Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return a list of namespaces that a user can access #1725

Closed
Tracked by #1723
jpellizzari opened this issue Mar 15, 2022 · 0 comments · Fixed by #1857
Closed
Tracked by #1723

Return a list of namespaces that a user can access #1725

jpellizzari opened this issue Mar 15, 2022 · 0 comments · Fixed by #1857
Assignees

Comments

@jpellizzari
Copy link
Contributor

jpellizzari commented Mar 15, 2022

Part of #1725

We want to show GitOps resources across namespaces. Given how RBAC works in kubernetes, we need to know which namespaces to query.

We determine "access" as a user who has these permissions in a given namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wego-admin-user-role
  namespace: {{.Values.namespace}}
rules:
  - apiGroups: [""]
    resources: ["secrets", "pods","events", "namespaces"]
    verbs: [ "get", "list" ]
  - apiGroups: ["apps"]
    resources: [ "deployments", "replicasets", "pods" ]
    verbs: [ "get", "list" ]
  - apiGroups: ["kustomize.toolkit.fluxcd.io"]
    resources: [ "kustomizations" ]
    verbs: [ "get", "list" ]
  - apiGroups: ["helm.toolkit.fluxcd.io"]
    resources: [ "helmreleases" ]
    verbs: [ "get", "list" ]
  - apiGroups: ["source.toolkit.fluxcd.io"]
    resources: [ "buckets", "helmcharts", "gitrepositories", "helmrepositories" ]
    verbs: [ "get", "list" ]

Acceptance Criteria:

  • Some function or interface needs to return a list of namespaces that represent "access" for a given user

Reference PoC PR: #1715

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant