✨ Check known required permissions for install before installing with the helm applier

[bentito]

Description

This is a successor PR to #1716 and is primarily the contributions of @trgeiger and @joelanford .

Goal and title, remain the same. Approach is a bit modified:

Pulls in RBAC authorization code from k8s.is/kubernetes, uses that code to check GET and other verb permissions as prelude to and as response from a Helm dry-run

To pull in the RBAC auth code concisely, repeatably and with warnings if the used code changes, we add a maintenance utility that adds the needed replace directives for all related staging modules (e.g., k8s.io/api, k8s.io/apimachinery, etc.) and they are automatically pinned to the corresponding published version.

All this code is initially called at

missingRules, err := h.PreAuthorizer.PreAuthorize(ctx, &ceServiceAccount, strings.NewReader(tmplRel.Manifest))

in internal/operator-controller/applier/helm.go

Reviewer Checklist

• API Go Documentation
• Tests: Unit Tests (and E2E Tests, if appropriate)
• Comprehensive Commit Messages
• Links to related GitHub Issue(s)

[netlify]

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	8200b97
🔍 Latest deploy log	https://app.netlify.com/sites/olmv1/deploys/67fe95140ad6f70008b8b5b9
😎 Deploy Preview	https://deploy-preview-1858--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[codecov]

Codecov Report

Attention: Patch coverage is 44.06176% with 471 lines in your changes missing coverage. Please review.

Project coverage is 65.98%. Comparing base (2f22dcf) to head (8200b97).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
hack/tools/k8smaintainer/main.go	0.00%	287 Missing ⚠️
internal/operator-controller/authorization/rbac.go	68.45%	119 Missing and 22 partials ⚠️
internal/operator-controller/applier/helm.go	49.36%	35 Missing and 5 partials ⚠️
cmd/operator-controller/main.go	80.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1858      +/-   ##
==========================================
- Coverage   69.53%   65.98%   -3.56%     
==========================================
  Files          68       70       +2     
  Lines        5350     6182     +832     
==========================================
+ Hits         3720     4079     +359     
- Misses       1398     1843     +445     
- Partials      232      260      +28     

Flag	Coverage Δ
e2e	45.16% <5.58%> (-5.41%)	⬇️
unit	55.16% <40.97%> (-2.38%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[trgeiger]

I added some tests but they still need to be tweaked/finalized. I noticed while writing them up that due to the order of the logic where missing rules are checked before escalation, if bind/escalate are in play but we're missing the explicit permissions that bind/escalate would give us we end up with a result where there's no error but we do have missing rules. @joelanford is that what we would want? I would think if we can bind or escalate that we would not return that we're missing those rules since the SA can grant them.

EDIT: This isn't a concern, I misunderstood the permissions logic here

[joelanford]

I might be missing it, but I didn't see any unit tests for what happens when PreAuthorize returns missing rules and/or an error.

That feels like a gap that should be covered.

[trgeiger]

We have tests for that in rbac_test.go, is that fine?

[trgeiger]

I added one for when there's an error, there are tests in rbac_test.go for returning missing rules, do we need to have an additional one in the applier tests here?

[joelanford]

I know you've got the applier-level tests implemented now, so just an informational answer to your question:

We have tests for that in rbac_test.go, is that fine?

Those are good, but they don't cover how the Helm Applier handles various return values from PreAuthorize. By adding tests in the helm applier, we're not testing our specific RBAC PreAuthorizer functionality. We are testing how our helm applier handles preauthorization.

We need tests at both levels.

[joelanford]

Is there something novel about this test that isn't covered in the non-preflight variant of this test. It seems like this test case is about "how does helm applier handle a failed installation?", which is the same in both cases.

[joelanford]

It seems like this test case should be "fails because of a pre-auth failure"

[trgeiger]

I changed the test to be when there's an error returned by preauth