* Merge pull request #316 from thatmidwesterncoder/toleration_validation (#459)
Add validation to Toleration and Affinitys Keys
* Bump to k8s 1.31
* Bump the maximum supported k8s version to 1.31
* Bump other k8s modules to be consistent with k8s 1.31
* Bump to versions of lasso and wrangler that support k8s 1.31
* Move go the go-uber gomock module.
* Update the wrangler module.
* Correct the mockgen install command.
* And re-correct the 'go install ... mockgen' command.
---------
Co-authored-by: Jacob Lindgren <jacob.lindgren@suse.com>
* Verify ExternalRules in RoleTemplates
If the feature flag external-rules is enabled, the validation for RT follows this sequence:
- 1) Reject if externalRules are provided and the user doesn’t have escalate permissions on RoleTemplates.
- 2) Validate the policy rules defined in externalRules the same way as the already existing rules field. This validation leverages Kubernetes’ upstream validation. Webhook will validate this only if external is set to true.
- 3) Use externalRules for resolving rules if provided.
- 4) Use backing ClusterRole in the local cluster if externalRules are not provided.
- 5) Reject if externalRules are not provided and there is no backing ClusterRole in the local cluster.
For PRTB or CRTB:
- 1) Use externalRules for resolving rules if provided.
- 2) Use backing ClusterRole in the local cluster if externalRules are not provided.
The previous verification process applies if the external-rules feature flag is disabled.
* Allow Restricted Admin to update external-rules feature flag (#102)
---------
Co-authored-by: Raul Cabello Martin <raulcabm@gmail.com>
Co-authored-by: Jonathan Crowther <jonathan.crowther@suse.com>
* bump rancher to be able to use ExternalRules
* fix test conflict
---------
Co-authored-by: Peter Matseykanets <peter.matseykanets@suse.com>
When 2 role templates inherit from each other, this can cause
performance issues or an outright crash. This change aims to
ensure that role templates can't form circular references like
this in the future.
Vatsal Parekh