adding backend resources for serviceaccount, clusterrole, and roles by kurwang · Pull Request #4832 · stolostron/console

kurwang · 2025-07-30T14:13:09Z

📝 Summary

Ticket Summary (Title):
Implement backend resources for rbac including serviceaccount and roles

Ticket Link:
(https://issues.redhat.com/browse/ACM-22617)

Type of Change:

✅ Checklist

General

PR title follows the convention (e.g. ACM-12340 Fix bug with...)
Code builds and runs locally without errors
No console logs, commented-out code, or unnecessary files
All commits are meaningful and well-labeled
All new display strings are externalized for localization (English only)
(Nice to have) JSDoc comments added for new functions and interfaces

If Feature

UI/UX reviewed (if applicable)
All acceptance criteria met
Unit test coverage added or updated
Relevant documentation or comments included

If Bugfix

Root cause and fix summary are documented in the ticket (for future reference / errata)
Fix tested thoroughly and resolves the issue
Test(s) added to prevent regression

🗒️ Notes for Reviewers

kurwang · 2025-07-30T15:42:36Z

/retest

oksanabaza · 2025-07-30T21:17:21Z

/lgtm

Ginxo

good job!! just few typing considerations.

Ginxo · 2025-07-31T08:29:28Z

+  kind: ServiceAccountKindType
+  metadata: Metadata
+  secrets: string[]
+  imagePullSecrets: string[]


See https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/service-account-v1/#ServiceAccount so it is something like

"imagePullSecrets": [ { "name": "builder-dockercfg-ggmbc" } ]

so I guess it is fair to explicitly type like

Suggested change

imagePullSecrets: string[]

imagePullSecrets: LocalObjectReference[]

and to create a new kubernetes-client.ts at frontend/src/resources containing

export interface LocalObjectReference { name: string }

wdyt?

agreed with these comments, will make the appropriate changes

Ginxo · 2025-07-31T08:30:31Z

+  apiVersion: ServiceAccountApiVersionType
+  kind: ServiceAccountKindType
+  metadata: Metadata
+  secrets: string[]


the same from imagePullSecrets applies to this but using ObjectReference from @openshift-console/dynamic-plugin-sdk library

Ginxo · 2025-07-31T08:33:06Z

+    verbs: string[]
+    apiGroups: string[]
+    resources: string[]
+    resourceNames: string[]


Suggested change

resourceNames: string[]

resourceNames?: string[]

from https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-v1/#Role

ResourceNames is an optional white list of names...

I would anyway create a new PolicyRule interface at frontend/src/resources/kubernetes-client.ts containing

import { ObjectReference } from '@openshift-console/dynamic-plugin-sdk' export interface LocalObjectReference { verbs: ObjectReference[] apiGroups: string[] resources: string[] resourceNames?: string[] }

and I would also replace ClusterRole.rules from the same file

Ginxo · 2025-07-31T08:48:01Z

+    kind: 'User' | 'Group'
+    apiGroup: 'rbac.authorization.k8s.io'
+    name: string
+    namespace: string


Suggested change

namespace: string

namespace?: string

see https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-binding-v1/#RoleBinding

Signed-off-by: kurwang <madeof50gold@gmail.com>

mshort55

Perhaps consider creating subjects and roleref interfaces to be used in the RoleBinding and ClusterRoleBinding interfaces because RoleBinding and ClusterRoleBinding structures are almost identical:

RoleBinding_structure.txt

ClusterRoleBinding_structure.txt

You can use "oc explain ObjectName --recursive" to get k8s object structures/fields.

mshort55 · 2025-07-31T16:28:46Z

+  kind: RoleBindingKindType
+  metadata: Metadata
+  subjects?: {
+    kind: 'User' | 'Group'


Suggested change

kind: 'User' | 'Group'

kind: UserKindType | GroupKindType | ServiceAccountKindType

I think you should make a similar change in ClusterRoleBinding.

agreed, created them and moved them in kubernetes-client.ts because they are generic kubernetes types that can be reused

Signed-off-by: kurwang <madeof50gold@gmail.com>

Ginxo

much better!! great job!

Ginxo · 2025-08-01T06:42:55Z

/lgtm

Ginxo · 2025-08-01T06:43:16Z

/retest

kurwang · 2025-08-01T13:01:06Z

/retest

mshort55 · 2025-08-01T14:58:03Z

/lgtm

kurwang · 2025-08-01T16:03:08Z

/retest

kurwang · 2025-08-04T12:40:09Z

/retest

kurwang · 2025-08-04T13:50:03Z

/retest

Signed-off-by: kurwang <madeof50gold@gmail.com>

sonarqubecloud · 2025-08-04T15:14:03Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Ginxo · 2025-08-04T15:31:35Z

/lgtm

openshift-ci · 2025-08-04T15:32:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ginxo, kurwang, mshort55, oksanabaza

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Ginxo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mshort55 · 2025-08-04T17:46:13Z

/lgtm

openshift-ci Bot added the dco-signoff: yes label Jul 30, 2025

openshift-ci Bot assigned oksanabaza Jul 30, 2025

openshift-ci Bot added the lgtm label Jul 30, 2025

Ginxo requested changes Jul 31, 2025

View reviewed changes

openshift-ci Bot assigned Ginxo Jul 31, 2025

openshift-ci Bot removed the lgtm label Jul 31, 2025

add changes to rbac.ts using kubernetes-client.ts

65183f4

Signed-off-by: kurwang <madeof50gold@gmail.com>

kurwang force-pushed the ACM-22617 branch from 2dac2d9 to 65183f4 Compare July 31, 2025 15:36

mshort55 reviewed Jul 31, 2025

View reviewed changes

adding subject and roleref interface to kubernetes-client.ts

d58b1f0

Signed-off-by: kurwang <madeof50gold@gmail.com>

kurwang force-pushed the ACM-22617 branch from a92fe7a to d58b1f0 Compare July 31, 2025 19:35

Ginxo approved these changes Aug 1, 2025

View reviewed changes

openshift-ci Bot added lgtm approved labels Aug 1, 2025

openshift-ci Bot assigned mshort55 Aug 1, 2025

openshift-ci Bot removed the lgtm label Aug 4, 2025

adding missing copyright and fix files from npm run check:fix

b59e5a8

Signed-off-by: kurwang <madeof50gold@gmail.com>

kurwang force-pushed the ACM-22617 branch from 8e07201 to b59e5a8 Compare August 4, 2025 14:35

openshift-ci Bot added the lgtm label Aug 4, 2025

openshift-merge-bot Bot merged commit a213db9 into stolostron:main Aug 4, 2025
11 checks passed

	imagePullSecrets: string[]
	imagePullSecrets: LocalObjectReference[]

	kind: 'User' \| 'Group'
	kind: UserKindType \| GroupKindType \| ServiceAccountKindType

Conversation

kurwang commented Jul 30, 2025

📝 Summary

✅ Checklist

General

If Feature

If Bugfix

🗒️ Notes for Reviewers

Uh oh!

kurwang commented Jul 30, 2025

Uh oh!

oksanabaza commented Jul 30, 2025

Uh oh!

Ginxo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mshort55 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Ginxo left a comment

Choose a reason for hiding this comment

Uh oh!

Ginxo commented Aug 1, 2025

Uh oh!

Ginxo commented Aug 1, 2025

Uh oh!

kurwang commented Aug 1, 2025

Uh oh!

mshort55 commented Aug 1, 2025

Uh oh!

kurwang commented Aug 1, 2025

Uh oh!

kurwang commented Aug 4, 2025

Uh oh!

kurwang commented Aug 4, 2025

Uh oh!

sonarqubecloud Bot commented Aug 4, 2025

Quality Gate passed

Uh oh!

Ginxo commented Aug 4, 2025

Uh oh!

openshift-ci Bot commented Aug 4, 2025

Uh oh!

Uh oh!

mshort55 commented Aug 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mshort55 left a comment •

edited

Loading