Use list with an empty string by default in generated Role/ClusterRole

Fix #32519
quarkusio · Apr 11, 2023 · 34dd1cb · 34dd1cb
1 parent cbdf77b
commit 34dd1cb
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/...lla/deployment/src/main/java/io/quarkus/kubernetes/deployment/KubernetesCommonHelper.java b/...lla/deployment/src/main/java/io/quarkus/kubernetes/deployment/KubernetesCommonHelper.java
@@ -104,6 +104,7 @@ public class KubernetesCommonHelper {
     private static final String[] PROMETHEUS_ANNOTATION_TARGETS = { "Service",
             "Deployment", "DeploymentConfig" };
     private static final String DEFAULT_ROLE_NAME_VIEW = "view";
+    private static final List<String> LIST_WITH_EMPTY = List.of("");
 
     public static Optional<Project> createProject(ApplicationInfoBuildItem app,
             Optional<CustomProjectRootBuildItem> customProjectRoot, OutputTargetBuildItem outputTarget,
@@ -1011,7 +1012,7 @@ private static List<PolicyRule> toPolicyRulesList(Map<String, PolicyRuleConfig>
         return policyRules.values()
                 .stream()
                 .map(it -> new PolicyRuleBuilder()
-                        .withApiGroups(it.apiGroups.orElse(null))
+                        .withApiGroups(it.apiGroups.orElse(LIST_WITH_EMPTY))
                         .withNonResourceURLs(it.nonResourceUrls.orElse(null))
                         .withResourceNames(it.resourceNames.orElse(null))
                         .withResources(it.resources.orElse(null))

diff --git a/...arkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java b/...arkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java
@@ -61,6 +61,7 @@ public void assertGeneratedResources() throws IOException {
         Role podWriterRole = getRoleByName(kubernetesList, "pod-writer");
         assertEquals(APP_NAMESPACE, podWriterRole.getMetadata().getNamespace());
         assertThat(podWriterRole.getRules()).satisfiesOnlyOnce(r -> {
+            assertThat(r.getApiGroups()).containsExactly("");
             assertThat(r.getResources()).containsExactly("pods");
             assertThat(r.getVerbs()).containsExactly("update");
         });
@@ -69,13 +70,15 @@ public void assertGeneratedResources() throws IOException {
         Role podReaderRole = getRoleByName(kubernetesList, "pod-reader");
         assertEquals("projectb", podReaderRole.getMetadata().getNamespace());
         assertThat(podReaderRole.getRules()).satisfiesOnlyOnce(r -> {
+            assertThat(r.getApiGroups()).containsExactly("");
             assertThat(r.getResources()).containsExactly("pods");
             assertThat(r.getVerbs()).containsExactly("get", "watch", "list");
         });
 
         // secret-reader assertions
         ClusterRole secretReaderRole = getClusterRoleByName(kubernetesList, "secret-reader");
         assertThat(secretReaderRole.getRules()).satisfiesOnlyOnce(r -> {
+            assertThat(r.getApiGroups()).containsExactly("");
             assertThat(r.getResources()).containsExactly("secrets");
             assertThat(r.getVerbs()).containsExactly("get", "watch", "list");
         });