add missing label check when looking for missing admin CRBs

m00g3n · Aug 14, 2024 · 09f3bac · 09f3bac
1 parent e0c541d
commit 09f3bac
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/internal/controller/runtime/fsm/runtime_fsm_apply_clusterrolebindings.go b/internal/controller/runtime/fsm/runtime_fsm_apply_clusterrolebindings.go
@@ -115,9 +115,12 @@ func getRemoved(crbs []rbacv1.ClusterRoleBinding, admins []string) (removed []rb
 
 //nolint:gochecknoglobals
 var newContainsAdmin = func(admin string) func(rbacv1.ClusterRoleBinding) bool {
-	return func(r rbacv1.ClusterRoleBinding) bool {
+	return func(crb rbacv1.ClusterRoleBinding) bool {
+		if !labels.Set(crb.Labels).AsSelector().Matches(labels.Set(labelsClusterRoleBindings)) {
+			return false
+		}
 		isAdmin := isRBACUserKindOneOf([]string{admin})
-		return slices.ContainsFunc(r.Subjects, isAdmin)
+		return slices.ContainsFunc(crb.Subjects, isAdmin)
 	}
 }