Support recovering from repository in different namespace #474
Conversation
Codecov Report
@@ Coverage Diff @@
## master #474 +/- ##
=====================================
Coverage 84% 84%
=====================================
Files 2 2
Lines 25 25
=====================================
Hits 21 21
Misses 2 2
Partials 2 2Continue to review full report at Codecov.
|
tamalsaha
changed the title
| cred = f.SecretForLocalBackend() | ||
| restic = f.ResticForHostPathLocalBackend() | ||
| recovery = f.RecoveryForRestic(restic) | ||
| recoveryNamespace = f.NewNamespace(rand.WithUniqSuffix("recovery")) |
There was a problem hiding this comment.
Where is this namespace created?
pkg/controller/rbac.go
Outdated
| @@ -231,7 +231,7 @@ func (c *StashController) ensureRecoveryRBAC(resource *core.ObjectReference) err | |||
| } | |||
|
|
|||
| // ensure role binding | |||
| _, _, err = rbac_util.CreateOrPatchRoleBinding(c.kubeClient, meta, func(in *rbac.RoleBinding) *rbac.RoleBinding { | |||
| _, _, err = rbac_util.CreateOrPatchClusterRoleBinding(c.kubeClient, meta, func(in *rbac.ClusterRoleBinding) *rbac.ClusterRoleBinding { | |||
There was a problem hiding this comment.
We don't need to use ClusterRoleBinding. This is what we should do, create a ClusterRole that gives read permission on any Repository object. Then create a RoleBinding in the namespace of the Repository object so that the recovery s/a can read it. This is how the EAS auth configmap is read.
There was a problem hiding this comment.
I added appscode:stash:repository-reader 085bd16
…operator mode for test
|
/lgtm |
cc: @farcaller