Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add metadata flags #100

Closed
wants to merge 2 commits into from
Closed

Add metadata flags #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f38ea3e
Update flags to customize metadata from command line
paulbarfuss Feb 28, 2024
8d5e829
Fix default values
paulbarfuss Feb 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions cmd/generate_cmd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,14 @@ import (
func NewCommandGenerateClusterRole() *cobra.Command {

clusterContext := ""
name := ""
namespace := ""
generateKind := ""
allowedGroups := []string{}
//expandGroups := []string{}
allowedVerb := []string{}
denyResources := []string{}
annotations := map[string]string{}

// Support overrides
cmd := &cobra.Command{
Expand Down Expand Up @@ -61,7 +64,7 @@ rbac-tool gen --generated-type=ClusterRole --deny-resources=secrets., --allowed-
return err
}

obj, err := generateRole(generateKind, computedPolicyRules)
obj, err := generateRole(generateKind, computedPolicyRules, name, namespace, annotations)
if err != nil {
return err
}
Expand All @@ -76,15 +79,18 @@ rbac-tool gen --generated-type=ClusterRole --deny-resources=secrets., --allowed-

flags.StringVarP(&generateKind, "generated-type", "t", "ClusterRole", "Role or ClusterRole")
flags.StringVarP(&clusterContext, "cluster-context", "c", "", "Cluster.use 'kubectl config get-contexts' to list available contexts")
flags.StringVar(&name, "name", "custom-cluster-role", "Name of Role/ClusterRole")
flags.StringVarP(&namespace, "namespace", "n", "myappnamespace", "Namespace of Role/ClusterRole")
//flags.StringSliceVarP(&expandGroups, "expand-groups", "g", []string{""}, "Comma separated list of API groups we would like to list all resource kinds rather than using wild cards '*'")
flags.StringSliceVar(&allowedGroups, "allowed-groups", []string{"*"}, "Comma separated list of API groups we would like to allow '*'")
flags.StringSliceVar(&allowedVerb, "allowed-verbs", []string{"*"}, "Comma separated list of verbs to include. To include all use '*'")
flags.StringSliceVar(&denyResources, "deny-resources", []string{""}, "Comma separated list of resource.group - for example secret. to deny secret (core group) access")
flags.StringToStringVar(&annotations, "annotations", map[string]string{}, "Custom annotations")

return cmd
}

func generateRole(generateKind string, rules []rbacv1.PolicyRule) (string, error) {
func generateRole(generateKind string, rules []rbacv1.PolicyRule, name string, namespace string, annotations map[string]string) (string, error) {
var obj runtime.Object

if generateKind == "ClusterRole" {
Expand All @@ -94,19 +100,24 @@ func generateRole(generateKind string, rules []rbacv1.PolicyRule) (string, error
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "custom-cluster-role",
Name: name,
Annotations: annotations,
},
Rules: rules,
}
} else {
if generateKind == "Role" && name == "custom-cluster-role" {
name = "cluster-role"
}
obj = &rbacv1.Role{
TypeMeta: metav1.TypeMeta{
Kind: "Role",
APIVersion: "rbac.authorization.k8s.io/v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "custom-role",
Namespace: "mynamespace",
Name: name,
Namespace: namespace,
Annotations: annotations,
},
Rules: rules,
}
Expand Down
8 changes: 7 additions & 1 deletion cmd/show_permissions_cmd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,15 @@ import (
func NewCommandGenerateShowPermissions() *cobra.Command {

clusterContext := ""
name := ""
namespace := ""
generateKind := "ClusterRole"
forGroups := []string{"*"}
withVerb := []string{"*"}
scope := "cluster"
denyVerb := []string{}
denyResource := []string{}
annotations := map[string]string{}

// Support overrides
cmd := &cobra.Command{
Expand Down Expand Up @@ -87,7 +90,7 @@ rbac-tool show --scope=namespaced --without-verbs=create,update,patch,delete,del
if scope == "namespaced" {
generateKind = "Role"
}
obj, err := generateRole(generateKind, computedPolicyRules)
obj, err := generateRole(generateKind, computedPolicyRules, name, namespace, annotations)
if err != nil {
return err
}
Expand All @@ -101,11 +104,14 @@ rbac-tool show --scope=namespaced --without-verbs=create,update,patch,delete,del
flags := cmd.Flags()

flags.StringVarP(&clusterContext, "cluster-context", "c", "", "Cluster.use 'kubectl config get-contexts' to list available contexts")
flags.StringVar(&name, "name", "custom-cluster-role", "Name of Role/ClusterRole")
flags.StringVarP(&namespace, "namespace", "n", "myappnamespace", "Namespace of Role/ClusterRole")
flags.StringVarP(&scope, "scope", "", "all", "Filter by resource scope. Valid values are: 'cluster' | 'namespaced' | 'all' ")
flags.StringSliceVar(&forGroups, "for-groups", []string{"*"}, "Comma separated list of API groups we would like to show the permissions")
flags.StringSliceVar(&withVerb, "with-verbs", []string{"*"}, "Comma separated list of verbs to include. To include all use '*'")
flags.StringSliceVar(&denyVerb, "without-verbs", []string{""}, "Comma separated list of verbs to exclude.")
flags.StringSliceVar(&denyResource, "without-resources", []string{""}, "Comma separated list of resources to exclude. Syntax: <resourceName>.<apiGroup>")
flags.StringToStringVar(&annotations, "annotations", map[string]string{}, "Custom annotations")

return cmd
}
Expand Down
Loading