Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor tenant RBAC rules #534

Merged
merged 1 commit into from
Dec 19, 2024
Merged

Refactor tenant RBAC rules #534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/apps/tenant/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ description: Separated tenant namespace
icon: /logos/tenant.svg

type: application
version: 1.6.2
version: 1.6.3
205 changes: 92 additions & 113 deletions packages/apps/tenant/templates/tenant.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ metadata:
kubernetes.io/service-account.name: {{ include "tenant.name" . }}
type: kubernetes.io/service-account-token
---
# == default role ==
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
Expand Down Expand Up @@ -62,18 +64,7 @@ roleRef:
name: {{ include "tenant.name" . }}
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "tenant.name" . }}
namespace: cozy-public
rules:
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmrepositories"]
verbs: ["get", "list"]
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmcharts"]
verbs: ["*"]
# == view role ==
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -119,22 +110,35 @@ rules:
- get
- list
- watch

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-view
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-view
apiGroup: rbac.authorization.k8s.io
{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
name: tenant-root-view
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if hasPrefix "tenant-" .Release.Namespace }}
{{- $parts := splitList "-" .Release.Namespace }}
{{- range $i, $v := $parts }}
{{- if ne $i 0 }}
- kind: Group
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-view
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end }}
{{- end }}
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-view
apiGroup: rbac.authorization.k8s.io

---
# == use role ==
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
Expand Down Expand Up @@ -189,14 +193,28 @@ metadata:
name: {{ include "tenant.name" . }}-use
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-use
apiGroup: rbac.authorization.k8s.io
{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
name: tenant-root-use
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if hasPrefix "tenant-" .Release.Namespace }}
{{- $parts := splitList "-" .Release.Namespace }}
{{- range $i, $v := $parts }}
{{- if ne $i 0 }}
- kind: Group
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-use
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end }}
{{- end }}
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-use
apiGroup: rbac.authorization.k8s.io
---
# == admin role ==
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
Expand Down Expand Up @@ -263,79 +281,35 @@ rules:
- update
- patch
- delete


---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: cozy-public
rules:
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmrepositories"]
verbs:
- get
- list
- apiGroups:
- source.toolkit.fluxcd.io
resources:
- helmcharts
verbs:
- get
- list
- apiGroups: ["source.toolkit.fluxcd.io"]
resources:
- helmcharts
verbs: ["*"]
resourceNames:
- bucket
- clickhouse
- ferretdb
- foo
- httpcache
- kafka
- kubernetes
- mysql
- nats
- postgres
- rabbitmq
- redis
- seaweedfs
- tcpbalancer
- virtualmachine
- vmdisk
- vminstance

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: cozy-public
namespace: {{ include "tenant.name" . }}
subjects:
{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
name: {{ include "tenant.name" . }}-admin
name: tenant-root-admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-admin
{{- end }}
{{- if hasPrefix "tenant-" .Release.Namespace }}
{{- $parts := splitList "-" .Release.Namespace }}
{{- range $i, $v := $parts }}
{{- if ne $i 0 }}
- kind: Group
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-admin
apiGroup: rbac.authorization.k8s.io
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-admin
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end }}
{{- end }}
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-admin
apiGroup: rbac.authorization.k8s.io
---
# == super admin role ==
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
Expand Down Expand Up @@ -377,45 +351,18 @@ rules:
- '*'
verbs:
- '*'


---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: cozy-public
rules:
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmrepositories"]
verbs:
- get
- list
- apiGroups: ["source.toolkit.fluxcd.io"]
resources:
- helmcharts
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: cozy-public
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: {{ include "tenant.name" . }}
subjects:
{{- if ne .Release.Namespace "tenant-root" }}
- kind: Group
name: tenant-root-super-admin
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if hasPrefix "tenant-" .Release.Namespace }}
{{- $parts := splitList "-" .Release.Namespace }}
{{- range $i, $v := $parts }}
Expand All @@ -426,10 +373,42 @@ subjects:
{{- end }}
{{- end }}
{{- end }}
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
---
# == dashboard role ==
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "tenant.name" . }}
namespace: cozy-public
rules:
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmrepositories"]
verbs: ["get", "list"]
- apiGroups: ["source.toolkit.fluxcd.io"]
resources: ["helmcharts"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "tenant.name" . }}
namespace: cozy-public
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
- kind: Group
name: {{ include "tenant.name" . }}-admin
apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
name: {{ include "tenant.name" . }}
namespace: {{ include "tenant.name" . }}
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-super-admin
name: {{ include "tenant.name" . }}
apiGroup: rbac.authorization.k8s.io
3 changes: 2 additions & 1 deletion packages/apps/versions_map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ tenant 1.4.0 94c688f7
tenant 1.5.0 48128743
tenant 1.6.0 df448b99
tenant 1.6.1 edbbb9be
tenant 1.6.2 HEAD
tenant 1.6.2 ccedc5fe
tenant 1.6.3 HEAD
virtual-machine 0.1.4 f2015d6
virtual-machine 0.1.5 7cd7de7
virtual-machine 0.2.0 5ca8823
Expand Down