[tenant] Allow listing workloads - #1576
Conversation
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
|
Caution Review failedThe pull request is closed. WalkthroughThe change adds Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Suggested reviewers
Poem
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello Andrei Kvapil (@kvaps), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the tenant component's operational capabilities by updating its RBAC configurations. The modification grants the necessary permissions to 'get', 'list', and 'watch' 'workloads' resources within the 'cozystack.io' API group, allowing the tenant application to effectively manage and observe workload objects. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Successfully created backport PR for |
There was a problem hiding this comment.
Code Review
This pull request correctly adds permissions for various tenant roles to list workloads from the cozystack.io API group. The changes are consistent across all roles. I have one suggestion regarding code duplication in the RBAC role definitions. Consolidating the repeated rule block into a Helm named template would improve the long-term maintainability of this configuration.
| - cozystack.io | ||
| resources: | ||
| - workloadmonitors | ||
| - workloads |
There was a problem hiding this comment.
While adding the workloads resource is correct, I've noticed that this block of RBAC rules for the cozystack.io apiGroup is duplicated across five different roles in this file (default, view, use, admin, and super-admin).
To improve maintainability and adhere to the Don't Repeat Yourself (DRY) principle, I recommend extracting this rule into a shared Helm named template. This would centralize the logic, making future updates to these permissions much simpler and less error-prone.
For example, you could define a template in a _helpers.tpl file or at the top of this file:
{{- define "tenant.cozystack.io.readonly.rules" -}}
- apiGroups:
- cozystack.io
resources:
- workloadmonitors
- workloads
verbs: ["get", "list", "watch"]
{{- end -}}And then include it in each role's rules section:
{{- include "tenant.cozystack.io.readonly.rules" . | nindent 2 }}# Description Backport of #1576 to `release-0.37`.
Signed-off-by: Andrei Kvapil kvapss@gmail.com
What this PR does
Release note
Summary by CodeRabbit