Skip to content

Commit 58eede4

Browse files
marctuerkemarctuerke
authored
feat: added rbac rules for every service (#784)
1 parent 06f8841 commit 58eede4

13 files changed

Lines changed: 415 additions & 0 deletions

File tree

‎examples/cloud/dependency_charts/aas-environment/config/rbac-rules.json‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
[
2+
{
3+
"role": "basyx-reader",
4+
"action": "READ",
5+
"targetInformation": {
6+
"@type": "submodel",
7+
"submodelIds": "*",
8+
"submodelElementIdShortPaths": "*"
9+
}
10+
},
11+
{
12+
"role": "admin",
13+
"action": ["CREATE", "READ", "UPDATE", "DELETE", "EXECUTE"],
14+
"targetInformation": {
15+
"@type": "submodel",
16+
"submodelIds": "*",
17+
"submodelElementIdShortPaths": "*"
18+
}
19+
},
20+
{
21+
"role": "basyx-reader-two",
22+
"action": "READ",
23+
"targetInformation": {
24+
"@type": "submodel",
25+
"submodelIds": "specificSubmodelId",
26+
"submodelElementIdShortPaths": "*"
27+
}
28+
},
29+
{
30+
"role": "basyx-sme-reader",
31+
"action": "READ",
32+
"targetInformation": {
33+
"@type": "submodel",
34+
"submodelIds": ["specificSubmodelId", "testSMId1", "testSMId2"],
35+
"submodelElementIdShortPaths": ["testSMEIdShortPath1","smc2.specificSubmodelElementIdShort","testSMEIdShortPath2"]
36+
}
37+
},
38+
{
39+
"role": "basyx-sme-reader-two",
40+
"action": "READ",
41+
"targetInformation": {
42+
"@type": "submodel",
43+
"submodelIds": "specificSubmodelId",
44+
"submodelElementIdShortPaths": "smc2.specificFileSubmodelElementIdShort"
45+
}
46+
},
47+
{
48+
"role": "basyx-creator",
49+
"action": "CREATE",
50+
"targetInformation": {
51+
"@type": "submodel",
52+
"submodelIds": "*",
53+
"submodelElementIdShortPaths": "*"
54+
}
55+
},
56+
{
57+
"role": "basyx-updater",
58+
"action": "UPDATE",
59+
"targetInformation": {
60+
"@type": "submodel",
61+
"submodelIds": "*",
62+
"submodelElementIdShortPaths": "*"
63+
}
64+
},
65+
{
66+
"role": "basyx-updater-two",
67+
"action": "UPDATE",
68+
"targetInformation": {
69+
"@type": "submodel",
70+
"submodelIds": "specificSubmodelId",
71+
"submodelElementIdShortPaths": "*"
72+
}
73+
},
74+
{
75+
"role": "basyx-sme-updater",
76+
"action": "UPDATE",
77+
"targetInformation": {
78+
"@type": "submodel",
79+
"submodelIds": "specificSubmodelId",
80+
"submodelElementIdShortPaths": "smc2.specificFileSubmodelElementIdShort"
81+
}
82+
},
83+
{
84+
"role": "basyx-sme-updater-two",
85+
"action": "UPDATE",
86+
"targetInformation": {
87+
"@type": "submodel",
88+
"submodelIds": "specificSubmodelId",
89+
"submodelElementIdShortPaths": "smc2"
90+
}
91+
},
92+
{
93+
"role": "basyx-sme-updater-three",
94+
"action": "UPDATE",
95+
"targetInformation": {
96+
"@type": "submodel",
97+
"submodelIds": "specificSubmodelId-2",
98+
"submodelElementIdShortPaths": "smc1.specificSubmodelElementIdShort-2"
99+
}
100+
},
101+
{
102+
"role": "basyx-file-sme-updater",
103+
"action": "UPDATE",
104+
"targetInformation": {
105+
"@type": "submodel",
106+
"submodelIds": "specificSubmodelId-2",
107+
"submodelElementIdShortPaths": "smc2.specificFileSubmodelElementIdShort"
108+
}
109+
},
110+
{
111+
"role": "basyx-deleter",
112+
"action": "DELETE",
113+
"targetInformation": {
114+
"@type": "submodel",
115+
"submodelIds": "*",
116+
"submodelElementIdShortPaths": "*"
117+
}
118+
},
119+
{
120+
"role": "basyx-deleter-two",
121+
"action": "DELETE",
122+
"targetInformation": {
123+
"@type": "submodel",
124+
"submodelIds": "specificSubmodelId-2",
125+
"submodelElementIdShortPaths": "*"
126+
}
127+
},
128+
{
129+
"role": "basyx-executor",
130+
"action": "EXECUTE",
131+
"targetInformation": {
132+
"@type": "submodel",
133+
"submodelIds": "*",
134+
"submodelElementIdShortPaths": "*"
135+
}
136+
},
137+
{
138+
"role": "basyx-executor-two",
139+
"action": "EXECUTE",
140+
"targetInformation": {
141+
"@type": "submodel",
142+
"submodelIds": "specificSubmodelId",
143+
"submodelElementIdShortPaths": "square"
144+
}
145+
},
146+
{
147+
"role": "basyx-file-sme-reader",
148+
"action": "READ",
149+
"targetInformation": {
150+
"@type": "submodel",
151+
"submodelIds": "specificSubmodelId-2",
152+
"submodelElementIdShortPaths": "smc2.specificFileSubmodelElementIdShort"
153+
}
154+
}
155+
]

‎examples/cloud/dependency_charts/aas-environment/templates/aas-environment-deployment.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ spec:
2626
- name: {{ template "aas-environment.fullname" $ }}-config
2727
configMap:
2828
name: {{ template "aas-environment.fullname" $ }}-config
29+
- name: {{ template "aas-environment.fullname" $ }}-rbac-rules
30+
configMap:
31+
name: {{ template "aas-environment.fullname" $ }}-rbac-rules
2932
{{- with .Values.imagePullSecrets }}
3033
imagePullSecrets:
3134
{{- toYaml . | nindent 8 }}
@@ -62,6 +65,9 @@ spec:
6265
- mountPath: /application/application.properties
6366
name: {{ template "aas-environment.fullname" $ }}-config
6467
subPath: application.properties
68+
- mountPath: /application/rbac-rules.json
69+
name: {{ template "aas-discovery.fullname" $ }}-rbac-rules
70+
subPath: rbac-rules.json
6571
{{- if .Values.startup.enabled }}
6672
- mountPath: /application/aas
6773
name: startup

‎examples/cloud/dependency_charts/aas-environment/templates/aas-environment-rbac-rules.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if .Values.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "aas-environment.fullname" . }}-rbac-rules
6+
labels:
7+
{{- include "aas-environment.labels" . | nindent 4 }}
8+
data:
9+
rbac-rules.json: |-
10+
{{ .Files.Get "config/rbac-rules.json" | indent 4 }}
11+
{{ end -}}

‎examples/cloud/dependency_charts/aas-environment/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,9 @@ config: |
6464
mqtt.clientId=AAS-Env-Example-8081
6565
mqtt.hostname = mqtt
6666
mqtt.port = 1884
67+
68+
basyx.feature.authorization.enabled = true
69+
basyx.feature.authorization.type = rbac
70+
basyx.feature.authorization.jwtBearerTokenProvider = keycloak
71+
basyx.feature.authorization.rbac.file = file:/application/rbac_rules.json
72+
spring.security.oauth2.resourceserver.jwt.issuer-uri= http://keycloak.basyx.local:8080/realms/BaSyx

‎examples/cloud/dependency_charts/aas-registry/config/rbac-rules.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
[
2+
{
3+
"role": "basyx-reader",
4+
"action": "READ",
5+
"targetInformation": {
6+
"@type": "aas-registry",
7+
"aasIds": "*"
8+
}
9+
},
10+
{
11+
"role": "admin",
12+
"action": ["CREATE", "READ", "UPDATE", "DELETE"],
13+
"targetInformation": {
14+
"@type": "aas-registry",
15+
"aasIds": "*"
16+
}
17+
},
18+
{
19+
"role": "basyx-reader-two",
20+
"action": "READ",
21+
"targetInformation": {
22+
"@type": "aas-registry",
23+
"aasIds": "dummyShellId_3"
24+
}
25+
},
26+
{
27+
"role": "basyx-creator",
28+
"action": "CREATE",
29+
"targetInformation": {
30+
"@type": "aas-registry",
31+
"aasIds": "*"
32+
}
33+
},
34+
{
35+
"role": "basyx-updater",
36+
"action": "UPDATE",
37+
"targetInformation": {
38+
"@type": "aas-registry",
39+
"aasIds": "*"
40+
}
41+
},
42+
{
43+
"role": "basyx-updater-two",
44+
"action": "UPDATE",
45+
"targetInformation": {
46+
"@type": "aas-registry",
47+
"aasIds": "dummyShellId_3"
48+
}
49+
},
50+
{
51+
"role": "basyx-asset-updater",
52+
"action": "UPDATE",
53+
"targetInformation": {
54+
"@type": "aas-registry",
55+
"aasIds": "*"
56+
}
57+
},
58+
{
59+
"role": "basyx-asset-updater-two",
60+
"action": "UPDATE",
61+
"targetInformation": {
62+
"@type": "aas-registry",
63+
"aasIds": "specificAasId-2"
64+
}
65+
},
66+
{
67+
"role": "basyx-deleter",
68+
"action": "DELETE",
69+
"targetInformation": {
70+
"@type": "aas-registry",
71+
"aasIds": "*"
72+
}
73+
},
74+
{
75+
"role": "basyx-deleter-two",
76+
"action": "DELETE",
77+
"targetInformation": {
78+
"@type": "aas-registry",
79+
"aasIds": "specificAasId-2"
80+
}
81+
}
82+
]

‎examples/cloud/dependency_charts/aas-registry/templates/aas-registry-deployment.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,13 @@ spec:
4545
- mountPath: /workspace/config/application.properties
4646
name: {{ template "aas-registry.fullname" $ }}-config
4747
subPath: application.properties
48+
- mountPath: /application/rbac-rules.json
49+
name: {{ template "aas-registry.fullname" $ }}-rbac-rules
50+
subPath: rbac-rules.json
4851
volumes:
4952
- name: {{ template "aas-registry.fullname" $ }}-config
5053
configMap:
5154
name: {{ template "aas-registry.fullname" $ }}-config
55+
- name: {{ template "aas-registry.fullname" $ }}-rbac-rules
56+
configMap:
57+
name: {{ template "aas-registry.fullname" $ }}-rbac-rules

‎examples/cloud/dependency_charts/aas-registry/templates/aas-registry-rbac-rules.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if .Values.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "aas-registry.fullname" . }}-rbac-rules
6+
labels:
7+
{{- include "aas-registry.labels" . | nindent 4 }}
8+
data:
9+
rbac-rules.json: |-
10+
{{ .Files.Get "config/rbac-rules.json" | indent 4 }}
11+
{{ end -}}

‎examples/cloud/dependency_charts/aas-registry/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,9 @@ config: |
6565
basyx.cors.allowed-origins="*"
6666
basyx.cors.allowed-methods="GET,POST,PATCH,DELETE,PUT,OPTIONS,HEAD"
6767
68+
basyx.feature.authorization.enabled = true
69+
basyx.feature.authorization.type = rbac
70+
basyx.feature.authorization.jwtBearerTokenProvider = keycloak
71+
basyx.feature.authorization.rbac.file = file:/application/rbac_rules.json
72+
spring.security.oauth2.resourceserver.jwt.issuer-uri= http://keycloak.basyx.local:8080/realms/BaSyx
73+

0 commit comments

Comments
 (0)