fix: check crds when controller start

Some user upgrade form 1.6 to 1.7 by just change the image. The crds and rbacs are not updated, however the controller starts successfully and hide the issues. This check will panic kube-ovn-controller if crds are not ready and expose the issues.

cmd/controller/controller.go

@@ -1,7 +1,10 @@
 package controller
 
 import (
+	"context"
 	"fmt"
+	v1 "k8s.io/api/authorization/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"net/http"
 	_ "net/http/pprof" // #nosec
 	"os"
@@ -30,6 +33,10 @@ func CmdMain() {
 		klog.Fatalf("parse config failed %v", err)
 	}
 
+	if err := checkPermission(config); err != nil {
+		klog.Fatalf("failed to check permission %v", err)
+	}
+
 	go loopOvnNbctlDaemon(config)
 	go func() {
 		http.Handle("/metrics", promhttp.Handler())
@@ -61,3 +68,27 @@ func loopOvnNbctlDaemon(config *controller.Configuration) {
 		}
 	}
 }
+
+func checkPermission(config *controller.Configuration) error {
+	resources := []string{"vpcs", "subnets", "ips", "vlans", "vpc-nat-gateways"}
+	for _, res := range resources {
+		ssar := &v1.SelfSubjectAccessReview{
+			Spec: v1.SelfSubjectAccessReviewSpec{
+				ResourceAttributes: &v1.ResourceAttributes{
+					Verb:     "watch",
+					Group:    "kubeovn.io",
+					Resource: res,
+				},
+			},
+		}
+		ssar, err := config.KubeClient.AuthorizationV1().SelfSubjectAccessReviews().Create(context.Background(), ssar, metav1.CreateOptions{})
+		if err != nil {
+			klog.Errorf("failed to get permission for resource %s, %v", res, err)
+			return err
+		}
+		if !ssar.Status.Allowed {
+			return fmt.Errorf("no permission to wath resource %s, %s", res, ssar.Status.Reason)
+		}
+	}
+	return nil
+}

dist/images/install-pre-1.16.sh

@@ -2207,6 +2207,7 @@ diagnose(){
   kubectl get crd vpc-nat-gateways.kubeovn.io
   kubectl get crd subnets.kubeovn.io
   kubectl get crd ips.kubeovn.io
+  kubectl get crd vlans.kubeovn.io
   kubectl get svc kube-dns -n kube-system
   kubectl get svc kubernetes -n default
   kubectl get sa -n kube-system ovn

dist/images/install.sh

@@ -2259,6 +2259,7 @@ diagnose(){
   kubectl get crd vpc-nat-gateways.kubeovn.io
   kubectl get crd subnets.kubeovn.io
   kubectl get crd ips.kubeovn.io
+  kubectl get crd vlans.kubeovn.io
   kubectl get svc kube-dns -n kube-system
   kubectl get svc kubernetes -n default
   kubectl get sa -n kube-system ovn

dist/images/kubectl-ko

@@ -163,6 +163,7 @@ diagnose(){
   kubectl get crd vpc-nat-gateways.kubeovn.io
   kubectl get crd subnets.kubeovn.io
   kubectl get crd ips.kubeovn.io
+  kubectl get crd vlans.kubeovn.io
   kubectl get svc kube-dns -n kube-system
   kubectl get svc kubernetes -n default
   kubectl get sa -n kube-system ovn