Skip to content

Draft: Feature: Namespace-restricted option#6425

Draft
frigaut-orange wants to merge 3 commits intocrossplane:mainfrom
orange-cloudfoundry:feature-namespace-restricted-option
Draft

Draft: Feature: Namespace-restricted option#6425
frigaut-orange wants to merge 3 commits intocrossplane:mainfrom
orange-cloudfoundry:feature-namespace-restricted-option

Conversation

@frigaut-orange
Copy link
Copy Markdown
Contributor

@frigaut-orange frigaut-orange commented May 2, 2025

Description of your changes

Add a --namespace-restricted option to the core crossplane command. This option :

  • Disables caching for resources outside of Crossplane's own namespace (to fix crashes)
  • Disable events for cluster-scoped resources (to fix error logs if crossplane does not have rights on the default namespace)
  • Disable RBAC manager pod (because it creates cluster-wide resources)
  • Disable webhooks
  • Give permissions to the core crosssplane pod only on resources in its own namespace
  • Give cluster-wide permissions to the core crosssplane pod only on its custom resources

Related docs PR : #6419

I have:

  • Read and followed Crossplane's [contribution process].
  • Run earthly +reviewable to ensure this PR is ready for review. (waiting for crossplane-runtime dependency : Add filter functions to event recorder crossplane-runtime#829)
  • Added or updated unit tests. (todo)
  • Added or updated e2e tests. (todo)
  • Linked a PR or a [docs tracking issue] to [document this change].
  • [ ] Added backport release-x.y labels to auto-backport this PR.
  • [ ] Followed the [API promotion workflow] if this PR introduces, removes, or promotes an API.

@frigaut-orange frigaut-orange requested review from a team, negz and turkenh as code owners May 2, 2025 09:04
@frigaut-orange frigaut-orange requested a review from phisco May 2, 2025 09:04
@frigaut-orange frigaut-orange changed the title Feature: Namespace-restricted option Draft: Feature: Namespace-restricted option May 2, 2025
@frigaut-orange frigaut-orange changed the title Draft: Feature: Namespace-restricted option Feature: Namespace-restricted option May 20, 2025
@frigaut-orange frigaut-orange force-pushed the feature-namespace-restricted-option branch from 882f1e5 to cfddc6b Compare May 20, 2025 12:51
This option adds a --namespace-restricted option to the core
crossplane controller, and has two consequences :

- Restrict resource caching only to crossplane's own namespace
  (fixes crasshes in case crossplane does not have enough
  permissions)
- Prevent events on cluster-wide resources

It also adapts the helm chart accordingly, adding a
namespaceRestricted variable in the values. This variable,
when set to true:

- Prevents the RBAC controller from being deployed
- Deploys minimalistic RBAC resources instead
- Prevents webhooks from being deployed
…r usages

Signed-off-by: François Rigaut <francois.rigaut@orange.com>
@frigaut-orange frigaut-orange force-pushed the feature-namespace-restricted-option branch from f170ec5 to 4742ac1 Compare May 27, 2025 08:55
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ClusterRoles would need to have unique names including the namespace itself, if you want to have multiple installations in parallel. Otherwise users would have to be careful and set a different name each time they install it.

fieldRef:
fieldPath: spec.serviceAccountName
{{- if .Values.webhooks.enabled }}
{{- if and (.Values.webhooks.enabled) (not .Values.namespaceRestricted) }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why disabling webhooks? they could just be configured to handle resources in a specific namespace

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am still not quite sure about whether webhooks should be disabled or not.

The idea is that Crossplane cannot deploy cluster-wide resources excepts its own CRDs, and that includes WebhookConfigurations. They should then be treated separately (i.e. not deployed within the helm chart).

However, what you are saying is right. Not deploying them within the helm chart or not can be managed separately (with the webhooks.enabled variable).

--> I can remove this particular change, and make so that webhooks are deployed by default anyway, and let the users decide the webhooks behavior separately. However, this would not be consistent with what I did for the RBAC manager pod.

Let me know what you think about this, as I am not quite sure about what the right approach is.

Signed-off-by: François Rigaut <francois.rigaut@orange.com>
@negz
Copy link
Copy Markdown
Member

negz commented Oct 9, 2025

@frigaut-orange Is this still relevant, or is it superseded by your more focused/smaller PRs?

@frigaut-orange frigaut-orange changed the title Feature: Namespace-restricted option Draft: Feature: Namespace-restricted option Oct 29, 2025
@frigaut-orange
Copy link
Copy Markdown
Contributor Author

@negz Again sorry for the delay

This PR is still relevant, although out-of-date, especially with #6732

The idea is to have an argument in the helm chart, which brings all of the following features at once, according the the one-pager:

TL;DR the changes to the helm chart are relevant, the changes to the code are out of date

I can clean up this PR but I would rather waiat for all the subsequent PRs to be merged beforehand. In the meantime, I set this PR to Draft.

@github-actions
Copy link
Copy Markdown

Crossplane does not currently have enough maintainers to address every issue and pull request. This pull request has been automatically marked as stale because it has had no activity in the last 90 days. It will be closed in 14 days if no further activity occurs. Adding a comment starting with /fresh will mark this PR as not stale.

@github-actions github-actions bot added the stale label Jan 28, 2026
@frigaut-orange
Copy link
Copy Markdown
Contributor Author

/fresh

Copy link
Copy Markdown
Member

@jbw976 jbw976 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that #6732 (review) is merged, can you please cleanly lay out the next steps for continuing with this broader namespace restriction effort @frigaut-orange? Thanks for your continued work here 🙇‍♂️

@jbw976
Copy link
Copy Markdown
Member

jbw976 commented Jan 28, 2026

In the meantime, I set this PR to Draft

I think this is supposed to be draft but it's not, so I'm setting it to draft now 😇

@jbw976 jbw976 marked this pull request as draft January 28, 2026 18:54
@jbw976
Copy link
Copy Markdown
Member

jbw976 commented Jan 28, 2026

Also, should #6348 be re-opened to track the continued effort of this PR?

Having a clear list of tasks / remaining work in the body of that issue (if it should be re-opened) or the body of this PR will help keep track of what's left, that helps me at least get oriented when I come back here later 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants