diff --git a/.chloggen/3380-ta-serviceaccount-check.yaml b/.chloggen/3380-ta-serviceaccount-check.yaml new file mode 100755 index 0000000000..4bcfc4e0df --- /dev/null +++ b/.chloggen/3380-ta-serviceaccount-check.yaml @@ -0,0 +1,16 @@ +# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' +change_type: bug_fix + +# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action) +component: target allocator + +# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). +note: "Permission check fixed for the serviceaccount of the target allocator" + +# One or more tracking issues related to the change +issues: [3380] + +# (Optional) One or more lines of additional information to render under the primary note. +# These lines will be padded with 2 spaces and then inserted directly into the document. +# Use pipe (|) for multiline entries. +subtext: diff --git a/apis/v1alpha1/targetallocator_webhook.go b/apis/v1alpha1/targetallocator_webhook.go index bed76f29a4..67a6ad5d43 100644 --- a/apis/v1alpha1/targetallocator_webhook.go +++ b/apis/v1alpha1/targetallocator_webhook.go @@ -119,7 +119,7 @@ func (w TargetAllocatorWebhook) validate(ctx context.Context, ta *TargetAllocato // if the prometheusCR is enabled, it needs a suite of permissions to function if ta.Spec.PrometheusCR.Enabled { - warnings, err := v1beta1.CheckTargetAllocatorPrometheusCRPolicyRules(ctx, w.reviewer, ta.Spec.ServiceAccount, ta.GetNamespace()) + warnings, err := v1beta1.CheckTargetAllocatorPrometheusCRPolicyRules(ctx, w.reviewer, ta.GetNamespace(), ta.Spec.ServiceAccount) if err != nil || len(warnings) > 0 { return warnings, err } diff --git a/apis/v1beta1/collector_webhook.go b/apis/v1beta1/collector_webhook.go index 68b572b8c1..7c66d388c5 100644 --- a/apis/v1beta1/collector_webhook.go +++ b/apis/v1beta1/collector_webhook.go @@ -29,6 +29,7 @@ import ( "github.com/open-telemetry/opentelemetry-operator/internal/config" "github.com/open-telemetry/opentelemetry-operator/internal/fips" ta "github.com/open-telemetry/opentelemetry-operator/internal/manifests/targetallocator/adapters" + "github.com/open-telemetry/opentelemetry-operator/internal/naming" "github.com/open-telemetry/opentelemetry-operator/internal/rbac" "github.com/open-telemetry/opentelemetry-operator/pkg/featuregate" ) @@ -341,8 +342,12 @@ func (c CollectorWebhook) validateTargetAllocatorConfig(ctx context.Context, r * } // if the prometheusCR is enabled, it needs a suite of permissions to function if r.Spec.TargetAllocator.PrometheusCR.Enabled { + saname := r.Spec.TargetAllocator.ServiceAccount + if len(r.Spec.TargetAllocator.ServiceAccount) == 0 { + saname = naming.TargetAllocatorServiceAccount(r.Name) + } warnings, err := CheckTargetAllocatorPrometheusCRPolicyRules( - ctx, c.reviewer, r.Spec.TargetAllocator.ServiceAccount, r.GetNamespace()) + ctx, c.reviewer, r.GetNamespace(), saname) if err != nil || len(warnings) > 0 { return warnings, err } diff --git a/apis/v1beta1/targetallocator_rbac.go b/apis/v1beta1/targetallocator_rbac.go index 4fb48832e6..2ef66b4541 100644 --- a/apis/v1beta1/targetallocator_rbac.go +++ b/apis/v1beta1/targetallocator_rbac.go @@ -61,8 +61,8 @@ func CheckTargetAllocatorPrometheusCRPolicyRules( serviceAccountName string) (warnings []string, err error) { subjectAccessReviews, err := reviewer.CheckPolicyRules( ctx, - namespace, serviceAccountName, + namespace, targetAllocatorCRPolicyRules..., ) if err != nil {