Skip to content

Recreate rolebinding because roleRef attr is immutable

Thong Kuah requested to merge delete_role_binding_to_recreate into master

What does this MR do?

Recreate rolebinding because roleRef attr is immutable

Related issue: #31113 (comment 433913108)

Does this MR meet the acceptance criteria?

Testing

Connect a cluster to a project and run a pipeline which contains the following .gitlab-ci.yml

deploy to production:
  stage: deploy
  script: echo $KUBE_NAMESPACE
  environment: production

It recreates an existing rolebinding

  1. The existing rolebinding has edit roleRef:
Name:         gitlab-stable-going-26-production
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  edit
Subjects:
  Kind            Name                                        Namespace
  ----            ----                                        ---------
  ServiceAccount  stable-going-26-production-service-account  stable-going-26-production
  1. Enable the kubernetes_cluster_namespace_role_admin FF
  2. Clear cluster cache of the cluster, otherwise it will not even attempt to recreate the rolebinding
  3. Run another CI pipeline. The new rolebinding now has admin roleRef:
Name:         gitlab-stable-going-26-production
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind            Name                                        Namespace
  ----            ----                                        ---------
  ServiceAccount  stable-going-26-production-service-account  stable-going-26-production

It creates a new role binding

  1. There's no existing rolebinding,
  2. Enable the kubernetes_cluster_namespace_role_admin FF
  3. Run CI pipeline. The new rolebinding has admin roleRef:
Name:         gitlab-stable-going-26-review
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind            Name                                    Namespace
  ----            ----                                    ---------
  ServiceAccount  stable-going-26-review-service-account  stable-going-26-review

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Thong Kuah

Merge request reports