From e13ac0c0fd9d3ac0f92ac1aed8e534ea4c02f69a Mon Sep 17 00:00:00 2001 From: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Date: Thu, 18 Jun 2026 10:27:04 -0400 Subject: [PATCH 1/2] Add activation_job_namespace field for workload isolation When set, activation job pods run in a dedicated namespace with their own RBAC, reducing the permissions granted in the EDA control plane namespace. Follows the same pattern as awx-operator PR #2122. Co-Authored-By: Claude Opus 4.6 (1M context) --- config/crd/bases/eda.ansible.com_edas.yaml | 3 + config/rbac/role.yaml | 7 +++ .../common/templates/service_account.yaml.j2 | 57 ++++++++++++++++++- roles/eda/defaults/main.yml | 2 + .../eda-activation-worker.deployment.yaml.j2 | 4 ++ 5 files changed, 70 insertions(+), 3 deletions(-) diff --git a/config/crd/bases/eda.ansible.com_edas.yaml b/config/crd/bases/eda.ansible.com_edas.yaml index 6acb3792..576a62f6 100644 --- a/config/crd/bases/eda.ansible.com_edas.yaml +++ b/config/crd/bases/eda.ansible.com_edas.yaml @@ -1476,6 +1476,9 @@ spec: type: object type: array type: object + activation_job_namespace: + description: Namespace where activation job pods will run. Creates the namespace and grants required permissions automatically. + type: string activation_worker: description: Defines desired state of eda-activation-worker resources properties: diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 93ecaf59..067689a5 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -4,6 +4,13 @@ kind: Role metadata: name: eda-manager-role rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - create ## ## Base operator rules ## diff --git a/roles/common/templates/service_account.yaml.j2 b/roles/common/templates/service_account.yaml.j2 index cad40fd6..d1d83d1d 100644 --- a/roles/common/templates/service_account.yaml.j2 +++ b/roles/common/templates/service_account.yaml.j2 @@ -19,15 +19,18 @@ metadata: labels: {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }} rules: -- apiGroups: [""] # "" indicates the core API group +{% if not activation_job_namespace %} +- apiGroups: [""] resources: ["pods", "pods/log", "jobs", "secrets", "services"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: ["batch", "extensions"] resources: ["jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] -- apiGroups: ["networking.k8s.io"] - resources: ["ingresses"] +{% else %} +- apiGroups: ["batch", "extensions"] + resources: ["jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +{% endif %} --- kind: RoleBinding @@ -44,3 +47,51 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: '{{ ansible_operator_meta.name }}' + +{% if activation_job_namespace %} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: '{{ activation_job_namespace }}' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: '{{ ansible_operator_meta.name }}-job-execution' + namespace: '{{ activation_job_namespace }}' + labels: + {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }} +rules: +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +- apiGroups: [""] + resources: ["pods/log"] + verbs: ["get"] +- apiGroups: ["batch", "extensions"] + resources: ["jobs"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "create", "delete"] +- apiGroups: [""] + resources: ["services"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: '{{ ansible_operator_meta.name }}-job-execution' + namespace: '{{ activation_job_namespace }}' + labels: + {{ lookup("template", "../common/templates/labels/common.yaml.j2") | indent(width=4) | trim }} +subjects: +- kind: ServiceAccount + name: '{{ ansible_operator_meta.name }}' + namespace: '{{ ansible_operator_meta.namespace }}' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: '{{ ansible_operator_meta.name }}-job-execution' +{% endif %} diff --git a/roles/eda/defaults/main.yml b/roles/eda/defaults/main.yml index ac15f427..081cc546 100644 --- a/roles/eda/defaults/main.yml +++ b/roles/eda/defaults/main.yml @@ -26,6 +26,8 @@ _image_web_version: "{{ lookup('env', 'DEFAULT_EDA_UI_VERSION') or 'main' }}" # kubernetes.io/arch: amd64 # kubernetes.io/os: linux +activation_job_namespace: '' + websocket_ssl_verify: false api: {} diff --git a/roles/eda/templates/eda-activation-worker.deployment.yaml.j2 b/roles/eda/templates/eda-activation-worker.deployment.yaml.j2 index ed71fad7..c4df3099 100644 --- a/roles/eda/templates/eda-activation-worker.deployment.yaml.j2 +++ b/roles/eda/templates/eda-activation-worker.deployment.yaml.j2 @@ -251,6 +251,10 @@ spec: - name: EDA_EVENT_PERSISTENCE_PGSSLMODE value: '{{ event_persistence_postgres_sslmode }}' {% endif %} +{% if activation_job_namespace %} + - name: EDA_ACTIVATION_JOB_NAMESPACE + value: '{{ activation_job_namespace }}' +{% endif %} {% if combined_activation_worker.resource_requirements is defined %} resources: {{ combined_activation_worker.resource_requirements }} {% endif %} From bb077fa9b7a9aaa51f11a8c2532b56043e0ade52 Mon Sep 17 00:00:00 2001 From: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Date: Thu, 18 Jun 2026 11:39:27 -0400 Subject: [PATCH 2/2] Fix service account RBAC for backward compatibility Remove batch/extensions jobs from EDA namespace Role when activation_job_namespace is set, and restore the ingress rule for the unset case to keep the Role identical to the original. Co-Authored-By: Claude Opus 4.6 (1M context) --- roles/common/templates/service_account.yaml.j2 | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/roles/common/templates/service_account.yaml.j2 b/roles/common/templates/service_account.yaml.j2 index d1d83d1d..b91e78e2 100644 --- a/roles/common/templates/service_account.yaml.j2 +++ b/roles/common/templates/service_account.yaml.j2 @@ -26,9 +26,8 @@ rules: - apiGroups: ["batch", "extensions"] resources: ["jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] -{% else %} -- apiGroups: ["batch", "extensions"] - resources: ["jobs"] +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] {% endif %}