Skip to content

Commit cc09450

Browse files
kvapskvaps
committed
Refactor tenant RBAC rules
Signed-off-by: Andrei Kvapil <[email protected]>
1 parent e44bece commit cc09450

3 files changed

Lines changed: 95 additions & 115 deletions

File tree

‎packages/apps/tenant/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ description: Separated tenant namespace
44
icon: /logos/tenant.svg
55

66
type: application
7-
version: 1.6.2
7+
version: 1.6.3

‎packages/apps/tenant/templates/tenant.yaml‎

Lines changed: 92 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ metadata:
1414
kubernetes.io/service-account.name: {{ include "tenant.name" . }}
1515
type: kubernetes.io/service-account-token
1616
---
17+
# == default role ==
18+
---
1719
apiVersion: rbac.authorization.k8s.io/v1
1820
kind: Role
1921
metadata:
@@ -62,18 +64,7 @@ roleRef:
6264
name: {{ include "tenant.name" . }}
6365
apiGroup: rbac.authorization.k8s.io
6466
---
65-
apiVersion: rbac.authorization.k8s.io/v1
66-
kind: Role
67-
metadata:
68-
name: {{ include "tenant.name" . }}
69-
namespace: cozy-public
70-
rules:
71-
- apiGroups: ["source.toolkit.fluxcd.io"]
72-
resources: ["helmrepositories"]
73-
verbs: ["get", "list"]
74-
- apiGroups: ["source.toolkit.fluxcd.io"]
75-
resources: ["helmcharts"]
76-
verbs: ["*"]
67+
# == view role ==
7768
---
7869
kind: Role
7970
apiVersion: rbac.authorization.k8s.io/v1
@@ -119,22 +110,35 @@ rules:
119110
- get
120111
- list
121112
- watch
122-
123113
---
124-
125114
kind: RoleBinding
126115
apiVersion: rbac.authorization.k8s.io/v1
127116
metadata:
128117
name: {{ include "tenant.name" . }}-view
129118
namespace: {{ include "tenant.name" . }}
130119
subjects:
131-
- kind: Group
132-
name: {{ include "tenant.name" . }}-view
133-
apiGroup: rbac.authorization.k8s.io
120+
{{- if ne .Release.Namespace "tenant-root" }}
121+
- kind: Group
122+
name: tenant-root-view
123+
apiGroup: rbac.authorization.k8s.io
124+
{{- end }}
125+
{{- if hasPrefix "tenant-" .Release.Namespace }}
126+
{{- $parts := splitList "-" .Release.Namespace }}
127+
{{- range $i, $v := $parts }}
128+
{{- if ne $i 0 }}
129+
- kind: Group
130+
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-view
131+
apiGroup: rbac.authorization.k8s.io
132+
{{- end }}
133+
{{- end }}
134+
{{- end }}
134135
roleRef:
135136
kind: Role
136137
name: {{ include "tenant.name" . }}-view
137138
apiGroup: rbac.authorization.k8s.io
139+
140+
---
141+
# == use role ==
138142
---
139143
kind: Role
140144
apiVersion: rbac.authorization.k8s.io/v1
@@ -189,14 +193,28 @@ metadata:
189193
name: {{ include "tenant.name" . }}-use
190194
namespace: {{ include "tenant.name" . }}
191195
subjects:
192-
- kind: Group
193-
name: {{ include "tenant.name" . }}-use
194-
apiGroup: rbac.authorization.k8s.io
196+
{{- if ne .Release.Namespace "tenant-root" }}
197+
- kind: Group
198+
name: tenant-root-use
199+
apiGroup: rbac.authorization.k8s.io
200+
{{- end }}
201+
{{- if hasPrefix "tenant-" .Release.Namespace }}
202+
{{- $parts := splitList "-" .Release.Namespace }}
203+
{{- range $i, $v := $parts }}
204+
{{- if ne $i 0 }}
205+
- kind: Group
206+
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-use
207+
apiGroup: rbac.authorization.k8s.io
208+
{{- end }}
209+
{{- end }}
210+
{{- end }}
195211
roleRef:
196212
kind: Role
197213
name: {{ include "tenant.name" . }}-use
198214
apiGroup: rbac.authorization.k8s.io
199215
---
216+
# == admin role ==
217+
---
200218
kind: Role
201219
apiVersion: rbac.authorization.k8s.io/v1
202220
metadata:
@@ -263,79 +281,35 @@ rules:
263281
- update
264282
- patch
265283
- delete
266-
267-
268-
---
269-
apiVersion: rbac.authorization.k8s.io/v1
270-
kind: Role
271-
metadata:
272-
name: {{ include "tenant.name" . }}-admin
273-
namespace: cozy-public
274-
rules:
275-
- apiGroups: ["source.toolkit.fluxcd.io"]
276-
resources: ["helmrepositories"]
277-
verbs:
278-
- get
279-
- list
280-
- apiGroups:
281-
- source.toolkit.fluxcd.io
282-
resources:
283-
- helmcharts
284-
verbs:
285-
- get
286-
- list
287-
- apiGroups: ["source.toolkit.fluxcd.io"]
288-
resources:
289-
- helmcharts
290-
verbs: ["*"]
291-
resourceNames:
292-
- bucket
293-
- clickhouse
294-
- ferretdb
295-
- foo
296-
- httpcache
297-
- kafka
298-
- kubernetes
299-
- mysql
300-
- nats
301-
- postgres
302-
- rabbitmq
303-
- redis
304-
- seaweedfs
305-
- tcpbalancer
306-
- virtualmachine
307-
- vmdisk
308-
- vminstance
309-
310284
---
311-
apiVersion: rbac.authorization.k8s.io/v1
312285
kind: RoleBinding
286+
apiVersion: rbac.authorization.k8s.io/v1
313287
metadata:
314288
name: {{ include "tenant.name" . }}-admin
315-
namespace: cozy-public
289+
namespace: {{ include "tenant.name" . }}
316290
subjects:
291+
{{- if ne .Release.Namespace "tenant-root" }}
317292
- kind: Group
318-
name: {{ include "tenant.name" . }}-admin
293+
name: tenant-root-admin
319294
apiGroup: rbac.authorization.k8s.io
320-
roleRef:
321-
kind: Role
322-
name: {{ include "tenant.name" . }}-admin
295+
{{- end }}
296+
{{- if hasPrefix "tenant-" .Release.Namespace }}
297+
{{- $parts := splitList "-" .Release.Namespace }}
298+
{{- range $i, $v := $parts }}
299+
{{- if ne $i 0 }}
300+
- kind: Group
301+
name: {{ join "-" (slice $parts 0 (add $i 1)) }}-admin
323302
apiGroup: rbac.authorization.k8s.io
324-
---
325-
kind: RoleBinding
326-
apiVersion: rbac.authorization.k8s.io/v1
327-
metadata:
328-
name: {{ include "tenant.name" . }}-admin
329-
namespace: {{ include "tenant.name" . }}
330-
subjects:
331-
- kind: Group
332-
name: {{ include "tenant.name" . }}-admin
333-
apiGroup: rbac.authorization.k8s.io
303+
{{- end }}
304+
{{- end }}
305+
{{- end }}
334306
roleRef:
335307
kind: Role
336308
name: {{ include "tenant.name" . }}-admin
337309
apiGroup: rbac.authorization.k8s.io
338310
---
311+
# == super admin role ==
312+
---
339313
kind: Role
340314
apiVersion: rbac.authorization.k8s.io/v1
341315
metadata:
@@ -377,45 +351,18 @@ rules:
377351
- '*'
378352
verbs:
379353
- '*'
380-
381-
382-
---
383-
apiVersion: rbac.authorization.k8s.io/v1
384-
kind: Role
385-
metadata:
386-
name: {{ include "tenant.name" . }}-super-admin
387-
namespace: cozy-public
388-
rules:
389-
- apiGroups: ["source.toolkit.fluxcd.io"]
390-
resources: ["helmrepositories"]
391-
verbs:
392-
- get
393-
- list
394-
- apiGroups: ["source.toolkit.fluxcd.io"]
395-
resources:
396-
- helmcharts
397-
verbs: ["*"]
398-
---
399-
apiVersion: rbac.authorization.k8s.io/v1
400-
kind: RoleBinding
401-
metadata:
402-
name: {{ include "tenant.name" . }}-super-admin
403-
namespace: cozy-public
404-
subjects:
405-
- kind: Group
406-
name: {{ include "tenant.name" . }}-super-admin
407-
apiGroup: rbac.authorization.k8s.io
408-
roleRef:
409-
kind: Role
410-
name: {{ include "tenant.name" . }}-super-admin
411-
apiGroup: rbac.authorization.k8s.io
412354
---
413355
kind: RoleBinding
414356
apiVersion: rbac.authorization.k8s.io/v1
415357
metadata:
416358
name: {{ include "tenant.name" . }}-super-admin
417359
namespace: {{ include "tenant.name" . }}
418360
subjects:
361+
{{- if ne .Release.Namespace "tenant-root" }}
362+
- kind: Group
363+
name: tenant-root-super-admin
364+
apiGroup: rbac.authorization.k8s.io
365+
{{- end }}
419366
{{- if hasPrefix "tenant-" .Release.Namespace }}
420367
{{- $parts := splitList "-" .Release.Namespace }}
421368
{{- range $i, $v := $parts }}
@@ -426,10 +373,42 @@ subjects:
426373
{{- end }}
427374
{{- end }}
428375
{{- end }}
376+
roleRef:
377+
kind: Role
378+
name: {{ include "tenant.name" . }}-super-admin
379+
apiGroup: rbac.authorization.k8s.io
380+
---
381+
# == dashboard role ==
382+
---
383+
apiVersion: rbac.authorization.k8s.io/v1
384+
kind: Role
385+
metadata:
386+
name: {{ include "tenant.name" . }}
387+
namespace: cozy-public
388+
rules:
389+
- apiGroups: ["source.toolkit.fluxcd.io"]
390+
resources: ["helmrepositories"]
391+
verbs: ["get", "list"]
392+
- apiGroups: ["source.toolkit.fluxcd.io"]
393+
resources: ["helmcharts"]
394+
verbs: ["get", "list"]
395+
---
396+
apiVersion: rbac.authorization.k8s.io/v1
397+
kind: RoleBinding
398+
metadata:
399+
name: {{ include "tenant.name" . }}
400+
namespace: cozy-public
401+
subjects:
429402
- kind: Group
430403
name: {{ include "tenant.name" . }}-super-admin
431404
apiGroup: rbac.authorization.k8s.io
405+
- kind: Group
406+
name: {{ include "tenant.name" . }}-admin
407+
apiGroup: rbac.authorization.k8s.io
408+
- kind: ServiceAccount
409+
name: {{ include "tenant.name" . }}
410+
namespace: {{ include "tenant.name" . }}
432411
roleRef:
433412
kind: Role
434-
name: {{ include "tenant.name" . }}-super-admin
413+
name: {{ include "tenant.name" . }}
435414
apiGroup: rbac.authorization.k8s.io

‎packages/apps/versions_map‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,8 @@ tenant 1.4.0 94c688f7
9191
tenant 1.5.0 48128743
9292
tenant 1.6.0 df448b99
9393
tenant 1.6.1 edbbb9be
94-
tenant 1.6.2 HEAD
94+
tenant 1.6.2 ccedc5fe
95+
tenant 1.6.3 HEAD
9596
virtual-machine 0.1.4 f2015d6
9697
virtual-machine 0.1.5 7cd7de7
9798
virtual-machine 0.2.0 5ca8823

0 commit comments

Comments
 (0)