Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(argo-rollouts): Restrict write access to rollout status in the aggregated roles #2536

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

nedal87
Copy link

@nedal87 nedal87 commented Feb 21, 2024

The status subresource is typically managed automatically by the controller managing the resource, in this case, the Argo Rollouts controller. Allowing users to directly manipulate the status subresource could lead to inconsistencies and unintended behavior, as the controller might overwrite or ignore manually set status updates.

Therefore, it's generally a good practice to restrict permissions to modify the status subresource to the controller or system components responsible for managing the resource, rather than granting such permissions to users directly. This helps ensure the integrity and consistency of the resource's state.
After this change, users will be still able to view the rollout status.

Current setup: argo-rollouts:edit

Checklist:

  • I have bumped the chart version according to versioning
  • I have updated the documentation according to documentation
  • I have updated the chart changelog with all the changes that come with this pull request according to changelog.
  • Any new values are backwards compatible and/or have sensible default.
  • I have signed off all my commits as required by DCO.
  • My build is green (troubleshooting builds).

@nedal87 nedal87 force-pushed the feat/neskaif/restrict-rollout-status-write-access branch from 503d009 to 920204e Compare February 21, 2024 13:35
@@ -37,7 +37,6 @@ rules:
resources:
- rollouts
- rollouts/scale
- rollouts/status
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your PR.
Since upstream has the permission in latest version, so can you please fix upstream at first ?
*argo-helm follows upstream's manifest.
https://github.com/argoproj/argo-rollouts/blob/v1.6.6/manifests/base/argo-rollouts-aggregate-roles.yaml

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @yu-croco sure thing, I will open a PR in upstream. Thanks!

@yu-croco yu-croco added the awaiting-upstream Is waiting for a change upstream to be completed before it can be merged. label Feb 24, 2024
Copy link

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@github-actions github-actions bot closed this May 5, 2024
@yu-croco yu-croco added the on-hold Issues or Pull Requests with this label will never be considered stale label May 5, 2024
@yu-croco yu-croco reopened this May 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
argo-rollouts awaiting-upstream Is waiting for a change upstream to be completed before it can be merged. no-pr-activity on-hold Issues or Pull Requests with this label will never be considered stale size/XS
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants