From 667d33eaaa53fd82978db18cc012fa100dcbe0ad Mon Sep 17 00:00:00 2001 From: Panagiotis Moustafellos Date: Mon, 26 Oct 2026 19:20:28 +0200 Subject: [PATCH 1/4] feat(rbac): read CronJob, PriorityClass, RBAC and Calico kinds Add get, list and watch rules for batch cronjobs, scheduling.k8s.io priorityclasses, rbac.authorization.k8s.io roles, clusterroles, rolebindings and clusterrolebindings, and crd.projectcalico.org ippools, bgppeers and ipamconfigs. The edge agent can now watch these kinds when an operator adds them to config.kube.resources. A rule for a CRD that is not installed is harmless, so the Calico rule is unconditional. The default config.kube.resources list is unchanged: the new kinds stay opt-in. The standalone manifests.yaml gets the same rules, and tests cover both the chart template and the manifest. Signed-off-by: Panagiotis Moustafellos --- manifests.yaml | 11 ++++++++++- templates/rbac.yaml | 11 ++++++++++- tests/manifests/check.sh | 8 ++++++++ tests/rbac_test.yaml | 29 +++++++++++++++++++++++++++++ 4 files changed, 57 insertions(+), 2 deletions(-) diff --git a/manifests.yaml b/manifests.yaml index 36ce8cd..e238d19 100644 --- a/manifests.yaml +++ b/manifests.yaml @@ -86,11 +86,20 @@ rules: resources: ["ingresses", "networkpolicies"] verbs: ["get", "list", "watch"] - apiGroups: ["batch"] - resources: ["jobs"] + resources: ["jobs", "cronjobs"] verbs: ["get", "list", "watch"] - apiGroups: ["policy"] resources: ["poddisruptionbudgets"] verbs: ["get", "list", "watch"] +- apiGroups: ["scheduling.k8s.io"] + resources: ["priorityclasses"] + verbs: ["get", "list", "watch"] +- apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"] + verbs: ["get", "list", "watch"] +- apiGroups: ["crd.projectcalico.org"] + resources: ["ippools", "bgppeers", "ipamconfigs"] + verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/templates/rbac.yaml b/templates/rbac.yaml index 3c4e7df..3c1d377 100644 --- a/templates/rbac.yaml +++ b/templates/rbac.yaml @@ -16,11 +16,20 @@ rules: resources: ["ingresses", "networkpolicies"] verbs: ["get", "list", "watch"] - apiGroups: ["batch"] - resources: ["jobs"] + resources: ["jobs", "cronjobs"] verbs: ["get", "list", "watch"] - apiGroups: ["policy"] resources: ["poddisruptionbudgets"] verbs: ["get", "list", "watch"] +- apiGroups: ["scheduling.k8s.io"] + resources: ["priorityclasses"] + verbs: ["get", "list", "watch"] +- apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"] + verbs: ["get", "list", "watch"] +- apiGroups: ["crd.projectcalico.org"] + resources: ["ippools", "bgppeers", "ipamconfigs"] + verbs: ["get", "list", "watch"] {{- with .Values.rbac.extraRules }} {{- toYaml . | nindent 0 }} {{- end }} diff --git a/tests/manifests/check.sh b/tests/manifests/check.sh index e422637..0aede6d 100755 --- a/tests/manifests/check.sh +++ b/tests/manifests/check.sh @@ -23,6 +23,14 @@ check "kube.resources has no services" jq -e '.kube.resources | index("services" role="$(yq -o=json 'select(.kind == "ClusterRole")' "$file")" check "ClusterRole core rule has endpoints" \ jq -e '.rules[] | select(.apiGroups == [""]) | .resources | index("endpoints")' <<<"$role" +check "ClusterRole reads cronjobs" \ + jq -e '.rules[] | select(.apiGroups == ["batch"]) | .resources | index("cronjobs")' <<<"$role" +check "ClusterRole reads priorityclasses" \ + jq -e '.rules[] | select(.apiGroups == ["scheduling.k8s.io"]) | .resources | index("priorityclasses")' <<<"$role" +check "ClusterRole reads clusterrolebindings" \ + jq -e '.rules[] | select(.apiGroups == ["rbac.authorization.k8s.io"]) | .resources | index("clusterrolebindings")' <<<"$role" +check "ClusterRole reads Calico ipamconfigs" \ + jq -e '.rules[] | select(.apiGroups == ["crd.projectcalico.org"]) | .resources | index("ipamconfigs")' <<<"$role" app_version="$(yq -r .appVersion "$root/Chart.yaml")" images="$(yq -r 'select(.kind == "Deployment") | .spec.template.spec.containers[].image' "$file")" diff --git a/tests/rbac_test.yaml b/tests/rbac_test.yaml index 140b308..054eb00 100644 --- a/tests/rbac_test.yaml +++ b/tests/rbac_test.yaml @@ -13,3 +13,32 @@ tests: - equal: path: rules[0].verbs value: [get, list, watch] + - it: lets the default ClusterRole read the CronJob, PriorityClass, RBAC and Calico kinds + documentSelector: + path: kind + value: ClusterRole + asserts: + - contains: + path: rules + content: + apiGroups: [batch] + resources: [jobs, cronjobs] + verbs: [get, list, watch] + - contains: + path: rules + content: + apiGroups: [scheduling.k8s.io] + resources: [priorityclasses] + verbs: [get, list, watch] + - contains: + path: rules + content: + apiGroups: [rbac.authorization.k8s.io] + resources: [roles, clusterroles, rolebindings, clusterrolebindings] + verbs: [get, list, watch] + - contains: + path: rules + content: + apiGroups: [crd.projectcalico.org] + resources: [ippools, bgppeers, ipamconfigs] + verbs: [get, list, watch] From 22d8a72ead830aa1b4b4db174afc05af3e3b78f3 Mon Sep 17 00:00:00 2001 From: Panagiotis Moustafellos Date: Mon, 26 Oct 2026 19:52:31 +0200 Subject: [PATCH 2/4] docs(values): list the opt-in informer kinds and fix stale comments values.yaml now shows cronjobs, priorityclasses, roles, clusterroles, rolebindings, clusterrolebindings, calicoippools, calicobgppeers and calicoipamconfigs as commented-out kube.resources entries. They stay off by default and the ClusterRole already grants them. The production example said it monitors all available resources, which stopped being true once opt-in kinds existed, so the comment now says it uses the default kinds. The header of tests/manifests/check.sh listed only the endpoints check; it now covers the CronJob, PriorityClass, RBAC and Calico rules too. Signed-off-by: Panagiotis Moustafellos --- examples/production-values.yaml | 3 ++- tests/manifests/check.sh | 5 +++-- values.yaml | 11 +++++++++++ 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/examples/production-values.yaml b/examples/production-values.yaml index 334ac32..bc03c90 100644 --- a/examples/production-values.yaml +++ b/examples/production-values.yaml @@ -49,7 +49,8 @@ config: kube: resyncInterval: "2m" - # Monitor all available resources + # Monitor the default resource kinds. The opt-in kinds listed in values.yaml + # (cronjobs, RBAC, Calico) are not enabled here. resources: - "pods" - "nodes" diff --git a/tests/manifests/check.sh b/tests/manifests/check.sh index 0aede6d..ef5de7f 100755 --- a/tests/manifests/check.sh +++ b/tests/manifests/check.sh @@ -1,7 +1,8 @@ #!/usr/bin/env bash # Checks the standalone manifests.yaml: the embedded config.json is valid and -# watches the informers the chart does, the ClusterRole can read endpoints, and -# the image tag matches the chart appVersion. Needs yq and jq. +# watches the informers the chart does, the ClusterRole can read endpoints and +# the CronJob, PriorityClass, RBAC and Calico kinds, and the image tag matches +# the chart appVersion. Needs yq and jq. # Usage: tests/manifests/check.sh set -euo pipefail diff --git a/values.yaml b/values.yaml index 96bbae1..edb87bf 100644 --- a/values.yaml +++ b/values.yaml @@ -207,6 +207,17 @@ config: - "ingresses" - "namespaces" - "services" + # Opt-in kinds, off by default. The ClusterRole already grants get, list + # and watch on them, so adding a name here is enough. + # - "cronjobs" + # - "priorityclasses" + # - "roles" + # - "clusterroles" + # - "rolebindings" + # - "clusterrolebindings" + # - "calicoippools" + # - "calicobgppeers" + # - "calicoipamconfigs" # Restrict which namespaces enter the resource graph. Unset (or mode "none") # means every namespace is graphed. The chart fails the render on invalid # combinations, mirroring the Edge's own validation: From d6dc3e8eafde2517dbcc825e8495416f1c04b37e Mon Sep 17 00:00:00 2001 From: Panagiotis Moustafellos Date: Mon, 26 Oct 2026 20:27:31 +0200 Subject: [PATCH 3/4] docs: fix two comments that overstate what the chart does values.yaml said adding a name to config.kube.resources is enough for the opt-in kinds. That is false for calicoippools, calicobgppeers and calicoipamconfigs: Calico's CRDs must also be installed, and the agent skips the kind otherwise. tests/manifests/check.sh said the embedded config.json watches the informers the chart does, but the check on line 22 requires it to omit services, which the chart default includes. The header now says what the config lists. Signed-off-by: Panagiotis Moustafellos --- tests/manifests/check.sh | 3 ++- values.yaml | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/manifests/check.sh b/tests/manifests/check.sh index ef5de7f..7af5136 100755 --- a/tests/manifests/check.sh +++ b/tests/manifests/check.sh @@ -1,6 +1,7 @@ #!/usr/bin/env bash # Checks the standalone manifests.yaml: the embedded config.json is valid and -# watches the informers the chart does, the ClusterRole can read endpoints and +# lists endpoints and k8services but not services (its list differs from the +# chart default, which has services), the ClusterRole can read endpoints and # the CronJob, PriorityClass, RBAC and Calico kinds, and the image tag matches # the chart appVersion. Needs yq and jq. # Usage: tests/manifests/check.sh diff --git a/values.yaml b/values.yaml index edb87bf..a852b67 100644 --- a/values.yaml +++ b/values.yaml @@ -208,7 +208,9 @@ config: - "namespaces" - "services" # Opt-in kinds, off by default. The ClusterRole already grants get, list - # and watch on them, so adding a name here is enough. + # and watch on them. The three calico* kinds also need Calico's CRDs + # (crd.projectcalico.org/v1) installed in the cluster; the agent skips + # them otherwise. # - "cronjobs" # - "priorityclasses" # - "roles" From 6b8bc5a6c03c45824004e1a4c07071a846b182aa Mon Sep 17 00:00:00 2001 From: Panagiotis Moustafellos Date: Mon, 26 Oct 2026 20:58:18 +0200 Subject: [PATCH 4/4] docs(examples): name priorityclasses among the opt-in kinds Signed-off-by: Panagiotis Moustafellos --- examples/production-values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/production-values.yaml b/examples/production-values.yaml index bc03c90..b917f8c 100644 --- a/examples/production-values.yaml +++ b/examples/production-values.yaml @@ -50,7 +50,7 @@ config: kube: resyncInterval: "2m" # Monitor the default resource kinds. The opt-in kinds listed in values.yaml - # (cronjobs, RBAC, Calico) are not enabled here. + # (cronjobs, priorityclasses, RBAC, Calico) are not enabled here. resources: - "pods" - "nodes"