Skip to content

add cluster role/rolebinding for iamroleselector on namespace scope#659

Open
michaelhtm wants to merge 1 commit intoaws-controllers-k8s:mainfrom
michaelhtm:addiamroleselectorclusterrole
Open

add cluster role/rolebinding for iamroleselector on namespace scope#659
michaelhtm wants to merge 1 commit intoaws-controllers-k8s:mainfrom
michaelhtm:addiamroleselectorclusterrole

Conversation

@michaelhtm
Copy link
Member

@michaelhtm michaelhtm commented Jan 26, 2026 •
edited
Loading

Issue #2755

Description of changes:
added changes:

  • Add IAMRoleSelector permissions to cache role if feature is enabled
  • When running with namespaced scope, ensure namespace cache role only has access
    to namespaces the controller is watching

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@ack-prow ack-prow bot requested review from jlbutler and knottnt January 26, 2026 21:56
@ack-prow
Copy link

ack-prow bot commented Jan 26, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: michaelhtm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ack-prow ack-prow bot added the approved label Jan 26, 2026
@michaelhtm
Copy link
Member Author

michaelhtm commented Jan 26, 2026

/retest

@michaelhtm michaelhtm force-pushed the addiamroleselectorclusterrole branch 5 times, most recently from d738669 to 6b0db9b Compare January 28, 2026 22:27
@knottnt
Copy link
Contributor

knottnt commented Jan 29, 2026

/retest

1 similar comment
@a-hilaly
Copy link
Member

a-hilaly commented Feb 4, 2026

/retest

a-hilaly
a-hilaly reviewed Feb 4, 2026
View reviewed changes
@michaelhtm
add cluster role/rolebinding for iamroleselector on namespace scope
62bc494 
IAMRoleSelector is a cluster scoped resource. When a controller is
configured as namespace scoped, this change adds a cluster
role/rolebinding that gives the controller access to iamroleselector and
namespaces.
@michaelhtm michaelhtm force-pushed the addiamroleselectorclusterrole branch from 6b0db9b to 62bc494 Compare February 4, 2026 21:59
@michaelhtm
Copy link
Member Author

michaelhtm commented Feb 6, 2026

/test ec2-controller-test
/test s3-controller-test

@ack-prow
Copy link

ack-prow bot commented Feb 6, 2026 •
edited
Loading

@michaelhtm: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
verify-attribution 62bc494 link false /test verify-attribution
s3-olm-test 62bc494 link false /test s3-olm-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@michaelhtm
Copy link
Member Author

michaelhtm commented Feb 6, 2026

/test ec2-controller-test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@a-hilaly a-hilaly a-hilaly left review comments

@jlbutler jlbutler Awaiting requested review from jlbutler

@knottnt knottnt Awaiting requested review from knottnt

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@michaelhtm @knottnt @a-hilaly