use rolebinding namespace for built-in role (#42)

* use rolebinding namespace for built-in role

Signed-off-by: Pulak Kanti Bhowmick <[email protected]>

* fix unit tests

Signed-off-by: Pulak Kanti Bhowmick <[email protected]>

---------

Signed-off-by: Pulak Kanti Bhowmick <[email protected]>

Author: pkbhowmick

internal/controller/argocdrolebinding_controller.go

@@ -154,9 +154,9 @@ func (r *ArgoCDRoleBindingReconciler) Reconcile(ctx context.Context, req ctrl.Re
 
 	switch roleName {
 	case "admin":
-		role = r.createBuiltInAdminRole()
+		role = r.createBuiltInAdminRole(rb.Namespace)
 	case "readonly":
-		role = r.createBuiltInReadOnlyRole()
+		role = r.createBuiltInReadOnlyRole(rb.Namespace)
 	}
 
 	r.Log.Info("Reconciling RBAC ConfigMap")

internal/controller/argocdrolebinding_controller_test.go

@@ -333,7 +333,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileBuiltInAdmin(t *testing.T) {
 	cm := &corev1.ConfigMap{}
 	err = reconciler.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
 	assert.NoError(t, err)
-	resCM := makeTestCM_BuiltInAdmin_WithRoleBinding_Expected()
+	resCM := makeTestCM_BuiltInAdmin_WithRoleBinding_Expected(argocdRoleBinding.Namespace)
 	assert.Equal(t, resCM.Data, cm.Data)
 }
 
@@ -367,7 +367,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileBuiltInReadOnly(t *testing.T) {
 	cm := &corev1.ConfigMap{}
 	err = reconciler.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
 	assert.NoError(t, err)
-	resCM := makeTestCM_BuiltInReadOnly_WithRoleBinding_Expected()
+	resCM := makeTestCM_BuiltInReadOnly_WithRoleBinding_Expected(argocdRoleBinding.Namespace)
 	assert.Equal(t, resCM.Data, cm.Data)
 }
 

internal/controller/configmap.go

@@ -205,11 +205,11 @@ func FetchObject(client client.Client, namespace string, name string, obj client
 }
 
 // createBuiltInAdminRole will return a new built-in ArgoCDRole with admin permissions.
-func (r *ArgoCDRoleBindingReconciler) createBuiltInAdminRole() *rbacoperatorv1alpha1.ArgoCDRole {
+func (r *ArgoCDRoleBindingReconciler) createBuiltInAdminRole(rbNamespace string) *rbacoperatorv1alpha1.ArgoCDRole {
 	return &rbacoperatorv1alpha1.ArgoCDRole{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      common.ArgoCDRoleAdmin,
-			Namespace: r.ArgoCDRBACConfigMapNamespace,
+			Namespace: rbNamespace,
 		},
 		Spec: rbacoperatorv1alpha1.ArgoCDRoleSpec{
 			Rules: []rbacoperatorv1alpha1.GlobalRule{
@@ -269,11 +269,11 @@ func (r *ArgoCDRoleBindingReconciler) createBuiltInAdminRole() *rbacoperatorv1al
 }
 
 // createBuiltInReadOnlyRole will return a new built-in ArgoCDRole with read-only permissions.
-func (r *ArgoCDRoleBindingReconciler) createBuiltInReadOnlyRole() *rbacoperatorv1alpha1.ArgoCDRole {
+func (r *ArgoCDRoleBindingReconciler) createBuiltInReadOnlyRole(rbNamespace string) *rbacoperatorv1alpha1.ArgoCDRole {
 	return &rbacoperatorv1alpha1.ArgoCDRole{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      common.ArgoCDRoleReadOnly,
-			Namespace: r.ArgoCDRBACConfigMapNamespace,
+			Namespace: rbNamespace,
 		},
 		Spec: rbacoperatorv1alpha1.ArgoCDRoleSpec{
 			Rules: []rbacoperatorv1alpha1.GlobalRule{

internal/controller/testing.go

@@ -344,29 +344,29 @@ func makeTestCM_ArgoCDRole_WithRoleBindingLocalSubject_Expected() *corev1.Config
 	return cm
 }
 
-func makeTestCM_BuiltInAdmin_WithRoleBinding_Expected() *corev1.ConfigMap {
+func makeTestCM_BuiltInAdmin_WithRoleBinding_Expected(rbNamespace string) *corev1.ConfigMap {
 	cm := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      testRBACCMName,
 			Namespace: testRBACCMNamespace,
 		},
 		Data: map[string]string{
 			"policy.csv": "",
-			fmt.Sprintf("policy.%s.%s.csv", testRBACCMNamespace, common.ArgoCDRoleAdmin): fmt.Sprintf("g, role:rb-role-test, role:%s\n", common.ArgoCDRoleAdmin),
+			fmt.Sprintf("policy.%s.%s.csv", rbNamespace, common.ArgoCDRoleAdmin): fmt.Sprintf("g, role:rb-role-test, role:%s\n", common.ArgoCDRoleAdmin),
 		},
 	}
 	return cm
 }
 
-func makeTestCM_BuiltInReadOnly_WithRoleBinding_Expected() *corev1.ConfigMap {
+func makeTestCM_BuiltInReadOnly_WithRoleBinding_Expected(rbNamespace string) *corev1.ConfigMap {
 	cm := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      testRBACCMName,
 			Namespace: testRBACCMNamespace,
 		},
 		Data: map[string]string{
 			"policy.csv": "",
-			fmt.Sprintf("policy.%s.%s.csv", testRBACCMNamespace, common.ArgoCDRoleReadOnly): fmt.Sprintf("g, role:rb-role-test, role:%s\n", common.ArgoCDRoleReadOnly),
+			fmt.Sprintf("policy.%s.%s.csv", rbNamespace, common.ArgoCDRoleReadOnly): fmt.Sprintf("g, role:rb-role-test, role:%s\n", common.ArgoCDRoleReadOnly),
 		},
 	}
 	return cm