Skip to content

Commit 099c0da

Browse files
DebakelOrakelDebakelOrakel
authored
Merge pull request #108 from appuio/feat/self-provisioner
Support managing self-provisioners
2 parents 3cc7875 + bad3aae commit 099c0da

8 files changed

Lines changed: 355 additions & 2 deletions

File tree

‎class/defaults.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ parameters:
77
sudoGroupName: null
88
sudoGroups: []
99

10+
selfProvisionerGroups:
11+
- system:authenticated:oauth
12+
1013
identityProviders: {}
1114

1215
templates:

‎component/main.jsonnet‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ local esp = import 'lib/espejote.libsonnet';
66
local kap = import 'lib/kapitan.libjsonnet';
77
local kube = import 'kube-ssa-compat.libsonnet';
88
local rbac = import 'rbac.libsonnet';
9+
local sp = import 'self-provisioning.libsonnet';
910
local inv = kap.inventory();
1011
// The hiera parameters for the component
1112
local params = inv.parameters.openshift4_authentication;
@@ -186,4 +187,5 @@ local removeKubeAdmin =
186187
[if std.length(ldapSync) > 0 then '20_ldap_sync']: ldapSync,
187188
'30_rbac': rbac,
188189
'40_remove_kubeadmin_managedresource': removeKubeAdmin,
190+
'50_self_provisioning': sp.selfProvisioning,
189191
}

‎component/self-provisioning.libsonnet‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
local common = import 'common.libsonnet';
2+
local com = import 'lib/commodore.libjsonnet';
3+
local esp = import 'lib/espejote.libsonnet';
4+
local kap = import 'lib/kapitan.libjsonnet';
5+
6+
// The hiera parameters for the component
7+
local inv = kap.inventory();
8+
local params = inv.parameters.openshift4_authentication;
9+
10+
local metadataPatch = {
11+
annotations+: {
12+
'syn.tools/source': 'https://github.com/appuio/component-openshift4-authentication.git',
13+
},
14+
labels+: {
15+
'app.kubernetes.io/managed-by': 'espejote',
16+
'app.kubernetes.io/part-of': 'syn',
17+
'app.kubernetes.io/component': 'openshift4-authentication',
18+
},
19+
};
20+
21+
local patch = {
22+
apiVersion: 'rbac.authorization.k8s.io/v1',
23+
kind: 'ClusterRoleBinding',
24+
metadata: {
25+
name: 'self-provisioners',
26+
},
27+
roleRef: {
28+
apiGroup: 'rbac.authorization.k8s.io',
29+
kind: 'ClusterRole',
30+
name: 'self-provisioner',
31+
},
32+
subjects: [
33+
{
34+
apiGroup: 'rbac.authorization.k8s.io',
35+
kind: 'Group',
36+
name: group,
37+
}
38+
for group in com.renderArray(params.selfProvisionerGroups)
39+
],
40+
};
41+
42+
local serviceAccount = {
43+
apiVersion: 'v1',
44+
kind: 'ServiceAccount',
45+
metadata: {
46+
name: 'rbac-clusterrolebinding-self-provisioners',
47+
namespace: inv.parameters.espejote.namespace,
48+
} + metadataPatch,
49+
};
50+
51+
local clusterRole = {
52+
apiVersion: 'rbac.authorization.k8s.io/v1',
53+
kind: 'ClusterRole',
54+
metadata: {
55+
name: 'syn-espejote:rbac-clusterrolebinding-self-provisioners',
56+
} + metadataPatch,
57+
rules: [
58+
{
59+
apiGroups: [ '', 'project.openshift.io' ],
60+
resources: [ 'projectrequests' ],
61+
verbs: [ 'create' ],
62+
},
63+
{
64+
apiGroups: [ 'rbac.authorization.k8s.io' ],
65+
resources: [ 'clusterrolebindings' ],
66+
resourceNames: [ 'self-provisioners' ],
67+
verbs: [ '*' ],
68+
},
69+
],
70+
};
71+
72+
local clusterRoleBinding = {
73+
apiVersion: 'rbac.authorization.k8s.io/v1',
74+
kind: 'ClusterRoleBinding',
75+
metadata: {
76+
name: 'syn-espejote:rbac-clusterrolebinding-self-provisioners',
77+
} + metadataPatch,
78+
roleRef: {
79+
apiGroup: 'rbac.authorization.k8s.io',
80+
kind: 'ClusterRole',
81+
name: clusterRole.metadata.name,
82+
},
83+
subjects: [
84+
{
85+
kind: 'ServiceAccount',
86+
name: serviceAccount.metadata.name,
87+
namespace: serviceAccount.metadata.namespace,
88+
},
89+
],
90+
};
91+
92+
local managedResource = esp.managedResource('rbac-clusterrolebinding-self-provisioners', inv.parameters.espejote.namespace) {
93+
metadata+: metadataPatch,
94+
spec: {
95+
applyOptions: {
96+
force: true,
97+
},
98+
serviceAccountRef: {
99+
name: serviceAccount.metadata.name,
100+
},
101+
template: std.manifestJson(patch),
102+
triggers: [ {
103+
name: 'clusterrolebinding',
104+
watchResource: {
105+
apiVersion: patch.apiVersion,
106+
kind: patch.kind,
107+
name: patch.metadata.name,
108+
},
109+
} ],
110+
},
111+
};
112+
113+
{
114+
selfProvisioning: [
115+
serviceAccount,
116+
clusterRole,
117+
clusterRoleBinding,
118+
managedResource,
119+
],
120+
}

‎docs/modules/ROOT/pages/references/parameters.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,24 @@ See xref:index.adoc#_cluster_admin_sudo[Cluster Admin Sudo] and xref:index.adoc#
4040
Groups can be removed from the hierarchy by prefixing them with a `~` character.
4141

4242

43+
== `selfProvisionerGroups`
44+
45+
[horizontal]
46+
type:: list
47+
default::
48+
+
49+
[source,yaml]
50+
----
51+
selfProvisionerGroups:
52+
- system:authenticated:oauth
53+
----
54+
55+
The OpenShift group names for which the component allows self provisioning of projects/namespaces.
56+
See https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/postinstallation_configuration/post-install-preparing-for-users#default-roles_post-install-preparing-for-users[Default ClusterRoles] for more details.
57+
58+
Groups can be removed from the hierarchy by prefixing them with a `~` character.
59+
60+
4361
=== Example
4462

4563
[source,yaml]

‎tests/defaults.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
1+
applications:
2+
- espejote
3+
14
parameters:
25
kapitan:
36
dependencies:
47
- type: https
5-
source: https://raw.githubusercontent.com/projectsyn/component-espejote/v0.14.0/lib/espejote.libsonnet
8+
source: https://raw.githubusercontent.com/projectsyn/component-espejote/master/lib/espejote.libsonnet
69
output_path: vendor/lib/espejote.libsonnet
10+
espejote:
11+
namespace: syn-espejote
712

813
openshift4_authentication:
914
sudoGroups:

‎tests/golden/defaults/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations:
5+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
6+
labels:
7+
app.kubernetes.io/component: openshift4-authentication
8+
app.kubernetes.io/managed-by: espejote
9+
app.kubernetes.io/part-of: syn
10+
name: rbac-clusterrolebinding-self-provisioners
11+
namespace: syn-espejote
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
annotations:
17+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
18+
labels:
19+
app.kubernetes.io/component: openshift4-authentication
20+
app.kubernetes.io/managed-by: espejote
21+
app.kubernetes.io/part-of: syn
22+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
23+
rules:
24+
- apiGroups:
25+
- ''
26+
- project.openshift.io
27+
resources:
28+
- projectrequests
29+
verbs:
30+
- create
31+
- apiGroups:
32+
- rbac.authorization.k8s.io
33+
resourceNames:
34+
- self-provisioners
35+
resources:
36+
- clusterrolebindings
37+
verbs:
38+
- '*'
39+
---
40+
apiVersion: rbac.authorization.k8s.io/v1
41+
kind: ClusterRoleBinding
42+
metadata:
43+
annotations:
44+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
45+
labels:
46+
app.kubernetes.io/component: openshift4-authentication
47+
app.kubernetes.io/managed-by: espejote
48+
app.kubernetes.io/part-of: syn
49+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
50+
roleRef:
51+
apiGroup: rbac.authorization.k8s.io
52+
kind: ClusterRole
53+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
54+
subjects:
55+
- kind: ServiceAccount
56+
name: rbac-clusterrolebinding-self-provisioners
57+
namespace: syn-espejote
58+
---
59+
apiVersion: espejote.io/v1alpha1
60+
kind: ManagedResource
61+
metadata:
62+
annotations:
63+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
64+
labels:
65+
app.kubernetes.io/component: openshift4-authentication
66+
app.kubernetes.io/managed-by: espejote
67+
app.kubernetes.io/name: rbac-clusterrolebinding-self-provisioners
68+
app.kubernetes.io/part-of: syn
69+
name: rbac-clusterrolebinding-self-provisioners
70+
namespace: syn-espejote
71+
spec:
72+
applyOptions:
73+
force: true
74+
serviceAccountRef:
75+
name: rbac-clusterrolebinding-self-provisioners
76+
template: |-
77+
{
78+
"apiVersion": "rbac.authorization.k8s.io/v1",
79+
"kind": "ClusterRoleBinding",
80+
"metadata": {
81+
"name": "self-provisioners"
82+
},
83+
"roleRef": {
84+
"apiGroup": "rbac.authorization.k8s.io",
85+
"kind": "ClusterRole",
86+
"name": "self-provisioner"
87+
},
88+
"subjects": [
89+
{
90+
"apiGroup": "rbac.authorization.k8s.io",
91+
"kind": "Group",
92+
"name": "system:authenticated:oauth"
93+
}
94+
]
95+
}
96+
triggers:
97+
- name: clusterrolebinding
98+
watchResource:
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: ClusterRoleBinding
101+
name: self-provisioners

‎tests/golden/no-ldap/openshift4-authentication/openshift4-authentication/50_self_provisioning.yaml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations:
5+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
6+
labels:
7+
app.kubernetes.io/component: openshift4-authentication
8+
app.kubernetes.io/managed-by: espejote
9+
app.kubernetes.io/part-of: syn
10+
name: rbac-clusterrolebinding-self-provisioners
11+
namespace: syn-espejote
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
annotations:
17+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
18+
labels:
19+
app.kubernetes.io/component: openshift4-authentication
20+
app.kubernetes.io/managed-by: espejote
21+
app.kubernetes.io/part-of: syn
22+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
23+
rules:
24+
- apiGroups:
25+
- ''
26+
- project.openshift.io
27+
resources:
28+
- projectrequests
29+
verbs:
30+
- create
31+
- apiGroups:
32+
- rbac.authorization.k8s.io
33+
resourceNames:
34+
- self-provisioners
35+
resources:
36+
- clusterrolebindings
37+
verbs:
38+
- '*'
39+
---
40+
apiVersion: rbac.authorization.k8s.io/v1
41+
kind: ClusterRoleBinding
42+
metadata:
43+
annotations:
44+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
45+
labels:
46+
app.kubernetes.io/component: openshift4-authentication
47+
app.kubernetes.io/managed-by: espejote
48+
app.kubernetes.io/part-of: syn
49+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
50+
roleRef:
51+
apiGroup: rbac.authorization.k8s.io
52+
kind: ClusterRole
53+
name: syn-espejote:rbac-clusterrolebinding-self-provisioners
54+
subjects:
55+
- kind: ServiceAccount
56+
name: rbac-clusterrolebinding-self-provisioners
57+
namespace: syn-espejote
58+
---
59+
apiVersion: espejote.io/v1alpha1
60+
kind: ManagedResource
61+
metadata:
62+
annotations:
63+
syn.tools/source: https://github.com/appuio/component-openshift4-authentication.git
64+
labels:
65+
app.kubernetes.io/component: openshift4-authentication
66+
app.kubernetes.io/managed-by: espejote
67+
app.kubernetes.io/name: rbac-clusterrolebinding-self-provisioners
68+
app.kubernetes.io/part-of: syn
69+
name: rbac-clusterrolebinding-self-provisioners
70+
namespace: syn-espejote
71+
spec:
72+
applyOptions:
73+
force: true
74+
serviceAccountRef:
75+
name: rbac-clusterrolebinding-self-provisioners
76+
template: |-
77+
{
78+
"apiVersion": "rbac.authorization.k8s.io/v1",
79+
"kind": "ClusterRoleBinding",
80+
"metadata": {
81+
"name": "self-provisioners"
82+
},
83+
"roleRef": {
84+
"apiGroup": "rbac.authorization.k8s.io",
85+
"kind": "ClusterRole",
86+
"name": "self-provisioner"
87+
},
88+
"subjects": [
89+
90+
]
91+
}
92+
triggers:
93+
- name: clusterrolebinding
94+
watchResource:
95+
apiVersion: rbac.authorization.k8s.io/v1
96+
kind: ClusterRoleBinding
97+
name: self-provisioners

‎tests/no-ldap.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,12 @@ parameters:
22
kapitan:
33
dependencies:
44
- type: https
5-
source: https://raw.githubusercontent.com/projectsyn/component-espejote/v0.14.0/lib/espejote.libsonnet
5+
source: https://raw.githubusercontent.com/projectsyn/component-espejote/master/lib/espejote.libsonnet
66
output_path: vendor/lib/espejote.libsonnet
7+
8+
espejote:
9+
namespace: syn-espejote
10+
11+
openshift4_authentication:
12+
selfProvisionerGroups:
13+
- ~system:authenticated:oauth

0 commit comments

Comments
 (0)