Skip to content

Commit 0e4a5c6

Browse files
Weeblinribbybibby
Weeblin
authored and
ribbybibby
committed
Fit ClusterRole and CRB into a manifest struct
1 parent 46cb2e0 commit 0e4a5c6

File tree

2 files changed

+62
-188
lines changed

2 files changed

+62
-188
lines changed

‎pkg/permissions/generate.go

Lines changed: 23 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -2,89 +2,60 @@ package permissions
22

33
import (
44
"fmt"
5-
"strings"
65

76
"github.com/jetstack/preflight/pkg/agent"
87
"github.com/jetstack/preflight/pkg/datagatherer/k8s"
98
rbac "k8s.io/api/rbac/v1"
109
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1110
)
1211

13-
func Generate(dataGatherers []agent.DataGatherer) string {
14-
var accumulator string = ""
15-
16-
for _, g := range dataGatherers {
17-
if g.Kind != "k8s-dynamic" {
18-
continue
19-
}
20-
21-
genericConfig := g.Config
22-
dyConfig := genericConfig.(*k8s.ConfigDynamic)
23-
24-
metaName := fmt.Sprint(dyConfig.GroupVersionResource.Resource)
25-
26-
accumulator = fmt.Sprintf(`%s
27-
apiVersion: rbac.authorization.k8s.io/v1
28-
kind: ClusterRole
29-
metadata:
30-
name: jetstack-secure-agent-%s-reader
31-
rules:
32-
- apiGroups: ["%s"]
33-
resources: ["%s"]
34-
verbs: ["get", "list", "watch"]
35-
---`, accumulator, metaName, dyConfig.GroupVersionResource.Group, dyConfig.GroupVersionResource.Resource)
36-
}
37-
38-
s := strings.TrimPrefix(accumulator, "\n")
39-
ss := strings.TrimSuffix(s, "---")
40-
return strings.TrimSuffix(ss, "\n")
12+
// AgentRBACManifests is a wrapper around the various RBAC structs needed to grant the agent fine-grained permissions as per its dg configs
13+
type AgentRBACManifests struct {
14+
// ClusterRoles is a list of roles for resources the agent will collect
15+
ClusterRoles []rbac.ClusterRole
16+
// ClusterRoleBindings is a list of crbs for resources which have no include/exclude ns configured
17+
ClusterRoleBindings []rbac.ClusterRoleBinding
18+
// RoleBindings is a list of namespaced bindings to grant permissions when include/exclude ns set
19+
RoleBindings []rbac.RoleBinding
4120
}
4221

43-
func GenerateClusterRoles(dataGatherer []agent.DataGatherer) []rbac.ClusterRole {
44-
out := []rbac.ClusterRole{}
22+
func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer) AgentRBACManifests {
23+
// create a new AgentRBACManifest struct
24+
var AgentRBACManifests AgentRBACManifests
4525

46-
for _, g := range dataGatherer {
47-
if g.Kind != "k8s-dynamic" {
26+
for _, dg := range dataGatherers {
27+
if dg.Kind != "k8s-dynamic" {
4828
continue
4929
}
5030

51-
genericConfig := g.Config
52-
dyConfig := genericConfig.(*k8s.ConfigDynamic)
53-
54-
metaName := dyConfig.GroupVersionResource.Resource
31+
dyConfig := dg.Config.(*k8s.ConfigDynamic)
32+
metadataName := fmt.Sprintf("jetstack-secure-agent-%s-reader", dyConfig.GroupVersionResource.Resource)
5533

56-
out = append(out, rbac.ClusterRole{
34+
AgentRBACManifests.ClusterRoles = append(AgentRBACManifests.ClusterRoles, rbac.ClusterRole{
5735
TypeMeta: metav1.TypeMeta{
5836
Kind: "ClusterRole",
5937
APIVersion: "rbac.authorization.k8s.io/v1",
6038
},
6139
ObjectMeta: metav1.ObjectMeta{
62-
Name: fmt.Sprintf("jetstack-secure-agent-%s-reader", metaName),
40+
Name: metadataName,
6341
},
6442
Rules: []rbac.PolicyRule{
6543
{
6644
Verbs: []string{"get", "list", "watch"},
6745
APIGroups: []string{dyConfig.GroupVersionResource.Group},
68-
Resources: []string{metaName},
46+
Resources: []string{dyConfig.GroupVersionResource.Resource},
6947
},
7048
},
7149
})
7250

73-
}
74-
return out
75-
}
76-
77-
func GenerateClusterRoleBindings(clusterRoles []rbac.ClusterRole) []rbac.ClusterRoleBinding {
78-
out := []rbac.ClusterRoleBinding{}
79-
for _, cr := range clusterRoles {
80-
out = append(out, rbac.ClusterRoleBinding{
51+
AgentRBACManifests.ClusterRoleBindings = append(AgentRBACManifests.ClusterRoleBindings, rbac.ClusterRoleBinding{
8152
TypeMeta: metav1.TypeMeta{
8253
Kind: "ClusterRoleBinding",
8354
APIVersion: "rbac.authorization.k8s.io/v1",
8455
},
8556

8657
ObjectMeta: metav1.ObjectMeta{
87-
Name: cr.ObjectMeta.Name,
58+
Name: metadataName,
8859
},
8960

9061
Subjects: []rbac.Subject{
@@ -97,11 +68,11 @@ func GenerateClusterRoleBindings(clusterRoles []rbac.ClusterRole) []rbac.Cluster
9768

9869
RoleRef: rbac.RoleRef{
9970
Kind: "ClusterRole",
100-
Name: cr.ObjectMeta.Name,
71+
Name: metadataName,
10172
APIGroup: "rbac.authorization.k8s.io",
10273
},
10374
})
104-
10575
}
106-
return out
76+
77+
return AgentRBACManifests
10778
}

‎pkg/permissions/generate_test.go

Lines changed: 39 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,14 @@ import (
1111
"k8s.io/apimachinery/pkg/runtime/schema"
1212
)
1313

14-
func TestGenerateRBAC(t *testing.T) {
15-
// Use these test cases to check if Generate function is correct
14+
func TestGenerateAgentRBACManifests(t *testing.T) {
1615
testCases := []struct {
17-
expectedClusterRoles []rbac.ClusterRole
18-
expectedClusterRoleBindings []rbac.ClusterRoleBinding
19-
dataGatherers []agent.DataGatherer
20-
description string
16+
description string
17+
dataGatherers []agent.DataGatherer
18+
expectedAgentRBACManifests AgentRBACManifests
2119
}{
2220
{
23-
description: "Generate RBAC struct for pods datagatherer",
21+
description: "Generate ClusterRole and ClusterRoleBinding for simple pod dg case",
2422
dataGatherers: []agent.DataGatherer{
2523
{
2624
Name: "k8s/pods",
@@ -32,151 +30,56 @@ func TestGenerateRBAC(t *testing.T) {
3230
},
3331
},
3432
},
35-
{
36-
Name: "k8s/secrets",
37-
Kind: "k8s-dynamic",
38-
Config: &k8s.ConfigDynamic{
39-
GroupVersionResource: schema.GroupVersionResource{
40-
Version: "v1",
41-
Resource: "secrets",
42-
},
43-
},
44-
},
45-
{
46-
Name: "k8s/awspcaissuer",
47-
Kind: "k8s-dynamic",
48-
Config: &k8s.ConfigDynamic{
49-
GroupVersionResource: schema.GroupVersionResource{
50-
Group: "awspca.cert-manager.io",
51-
Version: "v1",
52-
Resource: "awspcaissuers",
53-
},
54-
},
55-
},
5633
},
57-
expectedClusterRoles: []rbac.ClusterRole{
58-
{
59-
TypeMeta: metav1.TypeMeta{
60-
Kind: "ClusterRole",
61-
APIVersion: "rbac.authorization.k8s.io/v1",
62-
},
63-
ObjectMeta: metav1.ObjectMeta{
64-
Name: "jetstack-secure-agent-pods-reader",
65-
},
66-
Rules: []rbac.PolicyRule{
67-
{
68-
Verbs: []string{"get", "list", "watch"},
69-
APIGroups: []string{""},
70-
Resources: []string{"pods"},
34+
expectedAgentRBACManifests: AgentRBACManifests{
35+
ClusterRoles: []rbac.ClusterRole{
36+
{
37+
TypeMeta: metav1.TypeMeta{
38+
Kind: "ClusterRole",
39+
APIVersion: "rbac.authorization.k8s.io/v1",
7140
},
72-
},
73-
},
74-
{
75-
TypeMeta: metav1.TypeMeta{
76-
Kind: "ClusterRole",
77-
APIVersion: "rbac.authorization.k8s.io/v1",
78-
},
79-
ObjectMeta: metav1.ObjectMeta{
80-
Name: "jetstack-secure-agent-secrets-reader",
81-
},
82-
Rules: []rbac.PolicyRule{
83-
{
84-
Verbs: []string{"get", "list", "watch"},
85-
APIGroups: []string{""},
86-
Resources: []string{"secrets"},
41+
ObjectMeta: metav1.ObjectMeta{
42+
Name: "jetstack-secure-agent-pods-reader",
8743
},
88-
},
89-
},
90-
{
91-
TypeMeta: metav1.TypeMeta{
92-
Kind: "ClusterRole",
93-
APIVersion: "rbac.authorization.k8s.io/v1",
94-
},
95-
ObjectMeta: metav1.ObjectMeta{
96-
Name: "jetstack-secure-agent-awspcaissuers-reader",
97-
},
98-
Rules: []rbac.PolicyRule{
99-
{
100-
Verbs: []string{"get", "list", "watch"},
101-
APIGroups: []string{"awspca.cert-manager.io"},
102-
Resources: []string{"awspcaissuers"},
44+
Rules: []rbac.PolicyRule{
45+
{
46+
Verbs: []string{"get", "list", "watch"},
47+
APIGroups: []string{""},
48+
Resources: []string{"pods"},
49+
},
10350
},
10451
},
10552
},
106-
},
107-
expectedClusterRoleBindings: []rbac.ClusterRoleBinding{
108-
{
109-
TypeMeta: metav1.TypeMeta{
110-
Kind: "ClusterRoleBinding",
111-
APIVersion: "rbac.authorization.k8s.io/v1",
112-
},
113-
ObjectMeta: metav1.ObjectMeta{
114-
Name: "jetstack-secure-agent-pods-reader",
115-
},
116-
Subjects: []rbac.Subject{
117-
{
118-
Kind: "ServiceAccount",
119-
Name: "agent",
120-
Namespace: "jetstack-secure",
53+
ClusterRoleBindings: []rbac.ClusterRoleBinding{
54+
{
55+
TypeMeta: metav1.TypeMeta{
56+
Kind: "ClusterRoleBinding",
57+
APIVersion: "rbac.authorization.k8s.io/v1",
12158
},
122-
},
123-
RoleRef: rbac.RoleRef{
124-
Kind: "ClusterRole",
125-
Name: "jetstack-secure-agent-pods-reader",
126-
APIGroup: "rbac.authorization.k8s.io",
127-
},
128-
},
129-
{
130-
TypeMeta: metav1.TypeMeta{
131-
Kind: "ClusterRoleBinding",
132-
APIVersion: "rbac.authorization.k8s.io/v1",
133-
},
134-
ObjectMeta: metav1.ObjectMeta{
135-
Name: "jetstack-secure-agent-secrets-reader",
136-
},
137-
Subjects: []rbac.Subject{
138-
{
139-
Kind: "ServiceAccount",
140-
Name: "agent",
141-
Namespace: "jetstack-secure",
59+
ObjectMeta: metav1.ObjectMeta{
60+
Name: "jetstack-secure-agent-pods-reader",
14261
},
143-
},
144-
RoleRef: rbac.RoleRef{
145-
Kind: "ClusterRole",
146-
Name: "jetstack-secure-agent-secrets-reader",
147-
APIGroup: "rbac.authorization.k8s.io",
148-
},
149-
},
150-
{
151-
TypeMeta: metav1.TypeMeta{
152-
Kind: "ClusterRoleBinding",
153-
APIVersion: "rbac.authorization.k8s.io/v1",
154-
},
155-
ObjectMeta: metav1.ObjectMeta{
156-
Name: "jetstack-secure-agent-awspcaissuers-reader",
157-
},
158-
Subjects: []rbac.Subject{
159-
{
160-
Kind: "ServiceAccount",
161-
Name: "agent",
162-
Namespace: "jetstack-secure",
62+
Subjects: []rbac.Subject{
63+
{
64+
Kind: "ServiceAccount",
65+
Name: "agent",
66+
Namespace: "jetstack-secure",
67+
},
68+
},
69+
RoleRef: rbac.RoleRef{
70+
Kind: "ClusterRole",
71+
Name: "jetstack-secure-agent-pods-reader",
72+
APIGroup: "rbac.authorization.k8s.io",
16373
},
164-
},
165-
RoleRef: rbac.RoleRef{
166-
Kind: "ClusterRole",
167-
Name: "jetstack-secure-agent-awspcaissuers-reader",
168-
APIGroup: "rbac.authorization.k8s.io",
16974
},
17075
},
17176
},
17277
},
17378
}
17479

17580
for _, input := range testCases {
176-
gotClusterRoles := GenerateClusterRoles(input.dataGatherers)
177-
gotClusterRoleBindings := GenerateClusterRoleBindings(gotClusterRoles)
81+
got := GenerateAgentRBACManifests(input.dataGatherers)
17882

179-
td.Cmp(t, input.expectedClusterRoles, gotClusterRoles)
180-
td.Cmp(t, input.expectedClusterRoleBindings, gotClusterRoleBindings)
83+
td.Cmp(t, input.expectedAgentRBACManifests, got)
18184
}
18285
}

0 commit comments

Comments
 (0)