Merge pull request #719 from fluxcd/ssa-skip-clusterrole-normalization

ssa: Skip normalization of Roles and ClusterRoles

ssa/normalize/normalize.go

@@ -88,6 +88,13 @@ func UnstructuredList(objects []*unstructured.Unstructured) error {
 // certain standard fields are removed.
 func UnstructuredListWithScheme(objects []*unstructured.Unstructured, scheme *runtime.Scheme) error {
 	for _, o := range objects {
+		// Skip Role and ClusterRole objects to avoid resetting the rules due to upstream serialization bug.
+		// xref:https://github.com/fluxcd/kustomize-controller/issues/1041
+		if o.GetAPIVersion() == "rbac.authorization.k8s.io/v1" &&
+			(o.GetKind() == "Role" || o.GetKind() == "ClusterRole") {
+			continue
+		}
+
 		if err := UnstructuredWithScheme(o, scheme); err != nil {
 			return fmt.Errorf("%s normalization error: %w", utils.FmtUnstructured(o), err)
 		}

ssa/normalize/normalize_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -35,6 +36,27 @@ func TestFromUnstructured(t *testing.T) {
 		want    metav1.Object
 		wantErr bool
 	}{
+		{
+			name: "no rules ClusterRole",
+			object: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "rbac.authorization.k8s.io/v1",
+					"kind":       "ClusterRole",
+					"metadata": map[string]interface{}{
+						"name": "test-clusterrole",
+					},
+				},
+			},
+			want: &rbacv1.ClusterRole{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "rbac.authorization.k8s.io/v1",
+					Kind:       "ClusterRole",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "test-clusterrole",
+				},
+			},
+		},
 		{
 			name: "valid Pod",
 			object: &unstructured.Unstructured{