charts/gateway-operator/scripts/update-rbac-resources.sh doesn't take KGO EE policy rules into account.

[pmalek]

Problem statement

charts/gateway-operator/scripts/update-rbac-resources.sh is used to update the RBAC resources in gateway-operator chart.

It does not take KGO EE RBAC rules into account hence running this on the current version of KGO repo yields a diff which would remove permissions:

diff --git a/charts/gateway-operator/templates/rbac-resources.yaml b/charts/gateway-operator/templates/rbac-resources.yaml
index 0f4af6b..647798a 100644
--- a/charts/gateway-operator/templates/rbac-resources.yaml
+++ b/charts/gateway-operator/templates/rbac-resources.yaml
@@ -126,18 +126,6 @@ rules:
   - create
   - delete
   - get
-- apiGroups:
-  - cert-manager.io
-  resources:
-  - certificates
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - configuration.konghq.com
   resources:
@@ -488,14 +476,6 @@ rules:
   - get
   - patch
   - update
-- apiGroups:
-  - gateway-operator.konghq.com
-  resources:
-  - dataplanemetricsextensions
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - gateway-operator.konghq.com
   resources:

Proposed solution

• update the comment

  charts/charts/gateway-operator/scripts/update-rbac-resources.sh

  Lines 1 to 17 in 468ea40

  	#!/usr/bin/env bash
  	# ------------------------------------------------------------------------------
  	#
  	# cd kong/gateway-operator/config
  	# kustomize build rbac > /tmp/rbac-resources.yaml
  	# sed -i 's/namespace: kong-system/namespace: {{ template "kong.namespace" . }}/g' /tmp/rbac-resources.yaml
  	# sed -i 's/name: controller-manager$/name: {{ template "kong.serviceAccountName" . }}/g' /tmp/rbac-resources.yaml
  	# sed -i 's/name: gateway-operator-manager-role/name: {{ template "kong.fullname" . }}-manager-role/g' /tmp/rbac-resources.yaml
  	# sed -i 's/name: controller-manager-metrics-service/name: {{ template "kong.fullname" . }}-metrics-service/g' /tmp/rbac-resources.yaml
  	# Then copy the contents of this file except for the Service Account resource using the following command
  	# (head -n 11 PATH_OF_YOUR_CHARTS_REPO/charts/gateway-operator/templates/rbac-resources.yaml && tail -n +6 /tmp/rbac-resources.yaml) > /tmp/new-rbac-resources.yaml
  	# mv /tmp/new-rbac-resources.yaml YOUR-PATH-OF-CHARTS/charts/gateway-operator/templates/rbac-resources.yaml
  	# ------------------------------------------------------------------------------
  	# this script will receive two arguments:
  	# $1: the path to the kgo repository
  	# $2: the path to the kong/charts repository

  and

  charts/charts/gateway-operator/templates/rbac-resources.yaml

  Lines 1 to 4 in 0e8c4b5

  	# Generated by the following steps:
  	# ./charts/gateway-operator/scripts/update-rbac-resources.sh KGO_REPO_PATH CHARTS_REPO_PATH
  	# e.g.:
  	# ./charts/gateway-operator/scripts/update-rbac-resources.sh ~/go/src/github.com/kong/gateway-operator ~/go/src/github.com/kong/charts

  to indicate how to generate RBAC resources with KGO EE policy rules
• add proper tests to account for that and ensure on CI that these generated manifests are always up to date.