@@ -15,6 +15,11 @@ import (
1515 "sigs.k8s.io/controller-runtime/pkg/log"
1616)
1717
18+ const (
19+ authenticationAPIGroup = "authentication.k8s.io"
20+ verbCreate = "create"
21+ )
22+
1823// Deploy the feast authorization
1924func (authz * FeastAuthorization ) Deploy () error {
2025 if authz .isKubernetesAuth () {
@@ -152,32 +157,32 @@ func (authz *FeastAuthorization) setFeastClusterRole(clusterRole *rbacv1.Cluster
152157 {
153158 APIGroups : []string {rbacv1 .GroupName },
154159 Resources : []string {"rolebindings" },
155- Verbs : []string {"list" },
160+ Verbs : []string {verbList },
156161 },
157162 {
158- APIGroups : []string {"authentication.k8s.io" },
159- Resources : []string {"tokenreviews" },
160- Verbs : []string {"create" },
163+ APIGroups : []string {authenticationAPIGroup },
164+ Resources : []string {resourceTokenReviews },
165+ Verbs : []string {verbCreate },
161166 },
162167 {
163168 APIGroups : []string {rbacv1 .GroupName },
164169 Resources : []string {"subjectaccessreviews" },
165- Verbs : []string {"create" },
170+ Verbs : []string {verbCreate },
166171 },
167172 {
168173 APIGroups : []string {"" },
169174 Resources : []string {"namespaces" },
170- Verbs : []string {"get" , "list" , "watch" },
175+ Verbs : []string {verbGet , verbList , verbWatch },
171176 },
172177 {
173178 APIGroups : []string {rbacv1 .GroupName },
174179 Resources : []string {"clusterroles" },
175- Verbs : []string {"get" , "list" },
180+ Verbs : []string {verbGet , verbList },
176181 },
177182 {
178183 APIGroups : []string {rbacv1 .GroupName },
179184 Resources : []string {"clusterrolebindings" },
180- Verbs : []string {"get" , "list" },
185+ Verbs : []string {verbGet , verbList },
181186 },
182187 }
183188 // Don't set controller reference for shared ClusterRole
@@ -238,32 +243,32 @@ func (authz *FeastAuthorization) setFeastRole(role *rbacv1.Role) error {
238243 {
239244 APIGroups : []string {rbacv1 .GroupName },
240245 Resources : []string {"roles" , "rolebindings" },
241- Verbs : []string {"get" , "list" , "watch" },
246+ Verbs : []string {verbGet , verbList , verbWatch },
242247 },
243248 {
244- APIGroups : []string {"authentication.k8s.io" },
245- Resources : []string {"tokenreviews" },
246- Verbs : []string {"create" },
249+ APIGroups : []string {authenticationAPIGroup },
250+ Resources : []string {resourceTokenReviews },
251+ Verbs : []string {verbCreate },
247252 },
248253 {
249254 APIGroups : []string {rbacv1 .GroupName },
250255 Resources : []string {"subjectaccessreviews" },
251- Verbs : []string {"create" },
256+ Verbs : []string {verbCreate },
252257 },
253258 {
254259 APIGroups : []string {"" },
255260 Resources : []string {"namespaces" },
256- Verbs : []string {"get" , "list" , "watch" },
261+ Verbs : []string {verbGet , verbList , verbWatch },
257262 },
258263 {
259264 APIGroups : []string {rbacv1 .GroupName },
260265 Resources : []string {"clusterroles" },
261- Verbs : []string {"get" , "list" },
266+ Verbs : []string {verbGet , verbList },
262267 },
263268 {
264269 APIGroups : []string {rbacv1 .GroupName },
265270 Resources : []string {"clusterrolebindings" },
266- Verbs : []string {"get" , "list" },
271+ Verbs : []string {verbGet , verbList },
267272 },
268273 }
269274
@@ -347,9 +352,9 @@ func (authz *FeastAuthorization) createOidcClusterRole() error {
347352 clusterRole .Labels = authz .getSharedOidcClusterRoleLabels ()
348353 clusterRole .Rules = []rbacv1.PolicyRule {
349354 {
350- APIGroups : []string {"authentication.k8s.io" },
351- Resources : []string {"tokenreviews" },
352- Verbs : []string {"create" },
355+ APIGroups : []string {authenticationAPIGroup },
356+ Resources : []string {resourceTokenReviews },
357+ Verbs : []string {verbCreate },
353358 },
354359 }
355360 return nil
@@ -432,7 +437,7 @@ func (authz *FeastAuthorization) setFeastOidcAuthCondition(err error) error {
432437 if err != nil {
433438 logger := log .FromContext (authz .Handler .Context )
434439 cond := feastOidcAuthConditions [metav1 .ConditionFalse ]
435- cond .Message = "Error: " + err .Error ()
440+ cond .Message = services . ErrorMessagePrefix + err .Error ()
436441 apimeta .SetStatusCondition (& authz .Handler .FeatureStore .Status .Conditions , cond )
437442 logger .Error (err , "Error deploying the OIDC authorization" )
438443 return err
@@ -445,13 +450,12 @@ func (authz *FeastAuthorization) setFeastKubernetesAuthCondition(err error) erro
445450 if err != nil {
446451 logger := log .FromContext (authz .Handler .Context )
447452 cond := feastKubernetesAuthConditions [metav1 .ConditionFalse ]
448- cond .Message = "Error: " + err .Error ()
453+ cond .Message = services . ErrorMessagePrefix + err .Error ()
449454 apimeta .SetStatusCondition (& authz .Handler .FeatureStore .Status .Conditions , cond )
450455 logger .Error (err , "Error deploying the Kubernetes authorization" )
451456 return err
452- } else {
453- apimeta .SetStatusCondition (& authz .Handler .FeatureStore .Status .Conditions , feastKubernetesAuthConditions [metav1 .ConditionTrue ])
454457 }
458+ apimeta .SetStatusCondition (& authz .Handler .FeatureStore .Status .Conditions , feastKubernetesAuthConditions [metav1 .ConditionTrue ])
455459 return nil
456460}
457461
0 commit comments