Skip to content

Commit 87ef7f3

Browse files
memalhotmemalhot
committed
cronjob for multiple namespaces
1 parent 9509efc commit 87ef7f3

File tree

7 files changed

+206
-0
lines changed

7 files changed

+206
-0
lines changed

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,36 @@ Alternatively, to run the script immediately:
7474

7575
This will trigger the cronjob to spawn a job manually.
7676

77+
### multiple-ns-group-sync
78+
This cronjob runs once every hours at the top of the hour, adding all users with the edit rolebinding in the specified namespaces to the specified group. This cronjob differs from the original `group-sync` cronjob by syncing with multiple namespaces rather than just one namespace.
79+
80+
1. Ensure you are logged in to your OpenShift account via the CLI and you have access to ope-rhods-testing namespace.
81+
Then run:
82+
```
83+
oc project ope-rhods-testing
84+
```
85+
2. Ensure the environment variables for `GROUP_NAME`, and `CLASS_NAME` are correctly set.
86+
87+
3. From cronjobs/multiple-ns-group-sync directory run:
88+
89+
```
90+
oc apply -k . --as system:admin
91+
```
92+
93+
94+
This will deploy all the necessary resources for the cronjob to run on the specified schedule.(Every hour by default)
95+
96+
Alternatively, to run the script immediately:
97+
98+
1. Ensure you followed the steps above
99+
2. Verify the cronjob `multiple-ns-group-sync` exists
100+
```
101+
oc get cronjob multiple-ns-group-sync
102+
```
103+
3.
104+
````
105+
kubectl create job --from=cronjob/multiple-ns-group-sync -n ope-rhods-testing multiple-ns-group-sync
106+
````
77107

78108
## Scripts
79109

‎cronjobs/multiple-ns-group-sync/clusterrole.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: multiple-ns-group-sync
5+
rules:
6+
- apiGroups:
7+
- user.openshift.io
8+
resources:
9+
- groups
10+
verbs:
11+
- get
12+
- update
13+
- list
14+
- patch
15+
- watch
16+
- apiGroups:
17+
- ""
18+
resources:
19+
- namespaces
20+
verbs:
21+
- get
22+
- list
23+
- watch
24+
- apiGroups:
25+
- rbac.authorization.k8s.io
26+
resources:
27+
- rolebindings
28+
verbs:
29+
- get
30+
- list
31+
- watch

‎cronjobs/multiple-ns-group-sync/clusterrolebinding.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
kind: RoleBinding
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
name: multiple-ns-group-sync
5+
subjects:
6+
- kind: ServiceAccount
7+
name: multiple-ns-group-sync
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: edit

‎cronjobs/multiple-ns-group-sync/cronjob.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
kind: CronJob
2+
apiVersion: batch/v1
3+
metadata:
4+
name: multiple-ns-group-sync
5+
labels:
6+
component.opendatahub.io/name: multiple-ns-group-sync
7+
opendatahub.io/component: 'true'
8+
opendatahub.io/modified: 'false'
9+
spec:
10+
schedule: '0 * * * *'
11+
startingDeadlineSeconds: 200
12+
concurrencyPolicy: Allow
13+
suspend: false
14+
jobTemplate:
15+
metadata:
16+
labels:
17+
component.opendatahub.io/name: multiple-ns-group-sync
18+
opendatahub.io/component: 'true'
19+
spec:
20+
template:
21+
metadata:
22+
labels:
23+
component.opendatahub.io/name: multiple-ns-group-sync
24+
opendatahub.io/component: 'true'
25+
parent: multiple-ns-group-sync
26+
spec:
27+
restartPolicy: Never
28+
serviceAccountName: multiple-ns-group-sync
29+
schedulerName: default-scheduler
30+
terminationGracePeriodSeconds: 30
31+
securityContext: {}
32+
containers:
33+
- name: oc-cli
34+
image: >-
35+
registry.redhat.io/openshift4/ose-cli@sha256:25fef269ac6e7491cb8340119a9b473acbeb53bc6970ad029fdaae59c3d0ca61
36+
command: ["/bin/bash", "-c", "--"]
37+
args:
38+
- |
39+
# get everyone in current grouping
40+
group_users=($(oc get groups --as system:admin $GROUP_NAME -o jsonpath='{.users[*]}'))
41+
42+
# get everyone who has edit permissions on a workbench
43+
curr_users=()
44+
45+
namespaces=($(oc get ns --as system:admin -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep "^${CLASS_NAME}-"))
46+
47+
for ns in "${namespaces[@]}"; do
48+
users=$(oc -n "$ns" get rolebinding -o jsonpath='{range .items[?(@.roleRef.name=="edit")].subjects[?(@.kind=="User")]}{.name}{"\n"}{end}')
49+
for u in $users; do
50+
[[ -z "$u" ]] && continue
51+
52+
# if not in already in current users, add to current users
53+
[[ " ${curr_users[*]} " =~ " $u " ]] || curr_users+=("$u")
54+
done
55+
done
56+
57+
# add users to the group who have rolebindings, but are not in the group
58+
users_to_add=()
59+
# remove users who are in the group, but dont have rolebindings
60+
users_to_remove=()
61+
62+
for u in ${curr_users[@]}; do
63+
# if not in group users, but in current users, add user
64+
if [[ ! " ${group_users[*]} " =~ " $u " ]]; then
65+
users_to_add+=("$u")
66+
fi
67+
done
68+
69+
for u in ${group_users[@]}; do
70+
# if not in group users, but in current users, add user
71+
if [[ ! " ${curr_users[*]} " =~ " $u " ]]; then
72+
users_to_remove+=("$u")
73+
fi
74+
done
75+
76+
echo "users to add:"
77+
echo ${users_to_add[@]}
78+
echo " "
79+
80+
echo "users to remove:"
81+
echo ${users_to_remove[@]}
82+
echo " "
83+
84+
if [ ${#users_to_add[@]} -gt 0 ]; then
85+
oc adm groups add-users --as system:admin "$GROUP_NAME" "${users_to_add[@]}"
86+
fi
87+
88+
if [ ${#users_to_remove[@]} -gt 0 ]; then
89+
oc adm groups remove-users --as system:admin "$GROUP_NAME" "${users_to_remove[@]}"
90+
fi
91+
env:
92+
# EDIT VALUE HERE BEFORE RUNNING
93+
- name: CLASS_NAME
94+
value: "bu-cs599-pmpp-cuda"
95+
- name: GROUP_NAME
96+
value: "cs599-pmpp"
97+
resources:
98+
limits:
99+
cpu: 100m
100+
memory: 800Mi
101+
requests:
102+
cpu: 100m
103+
memory: 400Mi
104+
terminationMessagePath: /dev/termination-log
105+
terminationMessagePolicy: File
106+
imagePullPolicy: IfNotPresent
107+
dnsPolicy: ClusterFirst
108+
successfulJobsHistoryLimit: 7
109+
failedJobsHistoryLimit: 7

‎cronjobs/multiple-ns-group-sync/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- clusterrole.yaml
5+
- cronjob.yaml
6+
- clusterrolebinding.yaml
7+
- serviceaccount.yaml
8+
- rhods-rb.yaml
9+
namespace: ope-rhods-testing

‎cronjobs/multiple-ns-group-sync/rhods-rb.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: multiple-ns-group-sync-binding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: multiple-ns-group-sync
9+
subjects:
10+
- kind: ServiceAccount
11+
name: multiple-ns-group-sync
12+
namespace: ope-rhods-testing

‎cronjobs/multiple-ns-group-sync/serviceaccount.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: multiple-ns-group-sync

0 commit comments

Comments
 (0)