Skip to content

feat: Implement Kubernetes Native RBAC Aggregation for cloud-manager#1740

Open
stekik wants to merge 11 commits into
kyma-project:mainfrom
stekik:rbac-aggregation
Open

feat: Implement Kubernetes Native RBAC Aggregation for cloud-manager#1740
stekik wants to merge 11 commits into
kyma-project:mainfrom
stekik:rbac-aggregation

Conversation

@stekik
Copy link
Copy Markdown
Contributor

@stekik stekik commented Mar 12, 2026

Description
This PR adds three aggregated ClusterRoles that automatically extend the standard Kubernetes view, edit, and admin roles with permissions for all cloud-manager CRDs

Changes proposed in this pull request:

Related issue(s)

@stekik stekik requested a review from a team as a code owner March 12, 2026 13:24
@hyperspace-insights
Copy link
Copy Markdown
Contributor

Control Panel

Hi, I'm an AI-powered Review Bot that helps you with summarizing and reviewing pull requests.
To interact with me, just use the following actions:

  • 📝 Summarize PR
  • 🔍 Agentic Review
  • 🗑️ Delete all bot comments and reviews

💌 Have ideas or want to contribute? Create an issue and share your thoughts with us!
📑 Check out the documentation for more information.
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

Made with ❤️ by Hyperspace.

@stekik stekik linked an issue Mar 12, 2026 that may be closed by this pull request
8 tasks
@stekik stekik added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 12, 2026
Comment thread config/rbac/cloud-manager_admin_role.yaml Outdated
Copy link
Copy Markdown
Contributor

@dushanpantic dushanpantic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have both resource groups (cloud-control, cloud-resources) in same manifest which is not a possible scenario.

@dushanpantic
Copy link
Copy Markdown
Contributor

Cloud manager aggregated roles should be installed to SKR when cloud-manager is enabled

@stekik
Copy link
Copy Markdown
Contributor Author

stekik commented Mar 13, 2026

Need clarification on:

  • Should these be Roles (namespace-scoped) instead?
  • Conditional deployment logic?

Copy link
Copy Markdown
Contributor

@tmilos77 tmilos77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not change kustomization.yaml files
Create just one admin role for group cloud-resources.kyma-project.io and * resoucrea and verbs
Note that work doesn't end here, that also has to be added to the module manifest, check with @ijovovic and the release procecure

@dushanpantic
Copy link
Copy Markdown
Contributor

cloud-control.kyma-project.io resources should not be part of these roles

@stekik
Copy link
Copy Markdown
Contributor Author

stekik commented Mar 23, 2026

@ijovovic The aggregated RBAC roles are now deployed to SKR via the installer (common directory pattern). Could you advise on the module manifest integration needed for the release procedure? cc @tmilos77

@stekik stekik requested a review from a team as a code owner March 27, 2026 10:45
@stekik stekik force-pushed the rbac-aggregation branch from 54520b0 to 8653caf Compare April 27, 2026 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/feature Categorizes issue or PR as related to a new feature.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement RBAC Aggregation for cloud-manager module

3 participants