Skip to content

Commit 35f3361

Browse files
Weeblinribbybibby
Weeblin
authored and
ribbybibby
committed
Add making RoleBiding Functionality
Signed-off-by: wenlin <wenlin.yi@jetstack.io>
1 parent 0e4a5c6 commit 35f3361

File tree

2 files changed

+140
-21
lines changed

2 files changed

+140
-21
lines changed

‎pkg/permissions/generate.go

Lines changed: 57 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ type AgentRBACManifests struct {
1919
RoleBindings []rbac.RoleBinding
2020
}
2121

22+
//func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer, konwnNamespaces []string) AgentRBACManifests {
2223
func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer) AgentRBACManifests {
2324
// create a new AgentRBACManifest struct
2425
var AgentRBACManifests AgentRBACManifests
@@ -31,6 +32,7 @@ func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer) AgentRBACMan
3132
dyConfig := dg.Config.(*k8s.ConfigDynamic)
3233
metadataName := fmt.Sprintf("jetstack-secure-agent-%s-reader", dyConfig.GroupVersionResource.Resource)
3334

35+
// always do this...
3436
AgentRBACManifests.ClusterRoles = append(AgentRBACManifests.ClusterRoles, rbac.ClusterRole{
3537
TypeMeta: metav1.TypeMeta{
3638
Kind: "ClusterRole",
@@ -48,30 +50,65 @@ func GenerateAgentRBACManifests(dataGatherers []agent.DataGatherer) AgentRBACMan
4850
},
4951
})
5052

51-
AgentRBACManifests.ClusterRoleBindings = append(AgentRBACManifests.ClusterRoleBindings, rbac.ClusterRoleBinding{
52-
TypeMeta: metav1.TypeMeta{
53-
Kind: "ClusterRoleBinding",
54-
APIVersion: "rbac.authorization.k8s.io/v1",
55-
},
53+
// if dyConfig.IncludeNamespaces has more than 0 items in it
54+
// then, for each namespace create a rbac.RoleBinding in that namespace
55+
// AgentRBACManifests.RoleBindings = append(...)
56+
if len(dyConfig.IncludeNamespaces) != 0 {
57+
for _, ns := range dyConfig.IncludeNamespaces {
58+
AgentRBACManifests.RoleBindings = append(AgentRBACManifests.RoleBindings, rbac.RoleBinding{
59+
TypeMeta: metav1.TypeMeta{
60+
Kind: "RoleBinding",
61+
APIVersion: "rbac.authorization.k8s.io/v1",
62+
},
5663

57-
ObjectMeta: metav1.ObjectMeta{
58-
Name: metadataName,
59-
},
64+
ObjectMeta: metav1.ObjectMeta{
65+
Name: metadataName,
66+
Namespace: ns,
67+
},
6068

61-
Subjects: []rbac.Subject{
62-
{
63-
Kind: "ServiceAccount",
64-
Name: "agent",
65-
Namespace: "jetstack-secure",
69+
Subjects: []rbac.Subject{
70+
{
71+
Kind: "ServiceAccount",
72+
Name: "agent",
73+
Namespace: "jetstack-secure",
74+
},
75+
},
76+
77+
RoleRef: rbac.RoleRef{
78+
Kind: "ClusterRole",
79+
Name: metadataName,
80+
APIGroup: "rbac.authorization.k8s.io",
81+
},
82+
})
83+
}
84+
} else {
85+
// only do this if the dg does not have IncludeNamespaces set
86+
AgentRBACManifests.ClusterRoleBindings = append(AgentRBACManifests.ClusterRoleBindings, rbac.ClusterRoleBinding{
87+
TypeMeta: metav1.TypeMeta{
88+
Kind: "ClusterRoleBinding",
89+
APIVersion: "rbac.authorization.k8s.io/v1",
6690
},
67-
},
6891

69-
RoleRef: rbac.RoleRef{
70-
Kind: "ClusterRole",
71-
Name: metadataName,
72-
APIGroup: "rbac.authorization.k8s.io",
73-
},
74-
})
92+
ObjectMeta: metav1.ObjectMeta{
93+
Name: metadataName,
94+
},
95+
96+
Subjects: []rbac.Subject{
97+
{
98+
Kind: "ServiceAccount",
99+
Name: "agent",
100+
Namespace: "jetstack-secure",
101+
},
102+
},
103+
104+
RoleRef: rbac.RoleRef{
105+
Kind: "ClusterRole",
106+
Name: metadataName,
107+
APIGroup: "rbac.authorization.k8s.io",
108+
},
109+
})
110+
}
111+
75112
}
76113

77114
return AgentRBACManifests

‎pkg/permissions/generate_test.go

Lines changed: 83 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ func TestGenerateAgentRBACManifests(t *testing.T) {
1818
expectedAgentRBACManifests AgentRBACManifests
1919
}{
2020
{
21-
description: "Generate ClusterRole and ClusterRoleBinding for simple pod dg case",
21+
description: "Generate ClusterRole and ClusterRoleBinding for simple pod dg use case",
2222
dataGatherers: []agent.DataGatherer{
2323
{
2424
Name: "k8s/pods",
@@ -75,6 +75,88 @@ func TestGenerateAgentRBACManifests(t *testing.T) {
7575
},
7676
},
7777
},
78+
{
79+
description: "Generate RBAC config for simple pod dg use case where single namespace is set",
80+
dataGatherers: []agent.DataGatherer{
81+
{
82+
Name: "k8s/pods",
83+
Kind: "k8s-dynamic",
84+
Config: &k8s.ConfigDynamic{
85+
GroupVersionResource: schema.GroupVersionResource{
86+
Version: "v1",
87+
Resource: "pods",
88+
},
89+
IncludeNamespaces: []string{"example", "foobar"},
90+
},
91+
},
92+
},
93+
expectedAgentRBACManifests: AgentRBACManifests{
94+
ClusterRoles: []rbac.ClusterRole{
95+
{
96+
TypeMeta: metav1.TypeMeta{
97+
Kind: "ClusterRole",
98+
APIVersion: "rbac.authorization.k8s.io/v1",
99+
},
100+
ObjectMeta: metav1.ObjectMeta{
101+
Name: "jetstack-secure-agent-pods-reader",
102+
},
103+
Rules: []rbac.PolicyRule{
104+
{
105+
Verbs: []string{"get", "list", "watch"},
106+
APIGroups: []string{""},
107+
Resources: []string{"pods"},
108+
},
109+
},
110+
},
111+
},
112+
RoleBindings: []rbac.RoleBinding{
113+
{
114+
TypeMeta: metav1.TypeMeta{
115+
Kind: "RoleBinding",
116+
APIVersion: "rbac.authorization.k8s.io/v1",
117+
},
118+
ObjectMeta: metav1.ObjectMeta{
119+
Name: "jetstack-secure-agent-pods-reader",
120+
Namespace: "example",
121+
},
122+
Subjects: []rbac.Subject{
123+
{
124+
Kind: "ServiceAccount",
125+
Name: "agent",
126+
Namespace: "jetstack-secure",
127+
},
128+
},
129+
RoleRef: rbac.RoleRef{
130+
Kind: "ClusterRole",
131+
Name: "jetstack-secure-agent-pods-reader",
132+
APIGroup: "rbac.authorization.k8s.io",
133+
},
134+
},
135+
{
136+
TypeMeta: metav1.TypeMeta{
137+
Kind: "RoleBinding",
138+
APIVersion: "rbac.authorization.k8s.io/v1",
139+
},
140+
ObjectMeta: metav1.ObjectMeta{
141+
Name: "jetstack-secure-agent-pods-reader",
142+
Namespace: "foobar",
143+
},
144+
Subjects: []rbac.Subject{
145+
{
146+
Kind: "ServiceAccount",
147+
Name: "agent",
148+
Namespace: "jetstack-secure",
149+
},
150+
},
151+
RoleRef: rbac.RoleRef{
152+
Kind: "ClusterRole",
153+
Name: "jetstack-secure-agent-pods-reader",
154+
APIGroup: "rbac.authorization.k8s.io",
155+
},
156+
},
157+
},
158+
},
159+
},
78160
}
79161

80162
for _, input := range testCases {

0 commit comments

Comments
 (0)