-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement BillingEntity RBAC reconcile (#199)
- Loading branch information
Showing
9 changed files
with
343 additions
and
82 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package controllers | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| "go.uber.org/multierr" | ||
| "k8s.io/client-go/tools/record" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/log" | ||
|
|
||
| billingv1 "github.com/appuio/control-api/apis/billing/v1" | ||
| "github.com/appuio/control-api/pkg/billingrbac" | ||
| ) | ||
|
|
||
| // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=get;list;watch;create;delete;patch;update;edit | ||
| // +kubebuilder:rbac:groups=rbac.appuio.io;billing.appuio.io,resources=billingentities,verbs=* | ||
|
|
||
| // BillingEntityRBACCronJob periodically checks billing entities and sends notification emails if appropriate | ||
| type BillingEntityRBACCronJob struct { | ||
| client.Client | ||
| } | ||
|
|
||
| func NewBillingEntityRBACCronJob(client client.Client, eventRecorder record.EventRecorder) BillingEntityRBACCronJob { | ||
| return BillingEntityRBACCronJob{ | ||
| Client: client, | ||
| } | ||
| } | ||
|
|
||
| // Run lists all BillingEntity resources and sends notification emails if needed. | ||
| func (r *BillingEntityRBACCronJob) Run(ctx context.Context) error { | ||
| log := log.FromContext(ctx).WithName("BillingEntityRBACCronJob") | ||
| log.Info("Reconciling BillingEntity RBAC") | ||
|
|
||
| list := &billingv1.BillingEntityList{} | ||
| err := r.Client.List(ctx, list) | ||
| if err != nil { | ||
| return fmt.Errorf("could not list billing entities: %w", err) | ||
| } | ||
|
|
||
| var errors []error | ||
| for _, be := range list.Items { | ||
| log := log.WithValues("billingentity", be.Name) | ||
| err := r.reconcile(ctx, &be) | ||
| if err != nil { | ||
| log.Error(err, "could not reconcile billing entity") | ||
| errors = append(errors, err) | ||
| } | ||
| } | ||
| return multierr.Combine(errors...) | ||
| } | ||
|
|
||
| func (r *BillingEntityRBACCronJob) reconcile(ctx context.Context, be *billingv1.BillingEntity) error { | ||
| ar, arBinding, vr, vrBinding := billingrbac.ClusterRoles(be.Name, billingrbac.ClusterRolesParams{ | ||
| AllowSubjectsToViewRole: true, | ||
| }) | ||
|
|
||
| arErr := r.Client.Patch(ctx, ar, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| arBinding.Subjects = nil // we don't want to manage the subjects | ||
| arBindingErr := r.Client.Patch(ctx, arBinding, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| vrErr := r.Client.Patch(ctx, vr, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
| vrBinding.Subjects = nil // we don't want to manage the subjects | ||
| vrBindingErr := r.Client.Patch(ctx, vrBinding, client.Apply, client.ForceOwnership, client.FieldOwner("control-api")) | ||
|
|
||
| return multierr.Combine(arErr, arBindingErr, vrErr, vrBindingErr) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| package controllers_test | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
| rbacv1 "k8s.io/api/rbac/v1" | ||
| "k8s.io/apimachinery/pkg/types" | ||
|
|
||
| . "github.com/appuio/control-api/controllers" | ||
| ) | ||
|
|
||
| func Test_BillingEntityRBACCronJob_Run(t *testing.T) { | ||
| ctx := context.Background() | ||
|
|
||
| be := baseBillingEntity() | ||
| c := prepareTest(t, be) | ||
|
|
||
| subject := &BillingEntityRBACCronJob{ | ||
| Client: c, | ||
| } | ||
|
|
||
| require.NoError(t, subject.Run(ctx)) | ||
|
|
||
| var adminRole rbacv1.ClusterRole | ||
| var adminRoleBinding rbacv1.ClusterRoleBinding | ||
| adminRoleName := fmt.Sprintf("billingentities-%s-admin", be.Name) | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: adminRoleName}, &adminRole), "admin role should be created") | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: adminRoleName}, &adminRoleBinding), "admin role binding should be created") | ||
|
|
||
| var viewerRole rbacv1.ClusterRole | ||
| var viewerRoleBinding rbacv1.ClusterRoleBinding | ||
| viewerRoleName := fmt.Sprintf("billingentities-%s-viewer", be.Name) | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRole), "viewer role should be created") | ||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRoleBinding), "viewer role binding should be created") | ||
|
|
||
| testSubjects := []rbacv1.Subject{ | ||
| { | ||
| APIGroup: "rbac.authorization.k8s.io", | ||
| Kind: "User", | ||
| Name: "testuser", | ||
| }, | ||
| } | ||
| viewerRoleBinding.Subjects = testSubjects | ||
| require.NoError(t, c.Update(ctx, &viewerRoleBinding)) | ||
|
|
||
| require.NoError(t, subject.Run(ctx)) | ||
|
|
||
| require.NoError(t, c.Get(ctx, types.NamespacedName{Name: viewerRoleName}, &viewerRoleBinding)) | ||
| require.Equal(t, testSubjects, viewerRoleBinding.Subjects, "role bindings should not be changed") | ||
| } |
Oops, something went wrong.