterServiceVersion
3+
metadata:
4+
name: rbac-escalation-operator.v1.0.0
5+
namespace: placeholder
6+
spec:
7+
apiservicedefinitions: {}
8+
customresourcedefinitions:
9+
owned: []
10+
description: Test operator for validating RBAC escalation handling with diverse permission requirements
11+
displayName: RBAC Escalation Test Operator
12+
install:
13+
spec:
14+
deployments:
15+
- name: rbac-escalation-operator
16+
spec:
17+
replicas: 1
18+
selector:
19+
matchLabels:
20+
app: rbac-escalation
21+
template:
22+
metadata:
23+
labels:
24+
app: rbac-escalation
25+
spec:
26+
terminationGracePeriodSeconds: 0
27+
containers:
28+
- name: manager
29+
image: busybox:1.37
30+
command: ["/bin/sh", "-c", "sleep 3600"]
31+
serviceAccountName: rbac-escalation-sa
32+
# These permissions differ from test-operator's requirements to validate
33+
# that the installer SA can handle operators with diverse RBAC needs
34+
clusterPermissions:
35+
- rules:
36+
# Requires storage.k8s.io permissions to test RBAC escalation handling
37+
- apiGroups:
38+
- storage.k8s.io
39+
resources:
40+
- storageclasses
41+
verbs:
42+
- create
43+
- update
44+
- delete
45+
- list
46+
- watch
47+
- get
48+
# Requires scheduling.k8s.io permissions to test diverse RBAC scenarios
49+
- apiGroups:
50+
- scheduling.k8s.io
51+
resources:
52+
- priorityclasses
53+
verbs:
54+
- create
55+
- update
56+
- delete
57+
- list
58+
- watch
59+
- get
60+
serviceAccountName: rbac-escalation-sa
61+
strategy: deployment
62+
installModes:
63+
- supported: false
64+
type: OwnNamespace
65+
- supported: false
66+
type: SingleNamespace
67+
- supported: false
68+
type: MultiNamespace
69+
- supported: true
70+
type: AllNamespaces
71+
keywords:
72+
- rbac-testing
73+
- escalation
74+
links:
75+
- name: RBAC Escalation Operator
76+
url: https://github.com/operator-framework/operator-controller
77+
maintainers:
78+
- email: dev@operatorframework.io
79+
name: OLM Team
80+
maturity: alpha
81+
provider:
82+
name: Operator Framework
83+
url: https://operatorframework.io
84+
version: 1.0.0

‎testdata/images/bundles/rbac-escalation-operator/v1.0.0/metadata/annotations.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
annotations:
2+
operators.operatorframework.io.bundle.channel.default.v1: stable
3+
operators.operatorframework.io.bundle.channels.v1: stable
4+
operators.operatorframework.io.bundle.manifests.v1: manifests/
5+
operators.operatorframework.io.bundle.mediatype.v1: registry+v1
6+
operators.operatorframework.io.bundle.metadata.v1: metadata/
7+
operators.operatorframework.io.bundle.package.v1: rbac-escalation-operator

‎testdata/images/catalogs/test-catalog/v1/configs/catalog.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,3 +159,23 @@ properties:
159159
value:
160160
packageName: single-namespace-operator
161161
version: 1.0.0
162+
---
163+
schema: olm.package
164+
name: rbac-escalation-operator
165+
defaultChannel: stable
166+
---
167+
schema: olm.channel
168+
name: stable
169+
package: rbac-escalation-operator
170+
entries:
171+
- name: rbac-escalation-operator.1.0.0
172+
---
173+
schema: olm.bundle
174+
name: rbac-escalation-operator.1.0.0
175+
package: rbac-escalation-operator
176+
image: docker-registry.operator-controller-e2e.svc.cluster.local:5000/bundles/registry-v1/rbac-escalation-operator:v1.0.0
177+
properties:
178+
- type: olm.package
179+
value:
180+
packageName: rbac-escalation-operator
181+
version: 1.0.0

0 commit comments

Comments
 (0)