feat(rbac): wire hardened admission webhook for rbac-controller 0.2.0-pr9690.1 #49
Loading…
Reference in a new issue
No description provided.
Delete branch "ipceicis-9690-rbac-admission-deploy"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Wires the hardened RBAC admission controller (0.2.0-pr9690.1) into the deployment stack. Promotes the controller from prototype (
0.0.1) to the final artifact from commitfd17b13, adding the admission webhook, permission ceiling enforcement, and the updated KCP APIExport schema.Dependencies
Certificate+Issuerfor webhook TLS; cert-manager CRDs must be installed in the clusterAPIBindingclusterroles pre-acceptance; functional dependency before tenant bindings are acceptedipceicis-9690-rbac-admission-deploybookmark is separate from PR #47's bookmark.Artifact Versions
edp.buildth.ing/devfw-cicd/rbac-controller:0.2.0-pr9690.1fd17b13sha256:227c7137c04f435f1d4bd92fd77f6091bb9b8aff8cbac8169349b2f8166ec057rbac-controller0.2.0-pr9690.1edp.buildth.ing/devfw-cicd/charts/rbac-controllersha256:68c2720bf1b8ee9f0afb0a989fb6f40ea166c3ce4e87975179655dfd49cdd439rbac-controller-kcp0.2.0-pr9690.1edp.buildth.ing/devfw-cicd/charts/rbac-controller-kcpsha256:43dacd087d85d2367d4723de2c082bbae9971df893f21021540b20b0454fb813scel50items001s17f7e0b431fc(MaxItems CEL cost-budget fix)Admission Webhook Configuration
The controller runs an in-process HTTPS admission webhook server. The service URL and cert SANs were derived from
helm templateoutput — not assumed.Helm fullname derivation:
rbac-controller-dev(from ApplicationSetname: 'rbac-controller-{{name}}'withname=dev)rbac-controllerfullname = rbac-controller-devrbac-controller-dev-webhookVerified cert SANs (from
helm templateon0.2.0-pr9690.1):webhook.serviceURL:https://rbac-controller-dev-webhook.edge-connect-system.svc.cluster.local:443webhook.platformUsername:rbac-controller— the KCP X.509 mTLS CN of the controller cert. Bypasses only theedge-connect-rt-*reserved-name-prefix guard; all hard denials and ceiling rules still apply.Dynamic CA / VWC (No caBundle in Git)
The controller bootstrap reconciler manages the
ValidatingWebhookConfigurationin the KCP provider workspace (root:controllers:rbac) and dynamically syncs the cert-manager CA into the VWCcaBundle. No staticcaBundleis committed to Git.The
manage-vwcClusterRole + ClusterRoleBinding are now included inrbac-controller-kcp:0.2.0-pr9690.1— no new consumerpermissionClaimforvalidatingwebhookconfigurationsis needed.Permission Ceiling Postures
Local (E2E ceiling)
Read-only allowlist covering existing E2E RoleTemplate examples/tests. Only
get/list/watchverbs; no write or delete verbs granted to tenants.Dev (deny-all)
ceiling.rules: []— intentionally empty. The chart omits the--ceiling-configflag and the ConfigMap/volume entirely whenrulesis empty. The controller starts withCeiling=nil→ fail-closed: no tenant RoleTemplate creates or updates are accepted until an approved persona ceiling is explicitly configured. Verified viahelm template(no ceiling resources rendered).KCP APIExport Changes
Both
localanddevKCP values updated:schemaNamePrefix:s17f7e0b431fc→scel50items001(schema now hasMaxItemsbounds onPolicyRulearrays; required to avoid CEL cost-budget rejection in KCP)clusterrolespermissionClaim (required by the RoleTemplate controller in 0.2.0; previously missing)manage-vwcClusterRoleBinding forrbac-controlleruser is chart-managed (0.2.0+)Files Changed
argocd/edge-connect-rbac-controller.yamltargetRevisions bumped0.0.1→0.2.0-pr9690.1rbac-controller-values-local.yamlrbac-controller-values-dev.yamlrbac-controller-kcp-values-local.yamlrbac-controller-kcp-values-dev.yamlPre-merge Checklist
helm lint— both charts, both envs: 0 failureshelm template— webhook URL, cert SANs, image tag, args verified (0.2.0-pr9690.1)scel50items001schema,clusterroles+clusterrolebindings+eventsclaimsmanage-vwcRBAC in KCP chart — no GitcaBundleRefs: IPCEICIS-9690
Promote rbac-controller-manager from prototype to hardened admission deployment. Upgrades both Helm charts to 0.2.0-pr9690, wires the admission webhook, and sets environment-appropriate ceiling postures. Changes: - argocd/edge-connect-rbac-controller.yaml: bump both chart targetRevisions 0.0.1 → 0.2.0-pr9690 - rbac-controller-values-{local,dev}.yaml: - image.tag 0.0.1 / 0.1.0-pr9690 → 0.2.0-pr9690 - webhook.serviceURL: https://rbac-controller-dev-webhook.edge-connect-system.svc.cluster.local:443 (verified: fullname=rbac-controller-dev, cert SANs match) - webhook.platformUsername: rbac-controller (KCP mTLS CN, prefix guard) - local: read-only ceiling (secrets/deployments/pods/pods/log get/list/watch) - dev: ceiling.rules=[] → deny-all; ConfigMap/volume/arg omitted by chart - rbac-controller-kcp-values-{local,dev}.yaml: - schemaNamePrefix s17f7e0b431fc → scel50items001 (MaxItems CEL fix) - add clusterroles permissionClaim (RoleTemplate controller requires it) - manage-vwc ClusterRole+Binding now included in chart (no Git caBundle) Dependency: controller CA bootstrap (manage-vwc RBAC) is in 0.2.0 chart; no additional consumer permissionClaim for VWC required. Dynamic CA sync into root:controllers:rbac VWC is controller-managed. Not merge-ready: runtime E2E validation on dev cluster pending. Refs: IPCEICIS-9690feat(rbac): wire hardened admission webhook for rbac-controller 0.2.0-pr9690to feat(rbac): wire hardened admission webhook for rbac-controller 0.2.0-pr9690.1View command line instructions
Manual merge helper
Use this merge commit message when completing the merge manually.
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.