-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement BillingEntity RBAC reconcile
Used a cron job since we never implemented watch for BEs.
- Loading branch information
Showing
7 changed files
with
323 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package controllers | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| "go.uber.org/multierr" | ||
| "k8s.io/client-go/tools/record" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/log" | ||
|
|
||
| billingv1 "github.com/appuio/control-api/apis/billing/v1" | ||
| "github.com/appuio/control-api/pkg/billingrbac" | ||
| ) | ||
|
|
||
| // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=get;list;watch;create;delete;patch;update;edit | ||
| // +kubebuilder:rbac:groups=rbac.appuio.io;billing.appuio.io,resources=billingentities,verbs=* | ||
|
|
||
| // BillingEntityRBACCronJob periodically checks billing entities and sends notification emails if appropriate | ||
| type BillingEntityRBACCronJob struct { | ||
| client.Client | ||
| } | ||
|
|
||
| func NewBillingEntityRBACCronJob(client client.Client, eventRecorder record.EventRecorder) BillingEntityRBACCronJob { | ||
| return BillingEntityRBACCronJob{ | ||
| Client: client, | ||
| } | ||
| } | ||
|
|
||
| // Run lists all BillingEntity resources and sends notification emails if needed. | ||
| func (r *BillingEntityRBACCronJob) Run(ctx context.Context) error { | ||
| log := log.FromContext(ctx).WithName("BillingEntityRBACCronJob") | ||
| log.Info("Reconciling BillingEntity RBAC") | ||
|
|
||
| list := &billingv1.BillingEntityList{} | ||
| err := r.Client.List(ctx, list) | ||
| if err != nil { | ||
| return fmt.Errorf("could not list billing entities: %w", err) | ||
| } | ||
|
|
||
| var errors []error | ||
| for _, be := range list.Items { | ||
| log := log.WithValues("billingentity", be.Name) | ||
| err := r.reconcile(ctx, &be) | ||
| if err != nil { | ||
| log.Error(err, "could not reconcile billing entity") | ||
| errors = append(errors, err) | ||
| } | ||
| } | ||
| return multierr.Combine(errors...) | ||
| } | ||
|
|
||
| func (r *BillingEntityRBACCronJob) reconcile(ctx context.Context, be *billingv1.BillingEntity) error { | ||
| ar, arBinding, vr, vrBinding := billingrbac.ClusterRoles(be.Name, billingrbac.ClusterRolesParams{ | ||
| AllowSubjectsToViewRole: true, | ||
| }) | ||
|
|
||
| arErr := r.Client.Patch(ctx, ar, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| arBinding.Subjects = nil // we don't want to manage the subjects | ||
| arBindingErr := r.Client.Patch(ctx, arBinding, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| vrErr := r.Client.Patch(ctx, vr, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| vrBinding.Subjects = nil // we don't want to manage the subjects | ||
| vrBindingErr := r.Client.Patch(ctx, vrBinding, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
|
|
||
| return multierr.Combine(arErr, arBindingErr, vrErr, vrBindingErr) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| package controllers_test | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
| rbacv1 "k8s.io/api/rbac/v1" | ||
| "k8s.io/apimachinery/pkg/types" | ||
|
|
||
| . "github.com/appuio/control-api/controllers" | ||
| ) | ||
|
|
||
| func Test_BillingEntityRBACCronJob_Run(t *testing.T) { | ||
| ctx := context.Background() | ||
|
|
||
| be := baseBillingEntity() | ||
| c := prepareTest(t, be) | ||
|
|
||
| subject := &BillingEntityRBACCronJob{ | ||
| Client: c, | ||
| } | ||
|
|
||
| require.NoError(t, subject.Run(ctx)) | ||
|
|
||
| var adminRole rbacv1.ClusterRole | ||
| var adminRoleBinding rbacv1.ClusterRoleBinding | ||
| adminRoleName := fmt.Sprintf("billingentities-%s-admin", be.Name) | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: adminRoleName}, &adminRole), "admin role should be created") | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: adminRoleName}, &adminRoleBinding), "admin role binding should be created") | ||
|
|
||
| var viewerRole rbacv1.ClusterRole | ||
| var viewerRoleBinding rbacv1.ClusterRoleBinding | ||
| viewerRoleName := fmt.Sprintf("billingentities-%s-viewer", be.Name) | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRole), "viewer role should be created") | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRoleBinding), "viewer role binding should be created") | ||
|
|
||
| testSubjects := []rbacv1.Subject{ | ||
| { | ||
| APIGroup: "rbac.authorization.k8s.io", | ||
| Kind: "User", | ||
| Name: "testuser", | ||
| }, | ||
| } | ||
| viewerRoleBinding.Subjects = testSubjects | ||
| require.NoError(t, c.Update(ctx, &viewerRoleBinding)) | ||
|
|
||
| require.NoError(t, subject.Run(ctx)) | ||
|
|
||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRoleBinding)) | ||
| require.Equal(t, testSubjects, viewerRoleBinding.Subjects, "role bindings should not be changed") | ||
| } |
Oops, something went wrong.