diff --git a/crates/stackable-operator/src/commons/rbac.rs b/crates/stackable-operator/src/commons/rbac.rs index 1b7ef2d85..b28dd2bee 100644 --- a/crates/stackable-operator/src/commons/rbac.rs +++ b/crates/stackable-operator/src/commons/rbac.rs @@ -30,12 +30,18 @@ pub enum Error { /// Build RBAC objects for the product workloads. /// The `rbac_prefix` is meant to be the product name, for example: zookeeper, airflow, etc. /// and it is a assumed that a ClusterRole named `{rbac_prefix}-clusterrole` exists. +/// 'rbac_prefix' is not used to build the names of the serviceAccount and roleBinding objects, +/// as this caused problems with multiple clusters of the same product within the same namespace +/// see for more details. +/// Instead the names for these objects are created by reading the name from the cluster object +/// and appending [-rolebinding|-serviceaccount] to create unique names instead of using the +/// same objects for multiple clusters. pub fn build_rbac_resources>( resource: &T, rbac_prefix: &str, labels: Labels, ) -> Result<(ServiceAccount, RoleBinding)> { - let sa_name = service_account_name(rbac_prefix); + let sa_name = service_account_name(&resource.name_any()); let service_account = ServiceAccount { metadata: ObjectMetaBuilder::new() .name_and_namespace(resource) @@ -52,7 +58,7 @@ pub fn build_rbac_resources>( let role_binding = RoleBinding { metadata: ObjectMetaBuilder::new() .name_and_namespace(resource) - .name(role_binding_name(rbac_prefix)) + .name(role_binding_name(&resource.name_any())) .ownerreference_from_resource(resource, None, Some(true)) .context(RoleBindingOwnerReferenceFromResourceSnafu { name: resource.name_any(), @@ -130,7 +136,7 @@ mod tests { build_rbac_resources(&cluster, RESOURCE_NAME, Labels::new()).unwrap(); assert_eq!( - Some(service_account_name(RESOURCE_NAME)), + Some(service_account_name(CLUSTER_NAME)), rbac_sa.metadata.name, "service account does not match" ); @@ -141,7 +147,7 @@ mod tests { ); assert_eq!( - Some(role_binding_name(RESOURCE_NAME)), + Some(role_binding_name(CLUSTER_NAME)), rbac_rolebinding.metadata.name, "rolebinding does not match" );