feat(manager): grant RBAC for IPAM resources used by ui-apis - #5294
feat(manager): grant RBAC for IPAM resources used by ui-apis#5294tianfeng92 wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Manager component’s ClusterRole RBAC to allow the calico-manager service account (used by ui-apis) to read the Calico IPAM resources needed to power the IP Pools page (EV-7009), specifically across both the aggregated API and the CRD API group where required.
Changes:
- Grant
get/listonippoolsandipamconfigurationsin the aggregatedprojectcalico.orgAPI group. - Grant
listonipamblocksin thecrd.projectcalico.orgAPI group (since blocks are not served by the aggregated API). - Extend Manager rendering tests to assert the new RBAC rules in both relevant rule sets.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pkg/render/manager.go | Adds the new RBAC PolicyRules to the manager ClusterRole for IPAM resources required by ui-apis. |
| pkg/render/manager_test.go | Updates expected ClusterRole rules to include the new IPAM-related permissions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The IP Pools page in ui-apis needs to read ippools, ipamconfigurations (via projectcalico.org aggregated API) and ipamblocks (via the CRD API group crd.projectcalico.org, since blocks are not served by the aggregated API). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
350cf42 to
8f54376
Compare
ui-apis reads the Installation resource to detect IPAM mode for the /cluster endpoint. Add operator.tigera.io/installations get permission to the calico-manager ClusterRole. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The code grants an additional permission (get on operator.tigera.io/installations) that is not described in the PR description and should be either justified in the description or removed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
| { | ||
| // IP Pools page: ui-apis reads the Installation to detect the IPAM mode. | ||
| APIGroups: []string{"operator.tigera.io"}, | ||
| Resources: []string{"installations"}, | ||
| Verbs: []string{"get"}, |
|
RBAC changes moved into calico-private PR https://github.com/tigera/calico-private/pull/13614 — operator code lives in the monorepo now. |
Description
The IP Pools page (EV-7009) in ui-apis needs to read IPAM resources via the calico-manager service account. This PR adds the necessary RBAC rules to the manager ClusterRole:
ippoolsandipamconfigurationsviaprojectcalico.org(aggregated API)ipamblocksviacrd.projectcalico.org(CRD API group — blocks are not served by the aggregatedprojectcalico.org/v3API)https://github.com/tigera/calico-private/pull/13614
Release Note
None
AI Assistance
This PR was written with AI assistance (Claude Code).
Docs Changes
docs-not-required