fix: add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961)

JaydipGabani · ritazh · web-flow · commit 9469f18b84dc · 2025-06-12T06:57:11.000-07:00
Signed-off-by: Jaydip Gabani &lt;gabanijaydip@gmail.com&gt;
Co-authored-by: Rita Zhang &lt;rita.z.zhang@gmail.com&gt;
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
@@ -213,3 +213,60 @@ jobs:
         name: generatorexpansion-logs
         path: |
           logs-*.json
+
+  e2e_test_with_OwnerReferencesPermissionEnforcement_admission_plugin:
+    name: "[E2E] Test with OwnerReferencesPermissionEnforcement admission plugin"
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.24"
+          check-latest: true
+
+      - name: Bootstrap e2e
+        run: |
+          mkdir -p $GITHUB_WORKSPACE/bin
+          echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
+          make e2e-bootstrap KIND_CLUSTER_FILE=test/bats/tests/kindcluster.yml
+
+      - name: Run e2e
+        run: |
+          make docker-buildx \
+            IMG=gatekeeper-e2e:latest
+
+          make e2e-build-load-externaldata-image
+
+          kind load docker-image --name kind \
+            gatekeeper-e2e:latest
+
+          make deploy \
+            IMG=gatekeeper-e2e:latest \
+            USE_LOCAL_IMG=true \
+            GENERATE_VAP=true \
+            GENERATE_VAPBINDING=true
+
+          make test-e2e-owner-ref
+
+      - name: Save logs
+        if: ${{ always() }}
+        run: |
+          kubectl logs -n gatekeeper-system -l control-plane=controller-manager --tail=-1 > logs-controller.json
+          kubectl logs -n gatekeeper-system -l control-plane=audit-controller --tail=-1 > logs-audit.json
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: ${{ always() }}
+        with:
+          name: logs-${{ matrix.KUBERNETES_VERSION }}
+          path: |
+            logs-*.json
diff --git a/Makefile b/Makefile
@@ -25,7 +25,7 @@ GENERATE_VAPBINDING ?= false
 VERSION := v3.20.0-beta.0
 
 KIND_VERSION ?= 0.27.0
-KIND_CLUSTER_FILE ?= test/bats/tests/kindcluster.yml
+KIND_CLUSTER_FILE ?= ""
 # note: k8s version pinned since KIND image availability lags k8s releases
 KUBERNETES_VERSION ?= 1.30.0
 KUSTOMIZE_VERSION ?= 3.8.9
@@ -196,6 +196,9 @@ test: __test-image
 test-e2e:
 	bats -t ${BATS_TESTS_FILE}
 
+test-e2e-owner-ref:
+	@bash test/with-admission-plugin/test-e2e-owner-ref.sh
+
 .PHONY: test-gator
 test-gator: gator test-gator-verify test-gator-test test-gator-expand
 
@@ -234,8 +237,11 @@ e2e-bootstrap: e2e-dependencies
 	if [ $$(${GITHUB_WORKSPACE}/bin/kind get clusters) ]; then ${GITHUB_WORKSPACE}/bin/kind delete cluster; fi
 
 	# Create a new kind cluster
-	# Only enabling VAP beta apis for 1.28, 1.29
-	if [ $$(echo $(KUBERNETES_VERSION) | cut -d'.' -f2) -lt 28 ] || [ $$(echo $(KUBERNETES_VERSION) | cut -d'.' -f2) -gt 29 ]; then ${GITHUB_WORKSPACE}/bin/kind create cluster --image $(KIND_NODE_VERSION) --wait 5m; else ${GITHUB_WORKSPACE}/bin/kind create cluster --config $(KIND_CLUSTER_FILE) --image $(KIND_NODE_VERSION) --wait 5m; fi
+	if [ ! -f $(KIND_CLUSTER_FILE) ]; then \
+		${GITHUB_WORKSPACE}/bin/kind create cluster --image $(KIND_NODE_VERSION) --wait 5m; \
+	else \
+		${GITHUB_WORKSPACE}/bin/kind create cluster --config $(KIND_CLUSTER_FILE) --image $(KIND_NODE_VERSION) --wait 5m; \
+	fi
 
 e2e-build-load-image: docker-buildx e2e-build-load-externaldata-image
 	kind load docker-image --name kind ${IMG} ${CRD_IMG}
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -168,6 +168,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - templates.gatekeeper.sh
+  resources:
+  - constrainttemplates/finalizers
+  verbs:
+  - update
 - apiGroups:
   - templates.gatekeeper.sh
   resources:
diff --git a/manifest_staging/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml b/manifest_staging/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml
@@ -177,6 +177,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - templates.gatekeeper.sh
+  resources:
+  - constrainttemplates/finalizers
+  verbs:
+  - update
 - apiGroups:
   - templates.gatekeeper.sh
   resources:
diff --git a/manifest_staging/deploy/gatekeeper.yaml b/manifest_staging/deploy/gatekeeper.yaml
@@ -4967,6 +4967,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - templates.gatekeeper.sh
+  resources:
+  - constrainttemplates/finalizers
+  verbs:
+  - update
 - apiGroups:
   - templates.gatekeeper.sh
   resources:
diff --git a/pkg/controller/constrainttemplate/constrainttemplate_controller.go b/pkg/controller/constrainttemplate/constrainttemplate_controller.go
@@ -248,6 +248,8 @@ type ReconcileConstraintTemplate struct {
 // +kubebuilder:rbac:groups=templates.gatekeeper.sh,resources=constrainttemplates,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=templates.gatekeeper.sh,resources=constrainttemplates/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=externaldata.gatekeeper.sh,resources=providers,verbs=get;list;watch;create;update;patch;delete
+// update permission on finalizers is needed to access metadata.ownerReferences[x].blockOwnerDeletion for OwnerReferencesPermissionEnforcement admission plugin - https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement.
+// +kubebuilder:rbac:groups=templates.gatekeeper.sh,resources=constrainttemplates/finalizers,verbs=update
 
 // Reconcile reads that state of the cluster for a ConstraintTemplate object and makes changes based on the state read
 // and what is in the ConstraintTemplate.Spec.
diff --git a/test/bats/tests/kindcluster.yml b/test/bats/tests/kindcluster.yml
@@ -1,6 +1,8 @@
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
-featureGates:
-  ValidatingAdmissionPolicy: true
-runtimeConfig:
-  admissionregistration.k8s.io/v1beta1: true
+kubeadmConfigPatches:
+- |
+  kind: ClusterConfiguration
+  apiServer:
+    extraArgs:
+      enable-admission-plugins: NodeRestriction,OwnerReferencesPermissionEnforcement
diff --git a/test/with-admission-plugin/test-e2e-owner-ref.sh b/test/with-admission-plugin/test-e2e-owner-ref.sh
@@ -0,0 +1,30 @@
+kubectl apply -f - <<EOF
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: testownerref
+spec:
+  crd:
+    spec:
+      names:
+        kind: TestOwnerRef
+      validation:
+        openAPIV3Schema:
+          type: object
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package testownerref
+        violation[{"msg": "test"}] {
+          true
+        }
+EOF
+
+sleep 1
+
+err=$(kubectl get ConstraintTemplate testownerref -o jsonpath='{.status.byPod[].errors}')
+
+if [[ -n "$err" ]]; then
+  echo "ConstraintTemplate testownerref is in error state: $err"
+  exit 1
+fi
