feat(rbac): read CronJob, PriorityClass, RBAC and Calico kinds

examples/production-values.yaml

@@ -49,7 +49,8 @@ config:
 
   kube:
     resyncInterval: "2m"
-    # Monitor all available resources
+    # Monitor the default resource kinds. The opt-in kinds listed in values.yaml
+    # (cronjobs, priorityclasses, RBAC, Calico) are not enabled here.
     resources:
       - "pods"
       - "nodes"  

manifests.yaml

@@ -86,11 +86,20 @@ rules:
   resources: ["ingresses", "networkpolicies"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["batch"]
-  resources: ["jobs"]
+  resources: ["jobs", "cronjobs"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["policy"]
   resources: ["poddisruptionbudgets"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["scheduling.k8s.io"]
+  resources: ["priorityclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["rbac.authorization.k8s.io"]
+  resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["crd.projectcalico.org"]
+  resources: ["ippools", "bgppeers", "ipamconfigs"]
+  verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

templates/rbac.yaml

@@ -16,11 +16,20 @@ rules:
   resources: ["ingresses", "networkpolicies"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["batch"]
-  resources: ["jobs"]
+  resources: ["jobs", "cronjobs"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["policy"]
   resources: ["poddisruptionbudgets"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["scheduling.k8s.io"]
+  resources: ["priorityclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["rbac.authorization.k8s.io"]
+  resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["crd.projectcalico.org"]
+  resources: ["ippools", "bgppeers", "ipamconfigs"]
+  verbs: ["get", "list", "watch"]
 {{- with .Values.rbac.extraRules }}
 {{- toYaml . | nindent 0 }}
 {{- end }}

tests/manifests/check.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 # Checks the standalone manifests.yaml: the embedded config.json is valid and
-# watches the informers the chart does, the ClusterRole can read endpoints, and
-# the image tag matches the chart appVersion. Needs yq and jq.
+# lists endpoints and k8services but not services (its list differs from the
+# chart default, which has services), the ClusterRole can read endpoints and
+# the CronJob, PriorityClass, RBAC and Calico kinds, and the image tag matches
+# the chart appVersion. Needs yq and jq.
 # Usage: tests/manifests/check.sh
 set -euo pipefail
 
@@ -23,6 +25,14 @@ check "kube.resources has no services" jq -e '.kube.resources | index("services"
 role="$(yq -o=json 'select(.kind == "ClusterRole")' "$file")"
 check "ClusterRole core rule has endpoints" \
   jq -e '.rules[] | select(.apiGroups == [""]) | .resources | index("endpoints")' <<<"$role"
+check "ClusterRole reads cronjobs" \
+  jq -e '.rules[] | select(.apiGroups == ["batch"]) | .resources | index("cronjobs")' <<<"$role"
+check "ClusterRole reads priorityclasses" \
+  jq -e '.rules[] | select(.apiGroups == ["scheduling.k8s.io"]) | .resources | index("priorityclasses")' <<<"$role"
+check "ClusterRole reads clusterrolebindings" \
+  jq -e '.rules[] | select(.apiGroups == ["rbac.authorization.k8s.io"]) | .resources | index("clusterrolebindings")' <<<"$role"
+check "ClusterRole reads Calico ipamconfigs" \
+  jq -e '.rules[] | select(.apiGroups == ["crd.projectcalico.org"]) | .resources | index("ipamconfigs")' <<<"$role"
 
 app_version="$(yq -r .appVersion "$root/Chart.yaml")"
 images="$(yq -r 'select(.kind == "Deployment") | .spec.template.spec.containers[].image' "$file")"

tests/rbac_test.yaml

@@ -13,3 +13,32 @@ tests:
       - equal:
           path: rules[0].verbs
           value: [get, list, watch]
+  - it: lets the default ClusterRole read the CronJob, PriorityClass, RBAC and Calico kinds
+    documentSelector:
+      path: kind
+      value: ClusterRole
+    asserts:
+      - contains:
+          path: rules
+          content:
+            apiGroups: [batch]
+            resources: [jobs, cronjobs]
+            verbs: [get, list, watch]
+      - contains:
+          path: rules
+          content:
+            apiGroups: [scheduling.k8s.io]
+            resources: [priorityclasses]
+            verbs: [get, list, watch]
+      - contains:
+          path: rules
+          content:
+            apiGroups: [rbac.authorization.k8s.io]
+            resources: [roles, clusterroles, rolebindings, clusterrolebindings]
+            verbs: [get, list, watch]
+      - contains:
+          path: rules
+          content:
+            apiGroups: [crd.projectcalico.org]
+            resources: [ippools, bgppeers, ipamconfigs]
+            verbs: [get, list, watch]

values.yaml

@@ -207,6 +207,19 @@ config:
       - "ingresses" 
       - "namespaces"
       - "services"
+      # Opt-in kinds, off by default. The ClusterRole already grants get, list
+      # and watch on them. The three calico* kinds also need Calico's CRDs
+      # (crd.projectcalico.org/v1) installed in the cluster; the agent skips
+      # them otherwise.
+      # - "cronjobs"
+      # - "priorityclasses"
+      # - "roles"
+      # - "clusterroles"
+      # - "rolebindings"
+      # - "clusterrolebindings"
+      # - "calicoippools"
+      # - "calicobgppeers"
+      # - "calicoipamconfigs"
     # Restrict which namespaces enter the resource graph. Unset (or mode "none")
     # means every namespace is graphed. The chart fails the render on invalid
     # combinations, mirroring the Edge's own validation: