Skip to content

Commit 081a114

Browse files
camilamacedo86camilamacedo86
committed
feat(rbac) : add editor and viewer role for crds
1 parent dc32e46 commit 081a114

File tree

10 files changed

+306
-0
lines changed

10 files changed

+306
-0
lines changed

‎pkg/scaffold/api.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,8 @@ func (api *API) scaffoldV2() error {
185185
Resource: r},
186186
&scaffoldv2.Group{Resource: r},
187187
&scaffoldv2.CRDSample{Resource: r},
188+
&scaffoldv2.CRDEditorRole{Resource: r},
189+
&scaffoldv2.CRDViewerRole{Resource: r},
188190
&crdv2.EnableWebhookPatch{Resource: r},
189191
&crdv2.EnableCAInjectionPatch{Resource: r},
190192
}

‎pkg/scaffold/v2/crd_editor_rbac.go‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright 2018 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v2
18+
19+
import (
20+
"fmt"
21+
"path/filepath"
22+
"strings"
23+
24+
"sigs.k8s.io/kubebuilder/pkg/scaffold/input"
25+
"sigs.k8s.io/kubebuilder/pkg/scaffold/resource"
26+
)
27+
28+
var _ input.File = &CRDEditorRole{}
29+
30+
// CRD Editor role scaffolds the config/rbca/<kind>_editor_role.yaml
31+
type CRDEditorRole struct {
32+
input.Input
33+
34+
// Resource is a resource in the API group
35+
Resource *resource.Resource
36+
}
37+
38+
// GetInput implements input.File
39+
func (g *CRDEditorRole) GetInput() (input.Input, error) {
40+
if g.Path == "" {
41+
g.Path = filepath.Join("config", "rbac", fmt.Sprintf("%s_editor_role.yaml", strings.ToLower(g.Resource.Kind)))
42+
}
43+
44+
g.TemplateBody = crdRoleEditorTemplate
45+
return g.Input, nil
46+
}
47+
48+
// Validate validates the values
49+
func (g *CRDEditorRole) Validate() error {
50+
return g.Resource.Validate()
51+
}
52+
53+
const crdRoleEditorTemplate = `# permissions to do edit {{ .Resource.Resource }}.
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
kind: ClusterRole
56+
metadata:
57+
name: {{ lower .Resource.Kind }}-editor-role
58+
rules:
59+
- apiGroups:
60+
- {{ .Resource.Group }}.{{ .Domain }}
61+
resources:
62+
- {{ .Resource.Resource }}
63+
verbs:
64+
- create
65+
- delete
66+
- get
67+
- list
68+
- patch
69+
- update
70+
- watch
71+
- apiGroups:
72+
- {{ .Resource.Group }}.{{ .Domain }}
73+
resources:
74+
- {{ .Resource.Resource }}/status
75+
verbs:
76+
- get
77+
- patch
78+
- update
79+
`

‎pkg/scaffold/v2/crd_viewer_rbac.go‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
Copyright 2018 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v2
18+
19+
import (
20+
"fmt"
21+
"path/filepath"
22+
"strings"
23+
24+
"sigs.k8s.io/kubebuilder/pkg/scaffold/input"
25+
"sigs.k8s.io/kubebuilder/pkg/scaffold/resource"
26+
)
27+
28+
var _ input.File = &CRDViewerRole{}
29+
30+
// CRD Viewer role scaffolds the config/rbca/<kind>_viewer_role.yaml
31+
type CRDViewerRole struct {
32+
input.Input
33+
34+
// Resource is a resource in the API group
35+
Resource *resource.Resource
36+
}
37+
38+
// GetInput implements input.File
39+
func (g *CRDViewerRole) GetInput() (input.Input, error) {
40+
if g.Path == "" {
41+
g.Path = filepath.Join("config", "rbac", fmt.Sprintf("%s_viewer_role.yaml", strings.ToLower(g.Resource.Kind)))
42+
}
43+
44+
g.TemplateBody = crdRoleViewerTemplate
45+
return g.Input, nil
46+
}
47+
48+
// Validate validates the values
49+
func (g *CRDViewerRole) Validate() error {
50+
return g.Resource.Validate()
51+
}
52+
53+
const crdRoleViewerTemplate = `# permissions to do viewer {{ .Resource.Resource }}.
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
kind: ClusterRole
56+
metadata:
57+
name: {{ lower .Resource.Kind }}-viewer-role
58+
rules:
59+
- apiGroups:
60+
- {{ .Resource.Group }}.{{ .Domain }}
61+
resources:
62+
- {{ .Resource.Resource }}
63+
verbs:
64+
- get
65+
- list
66+
- watch
67+
- apiGroups:
68+
- {{ .Resource.Group }}.{{ .Domain }}
69+
resources:
70+
- {{ .Resource.Resource }}/status
71+
verbs:
72+
- get
73+
`

‎test/e2e/v2/e2e_suite.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,20 @@ var _ = Describe("kubebuilder", func() {
246246
return err
247247
}, time.Minute, time.Second).Should(Succeed())
248248

249+
By("applying CRD Editor Role")
250+
crdEditorRole := filepath.Join("config", "rbac", fmt.Sprintf("%s_editor_role.yaml", strings.ToLower(kbc.Kind)))
251+
Eventually(func() error {
252+
_, err = kbc.Kubectl.Apply(true, "-f", crdEditorRole)
253+
return err
254+
}, time.Minute, time.Second).Should(Succeed())
255+
256+
By("applying CRD Viewer Role")
257+
crdViewerRole := filepath.Join("config", "rbac", fmt.Sprintf("%s_viewer_role.yaml", strings.ToLower(kbc.Kind)))
258+
Eventually(func() error {
259+
_, err = kbc.Kubectl.Apply(true, "-f", crdViewerRole)
260+
return err
261+
}, time.Minute, time.Second).Should(Succeed())
262+
249263
By("validate the created resource object gets reconciled in controller")
250264
managerContainerLogs := func() string {
251265
logOutput, err := kbc.Kubectl.Logs(controllerPodName, "-c", "manager")

‎testdata/project-v2/config/rbac/admiral_editor_role.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# permissions to do edit admirals.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: admiral-editor-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- admirals
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
19+
- apiGroups:
20+
- crew.testproject.org
21+
resources:
22+
- admirals/status
23+
verbs:
24+
- get
25+
- patch
26+
- update

‎testdata/project-v2/config/rbac/admiral_viewer_role.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# permissions to do viewer admirals.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: admiral-viewer-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- admirals
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- apiGroups:
16+
- crew.testproject.org
17+
resources:
18+
- admirals/status
19+
verbs:
20+
- get

‎testdata/project-v2/config/rbac/captain_editor_role.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# permissions to do edit captains.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: captain-editor-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- captains
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
19+
- apiGroups:
20+
- crew.testproject.org
21+
resources:
22+
- captains/status
23+
verbs:
24+
- get
25+
- patch
26+
- update

‎testdata/project-v2/config/rbac/captain_viewer_role.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# permissions to do viewer captains.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: captain-viewer-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- captains
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- apiGroups:
16+
- crew.testproject.org
17+
resources:
18+
- captains/status
19+
verbs:
20+
- get

‎testdata/project-v2/config/rbac/firstmate_editor_role.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# permissions to do edit firstmates.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: firstmate-editor-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- firstmates
11+
verbs:
12+
- create
13+
- delete
14+
- get
15+
- list
16+
- patch
17+
- update
18+
- watch
19+
- apiGroups:
20+
- crew.testproject.org
21+
resources:
22+
- firstmates/status
23+
verbs:
24+
- get
25+
- patch
26+
- update

‎testdata/project-v2/config/rbac/firstmate_viewer_role.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# permissions to do viewer firstmates.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: firstmate-viewer-role
6+
rules:
7+
- apiGroups:
8+
- crew.testproject.org
9+
resources:
10+
- firstmates
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- apiGroups:
16+
- crew.testproject.org
17+
resources:
18+
- firstmates/status
19+
verbs:
20+
- get

0 commit comments

Comments
 (0)