Skip to content

Commit 83f0ebd

Browse files
scotwellsscotwells
authored
Merge pull request #56 from datum-cloud/milo-iam-resources
Milo IAM resources
2 parents 66dd560 + a210e2e commit 83f0ebd

File tree

12 files changed

+146
-6
lines changed

12 files changed

+146
-6
lines changed

‎.github/workflows/publish.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
id-token: write
1212
contents: read
1313
packages: write
14-
uses: datum-cloud/actions/.github/workflows/publish-docker.yaml@v1.5.0
14+
uses: datum-cloud/actions/.github/workflows/publish-docker.yaml@v1.5.1
1515
with:
1616
image-name: workload-operator
1717
secrets: inherit
@@ -21,7 +21,7 @@ jobs:
2121
id-token: write
2222
contents: read
2323
packages: write
24-
uses: datum-cloud/actions/.github/workflows/publish-kustomize-bundle.yaml@v1.5.0
24+
uses: datum-cloud/actions/.github/workflows/publish-kustomize-bundle.yaml@v1.5.1
2525
with:
2626
bundle-name: ghcr.io/datum-cloud/workload-operator-kustomize
2727
bundle-path: config

‎config/iam/kustomization.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# This kustomization program is used to create all of the Milo IAM resources to
2+
# configure the roles that are available to users and the resources protected by
3+
# the IAM system.
4+
#
5+
# This is created as a component so it can be included with other
6+
# kustomizations.
7+
apiVersion: kustomize.config.k8s.io/v1alpha1
8+
kind: Component
9+
10+
resources:
11+
- protected-resources/
12+
- roles/

‎config/iam/protected-resources/instance.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: iam.miloapis.com/v1alpha1
2+
kind: ProtectedResource
3+
metadata:
4+
name: compute.datumapis.com-instance
5+
spec:
6+
serviceRef:
7+
name: "compute.datumapis.com"
8+
kind: Instance
9+
plural: instances
10+
singular: instance
11+
permissions:
12+
- list
13+
- get
14+
- create
15+
- patch
16+
- update
17+
- delete
18+
- watch
19+
- updateStatus
20+
parentResources:
21+
- apiGroup: resourcemanager.miloapis.com
22+
kind: Project

‎config/iam/protected-resources/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# This kustomization program is used to create all of the Milo IAM protected
2+
# resources to configure the resources that are protected by the IAM system.
3+
#
4+
# Each Custom Resource Definition (CRD) exposed by the workload API that needs
5+
# to be protected by the IAM system should have a corresponding protected
6+
# resource configuration file in this directory.
7+
8+
resources:
9+
- workload.yaml
10+
- workload-deployment.yaml
11+
- instance.yaml

‎config/iam/protected-resources/workload-deployment.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: iam.miloapis.com/v1alpha1
2+
kind: ProtectedResource
3+
metadata:
4+
name: compute.datumapis.com-workloaddeployment
5+
spec:
6+
serviceRef:
7+
name: "compute.datumapis.com"
8+
kind: WorkloadDeployment
9+
plural: workloaddeployments
10+
singular: workloaddeployment
11+
permissions:
12+
- list
13+
- get
14+
- create
15+
- update
16+
- patch
17+
- delete
18+
- watch
19+
- updateStatus
20+
parentResources:
21+
- apiGroup: resourcemanager.miloapis.com
22+
kind: Project

‎config/iam/protected-resources/workload.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: iam.miloapis.com/v1alpha1
2+
kind: ProtectedResource
3+
metadata:
4+
name: compute.datumapis.com-workload
5+
spec:
6+
serviceRef:
7+
name: "compute.datumapis.com"
8+
kind: Workload
9+
plural: workloads
10+
singular: workload
11+
permissions:
12+
- list
13+
- get
14+
- create
15+
- update
16+
- patch
17+
- delete
18+
- watch
19+
- updateStatus
20+
parentResources:
21+
- apiGroup: resourcemanager.miloapis.com
22+
kind: Project

‎config/iam/roles/compute-admin.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: iam.miloapis.com/v1alpha1
2+
kind: Role
3+
metadata:
4+
name: compute.datumapis.com-admin
5+
annotations:
6+
kubernetes.io/display-name: Compute Admin
7+
kubernetes.io/description: "Full access to all compute resources"
8+
spec:
9+
launchStage: Beta
10+
inheritedRoles:
11+
- name: compute.datumapis.com-viewer
12+
includedPermissions:
13+
- compute.datumapis.com/workloads.create
14+
- compute.datumapis.com/workloads.update
15+
- compute.datumapis.com/workloads.delete

‎config/iam/roles/compute-viewer.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: iam.miloapis.com/v1alpha1
2+
kind: Role
3+
metadata:
4+
name: compute.datumapis.com-viewer
5+
annotations:
6+
kubernetes.io/display-name: Compute Viewer
7+
kubernetes.io/description: "View access to all compute resources"
8+
spec:
9+
launchStage: Beta
10+
includedPermissions:
11+
- compute.datumapis.com/workloads.list
12+
- compute.datumapis.com/workloads.get
13+
- compute.datumapis.com/workloads.watch
14+
- compute.datumapis.com/workloaddeployments.list
15+
- compute.datumapis.com/workloaddeployments.get
16+
- compute.datumapis.com/workloaddeployments.watch
17+
- compute.datumapis.com/instances.list
18+
- compute.datumapis.com/instances.get
19+
- compute.datumapis.com/instances.watch

‎config/iam/roles/kustomization.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This kustomization program is used to create all of the Milo IAM roles that
2+
# are available to users.
3+
#
4+
# Each role should have a corresponding configuration file in this directory.
5+
6+
resources:
7+
- compute-admin.yaml
8+
- compute-viewer.yaml

‎config/resource-metrics/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ configMapGenerator:
55
- name: workload-services-metrics
66
options:
77
labels:
8-
telemetry.datumapis.com/resource-metrics-config: "true"
8+
telemetry.miloapis.com/resource-metrics-config: "true"
99

1010
files:
1111
- instances.yaml

0 commit comments

Comments
 (0)