Regularize kubebuilder RBAC annotations (CrunchyData#3586)

Author: benjaminjb

internal/controller/postgrescluster/cluster.go

@@ -32,7 +32,7 @@ import (
 	"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
 )
 
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="configmaps",verbs={create,patch}
 
 // reconcileClusterConfigMap writes the ConfigMap that contains generated
 // files (etc) that apply to the entire cluster.
@@ -62,7 +62,7 @@ func (r *Reconciler) reconcileClusterConfigMap(
 	return clusterConfigMap, err
 }
 
-// +kubebuilder:rbac:groups="",resources=services,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="services",verbs={create,patch}
 
 // reconcileClusterPodService writes the Service that can provide stable DNS
 // names to Pods related to cluster.

internal/controller/postgrescluster/controller.go

@@ -71,9 +71,9 @@ type Reconciler struct {
 	) error
 }
 
-// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
-// +kubebuilder:rbac:groups=postgres-operator.crunchydata.com,resources=postgresclusters,verbs=get;list;watch
-// +kubebuilder:rbac:groups=postgres-operator.crunchydata.com,resources=postgresclusters/status,verbs=patch
+// +kubebuilder:rbac:groups="",resources="events",verbs={create,patch}
+// +kubebuilder:rbac:groups="postgres-operator.crunchydata.com",resources="postgresclusters",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="postgres-operator.crunchydata.com",resources="postgresclusters/status",verbs={patch}
 
 // Reconcile reconciles a ConfigMap in a namespace managed by the PostgreSQL Operator
 func (r *Reconciler) Reconcile(
@@ -387,7 +387,7 @@ func (r *Reconciler) patch(
 // creator of such a reference have either "delete" permission on the owner or
 // "update" permission on the owner's "finalizers" subresource.
 // - https://docs.k8s.io/reference/access-authn-authz/admission-controllers/
-// +kubebuilder:rbac:groups=postgres-operator.crunchydata.com,resources=postgresclusters/finalizers,verbs=update
+// +kubebuilder:rbac:groups="postgres-operator.crunchydata.com",resources="postgresclusters/finalizers",verbs={update}
 
 // setControllerReference sets owner as a Controller OwnerReference on controlled.
 // Only one OwnerReference can be a controller, so it returns an error if another
@@ -406,19 +406,19 @@ func (r *Reconciler) setOwnerReference(
 	return controllerutil.SetOwnerReference(owner, controlled, r.Client.Scheme())
 }
 
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
-// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=get;list;watch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=get;list;watch
-// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch
-// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources="configmaps",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="",resources="endpoints",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="",resources="secrets",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="",resources="services",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="",resources="serviceaccounts",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="apps",resources="deployments",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="roles",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="rolebindings",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="batch",resources="cronjobs",verbs={get,list,watch}
+// +kubebuilder:rbac:groups="policy",resources="poddisruptionbudgets",verbs={get,list,watch}
 
 // SetupWithManager adds the PostgresCluster controller to the provided runtime manager
 func (r *Reconciler) SetupWithManager(mgr manager.Manager) error {

internal/controller/postgrescluster/delete.go

@@ -27,7 +27,7 @@ import (
 	"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
 )
 
-// +kubebuilder:rbac:groups=postgres-operator.crunchydata.com,resources=postgresclusters,verbs=patch
+// +kubebuilder:rbac:groups="postgres-operator.crunchydata.com",resources="postgresclusters",verbs={patch}
 
 // handleDelete sets a finalizer on cluster and performs the finalization of
 // cluster when it is being deleted. It returns (nil, nil) when cluster is

internal/controller/postgrescluster/instance.go

@@ -291,8 +291,8 @@ func (observed *observedInstances) writablePod(container string) (*corev1.Pod, *
 	return nil, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=pods,verbs=list
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=list
+// +kubebuilder:rbac:groups="",resources="pods",verbs={list}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={list}
 
 // observeInstances populates cluster.Status.InstanceSets with observations and
 // builds an observedInstances by reading from the Kubernetes API.
@@ -342,8 +342,8 @@ func (r *Reconciler) observeInstances(
 	return observed, err
 }
 
-// +kubebuilder:rbac:groups="",resources=pods,verbs=list
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=patch
+// +kubebuilder:rbac:groups="",resources="pods",verbs={list}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={patch}
 
 // deleteInstances gracefully stops instances of cluster to avoid failovers and
 // unclean shutdowns of PostgreSQL. It returns (nil, nil) when finished.
@@ -435,10 +435,10 @@ func (r *Reconciler) deleteInstances(
 	return &result, err
 }
 
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=delete;list
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=delete;list
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=delete;list
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=delete;list
+// +kubebuilder:rbac:groups="",resources="configmaps",verbs={delete,list}
+// +kubebuilder:rbac:groups="",resources="secrets",verbs={delete,list}
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={delete,list}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={delete,list}
 
 // deleteInstance will delete all resources related to a single instance
 func (r *Reconciler) deleteInstance(
@@ -572,7 +572,7 @@ func (r *Reconciler) reconcileInstanceSets(
 	return err
 }
 
-// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=list
+// +kubebuilder:rbac:groups="policy",resources="poddisruptionbudgets",verbs={list}
 
 // cleanupPodDisruptionBudgets removes pdbs that do not have an
 // associated Instance Set
@@ -672,7 +672,7 @@ func findAvailableInstanceNames(set v1beta1.PostgresInstanceSetSpec,
 	return availableInstanceNames
 }
 
-// +kubebuilder:rbac:groups="",resources=pods,verbs=delete
+// +kubebuilder:rbac:groups="",resources="pods",verbs={delete}
 
 // rolloutInstance redeploys the Pod of instance by deleting it. Its StatefulSet
 // will recreate it according to its current PodTemplate. When instance is the
@@ -958,7 +958,7 @@ func podsToKeep(instances []corev1.Pod, want map[string]int) []corev1.Pod {
 
 }
 
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=list
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={list}
 
 // scaleUpInstances updates the cluster until the number of instances matches
 // the cluster spec
@@ -1031,7 +1031,7 @@ func (r *Reconciler) scaleUpInstances(
 	return instances, err
 }
 
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=create;patch
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={create,patch}
 
 // reconcileInstance writes instance according to spec of cluster.
 // See Reconciler.reconcileInstanceSet.
@@ -1282,7 +1282,7 @@ func addPGBackRestToInstancePodSpec(cluster *v1beta1.PostgresCluster,
 	pgbackrest.AddConfigToInstancePod(cluster, instancePod)
 }
 
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="configmaps",verbs={create,patch}
 
 // reconcileInstanceConfigMap writes the ConfigMap that contains generated
 // files (etc) that apply to instance of cluster.
@@ -1318,8 +1318,8 @@ func (r *Reconciler) reconcileInstanceConfigMap(
 	return instanceConfigMap, err
 }
 
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=get
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="secrets",verbs={get}
+// +kubebuilder:rbac:groups="",resources="secrets",verbs={create,patch}
 
 // reconcileInstanceCertificates writes the Secret that contains certificates
 // and private keys for instance of cluster.
@@ -1381,7 +1381,7 @@ func (r *Reconciler) reconcileInstanceCertificates(
 	return instanceCerts, err
 }
 
-// +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=create;patch;get;delete
+// +kubebuilder:rbac:groups="policy",resources="poddisruptionbudgets",verbs={create,patch,get,delete}
 
 // reconcileInstanceSetPodDisruptionBudget creates a PDB for an instance set. A
 // PDB will be created when the minAvailable is determined to be greater than 0.

internal/controller/postgrescluster/patroni.go

@@ -37,7 +37,7 @@ import (
 	"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
 )
 
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=deletecollection
+// +kubebuilder:rbac:groups="",resources="endpoints",verbs={deletecollection}
 
 func (r *Reconciler) deletePatroniArtifacts(
 	ctx context.Context, cluster *v1beta1.PostgresCluster,
@@ -138,7 +138,7 @@ func (r *Reconciler) handlePatroniRestarts(
 	return nil
 }
 
-// +kubebuilder:rbac:groups="",resources=services,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="services",verbs={create,patch}
 
 // reconcilePatroniDistributedConfiguration sets labels and ownership on the
 // objects Patroni creates for its distributed configuration.
@@ -181,7 +181,7 @@ func (r *Reconciler) reconcilePatroniDistributedConfiguration(
 	return err
 }
 
-// +kubebuilder:rbac:resources=pods,verbs=get;list
+// +kubebuilder:rbac:resources="pods",verbs={get,list}
 
 func (r *Reconciler) reconcilePatroniDynamicConfiguration(
 	ctx context.Context, cluster *v1beta1.PostgresCluster, instances *observedInstances,
@@ -312,7 +312,7 @@ func (r *Reconciler) reconcilePatroniLeaderLease(
 	return service, err
 }
 
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get
+// +kubebuilder:rbac:groups="",resources="endpoints",verbs={get}
 
 // reconcilePatroniStatus populates cluster.Status.Patroni with observations.
 func (r *Reconciler) reconcilePatroniStatus(

internal/controller/postgrescluster/pgadmin.go

@@ -225,8 +225,8 @@ func (r *Reconciler) reconcilePGAdminService(
 	return service, err
 }
 
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=create;delete;patch
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={get}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={create,delete,patch}
 
 // reconcilePGAdminStatefulSet writes the StatefulSet that runs pgAdmin.
 func (r *Reconciler) reconcilePGAdminStatefulSet(
@@ -348,7 +348,7 @@ func (r *Reconciler) reconcilePGAdminStatefulSet(
 	return errors.WithStack(r.apply(ctx, sts))
 }
 
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={create,patch}
 
 // reconcilePGAdminDataVolume writes the PersistentVolumeClaim for instance's
 // pgAdmin data volume.

internal/controller/postgrescluster/pgbackrest.go

@@ -147,7 +147,7 @@ func (r *Reconciler) applyRepoHostIntent(ctx context.Context, postgresCluster *v
 	return repo, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={create,patch}
 
 // applyRepoVolumeIntent ensures the pgBackRest repository host deployment is synchronized with the
 // proper configuration according to the provided PostgresCluster custom resource.  This is done by
@@ -240,9 +240,9 @@ func (r *Reconciler) getPGBackRestResources(ctx context.Context,
 	return repoResources, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=delete
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=delete
-// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=delete
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={delete}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={delete}
+// +kubebuilder:rbac:groups="batch",resources="cronjobs",verbs={delete}
 
 // cleanupRepoResources cleans up pgBackRest repository resources that should no longer be
 // reconciled by deleting them.  This includes deleting repos (i.e. PersistentVolumeClaims) that
@@ -750,10 +750,10 @@ func generateBackupJobSpecIntent(postgresCluster *v1beta1.PostgresCluster,
 	return jobSpec, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=list;delete
-// +kubebuilder:rbac:groups="",resources=secrets,verbs=list;delete
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=get
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=list
+// +kubebuilder:rbac:groups="",resources="configmaps",verbs={delete,list}
+// +kubebuilder:rbac:groups="",resources="secrets",verbs={list,delete}
+// +kubebuilder:rbac:groups="",resources="endpoints",verbs={get}
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={list}
 
 // observeRestoreEnv observes the current Kubernetes environment to obtain any resources applicable
 // to performing pgBackRest restores (e.g. when initializing a new cluster using an existing
@@ -877,9 +877,9 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 	return currentEndpoints, restoreJob, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=endpoints,verbs=delete
-// +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=delete
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=delete
+// +kubebuilder:rbac:groups="",resources="endpoints",verbs={delete}
+// +kubebuilder:rbac:groups="apps",resources="statefulsets",verbs={delete}
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={delete}
 
 // prepareForRestore is responsible for reconciling an in place restore for the PostgresCluster.
 // This includes setting a "PreparingForRestore" condition, and then removing all existing
@@ -1000,7 +1000,7 @@ func (r *Reconciler) prepareForRestore(ctx context.Context,
 	return nil
 }
 
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=patch
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={patch}
 
 // reconcileRestoreJob is responsible for reconciling a Job that performs a pgBackRest restore in
 // order to populate a PGDATA directory.
@@ -1379,8 +1379,8 @@ func (r *Reconciler) reconcilePGBackRest(ctx context.Context,
 	return result, nil
 }
 
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=create;patch
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=create;patch;delete
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={create,patch}
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={create,patch,delete}
 
 // reconcilePostgresClusterDataSource is responsible for reconciling a PostgresCluster data source.
 // This is specifically done by running a pgBackRest restore to populate a PostgreSQL data volume
@@ -1539,8 +1539,8 @@ func (r *Reconciler) reconcilePostgresClusterDataSource(ctx context.Context,
 	return nil
 }
 
-// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=create;patch
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=create;patch;delete
+// +kubebuilder:rbac:groups="",resources="persistentvolumeclaims",verbs={create,patch}
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={create,patch,delete}
 
 // reconcileCloudBasedDataSource is responsible for reconciling a cloud-based PostgresCluster
 // data source, i.e., S3, etc.
@@ -1942,9 +1942,9 @@ func (r *Reconciler) reconcilePGBackRestSecret(ctx context.Context,
 	return err
 }
 
-// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=create;patch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=create;patch
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=create;patch
+// +kubebuilder:rbac:groups="",resources="serviceaccounts",verbs={create,patch}
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="roles",verbs={create,patch}
+// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="rolebindings",verbs={create,patch}
 
 // reconcileInstanceRBAC reconciles the Role, RoleBinding, and ServiceAccount for
 // pgBackRest
@@ -2072,7 +2072,7 @@ func (r *Reconciler) reconcileDedicatedRepoHost(ctx context.Context,
 	return repoHost, nil
 }
 
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=create;patch;delete
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={create,patch,delete}
 
 // reconcileManualBackup is responsible for reconciling pgBackRest backups that are initiated
 // manually by the end-user
@@ -2290,7 +2290,7 @@ func (r *Reconciler) reconcileManualBackup(ctx context.Context,
 	return nil
 }
 
-// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=create;patch;delete
+// +kubebuilder:rbac:groups="batch",resources="jobs",verbs={create,patch,delete}
 
 // reconcileReplicaCreateBackup is responsible for reconciling a full pgBackRest backup for the
 // cluster as required to create replicas
@@ -2505,8 +2505,8 @@ func (r *Reconciler) reconcileRepos(ctx context.Context,
 	return replicaCreateRepo, utilerrors.NewAggregate(errors)
 }
 
-// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list
-// +kubebuilder:rbac:groups="",resources=pods/exec,verbs=create
+// +kubebuilder:rbac:groups="",resources="pods",verbs={get,list}
+// +kubebuilder:rbac:groups="",resources="pods/exec",verbs={create}
 
 // reconcileStanzaCreate is responsible for ensuring stanzas are properly created for the
 // pgBackRest repositories configured for a PostgresCluster.  If the bool returned from this
@@ -2813,7 +2813,7 @@ func (r *Reconciler) reconcileScheduledBackups(
 	return requeue
 }
 
-// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=create;patch
+// +kubebuilder:rbac:groups="batch",resources="cronjobs",verbs={create,patch}
 
 // reconcilePGBackRestCronJob creates the CronJob for the given repo, pgBackRest
 // backup type and schedule