Skip to content

Commit b3d22a3

Browse files
supreme-gg-ggsupreme-gg-gg
authored
feat(helm): support namespaced RBAC for tools (#53)
* namespaced rbac Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io> * oops forgot i renamed it Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io> --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
1 parent 9125aee commit b3d22a3

4 files changed

Lines changed: 204 additions & 76 deletions

File tree

‎helm/kagent-tools/templates/clusterrole.yaml‎

Lines changed: 99 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,95 +1,118 @@
1-
{{- if and (not .Values.useDefaultServiceAccount) .Values.rbac.create }}
1+
{{- define "kagent-tools.rules" -}}
22
{{- if .Values.rbac.readOnly }}
3-
apiVersion: rbac.authorization.k8s.io/v1
4-
kind: ClusterRole
5-
metadata:
6-
name: {{ include "kagent-tools.fullname" . }}-read-role
7-
labels:
8-
{{- include "kagent-tools.labels" . | nindent 4 }}
9-
rules:
10-
# Core workload resources
11-
- apiGroups: [""]
12-
resources:
13-
- pods
14-
- services
15-
- endpoints
16-
- configmaps
17-
- serviceaccounts
18-
- persistentvolumeclaims
19-
- replicationcontrollers
20-
- namespaces
21-
verbs: ["get", "list", "watch"]
3+
# Core workload resources
4+
- apiGroups: [""]
5+
resources:
6+
- pods
7+
- services
8+
- endpoints
9+
- configmaps
10+
- serviceaccounts
11+
- persistentvolumeclaims
12+
- replicationcontrollers
13+
- namespaces
14+
verbs: ["get", "list", "watch"]
2215

23-
# Pod logs (subresource)
24-
- apiGroups: [""]
25-
resources:
26-
- pods/log
27-
verbs: ["get", "list"]
16+
# Pod logs (subresource)
17+
- apiGroups: [""]
18+
resources:
19+
- pods/log
20+
verbs: ["get", "list"]
2821

29-
# Events
30-
- apiGroups: [""]
31-
resources:
32-
- events
33-
verbs: ["get", "list", "watch"]
34-
- apiGroups: ["events.k8s.io"]
35-
resources:
36-
- events
37-
verbs: ["get", "list", "watch"]
22+
# Events
23+
- apiGroups: [""]
24+
resources:
25+
- events
26+
verbs: ["get", "list", "watch"]
27+
- apiGroups: ["events.k8s.io"]
28+
resources:
29+
- events
30+
verbs: ["get", "list", "watch"]
3831

39-
# Apps workloads
40-
- apiGroups: ["apps"]
41-
resources:
42-
- deployments
43-
- statefulsets
44-
- daemonsets
45-
- replicasets
46-
verbs: ["get", "list", "watch"]
32+
# Apps workloads
33+
- apiGroups: ["apps"]
34+
resources:
35+
- deployments
36+
- statefulsets
37+
- daemonsets
38+
- replicasets
39+
verbs: ["get", "list", "watch"]
4740

48-
# Batch workloads
49-
- apiGroups: ["batch"]
50-
resources:
51-
- jobs
52-
- cronjobs
53-
verbs: ["get", "list", "watch"]
41+
# Batch workloads
42+
- apiGroups: ["batch"]
43+
resources:
44+
- jobs
45+
- cronjobs
46+
verbs: ["get", "list", "watch"]
5447

55-
# Networking
56-
- apiGroups: ["networking.k8s.io"]
57-
resources:
58-
- ingresses
59-
- networkpolicies
60-
verbs: ["get", "list", "watch"]
48+
# Networking
49+
- apiGroups: ["networking.k8s.io"]
50+
resources:
51+
- ingresses
52+
- networkpolicies
53+
verbs: ["get", "list", "watch"]
6154

62-
# Autoscaling
63-
- apiGroups: ["autoscaling"]
64-
resources:
65-
- horizontalpodautoscalers
66-
verbs: ["get", "list", "watch"]
67-
68-
{{- if .Values.rbac.allowSecrets }}
69-
# Secrets (opt-in)
70-
- apiGroups: [""]
71-
resources:
72-
- secrets
73-
verbs: ["get", "list", "watch"]
74-
{{- end }}
55+
# Autoscaling
56+
- apiGroups: ["autoscaling"]
57+
resources:
58+
- horizontalpodautoscalers
59+
verbs: ["get", "list", "watch"]
7560

76-
{{- with .Values.rbac.additionalRules }}
77-
# Additional user-defined rules
78-
{{- toYaml . | nindent 2 }}
79-
{{- end }}
61+
{{- if .Values.rbac.allowSecrets }}
62+
# Secrets (opt-in)
63+
- apiGroups: [""]
64+
resources:
65+
- secrets
66+
verbs: ["get", "list", "watch"]
67+
{{- end }}
8068

69+
{{- with .Values.rbac.additionalRules }}
70+
# Additional user-defined rules
71+
{{- toYaml . | nindent 0 }}
72+
{{- end }}
8173
{{- else }}
74+
- apiGroups: ["*"]
75+
resources: ["*"]
76+
verbs: ["*"]
77+
{{- if .Values.rbac.clusterScoped }}
78+
- nonResourceURLs: ["*"]
79+
verbs: ["*"]
80+
{{- end }}
81+
{{- end }}
82+
{{- end -}}
83+
84+
{{- if and (not .Values.useDefaultServiceAccount) .Values.rbac.create }}
85+
{{- if .Values.rbac.clusterScoped }}
8286
apiVersion: rbac.authorization.k8s.io/v1
8387
kind: ClusterRole
8488
metadata:
89+
{{- if .Values.rbac.readOnly }}
90+
name: {{ include "kagent-tools.fullname" . }}-read-role
91+
{{- else }}
8592
name: {{ include "kagent-tools.fullname" . }}-cluster-admin-role
93+
{{- end }}
8694
labels:
8795
{{- include "kagent-tools.labels" . | nindent 4 }}
8896
rules:
89-
- apiGroups: ["*"]
90-
resources: ["*"]
91-
verbs: ["*"]
92-
- nonResourceURLs: ["*"]
93-
verbs: ["*"]
97+
{{- include "kagent-tools.rules" . | nindent 2 }}
98+
99+
{{- else }}
100+
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kagent-tools.namespace" .)) }}
101+
{{- range $namespace := $namespaces }}
102+
---
103+
apiVersion: rbac.authorization.k8s.io/v1
104+
kind: Role
105+
metadata:
106+
{{- if $.Values.rbac.readOnly }}
107+
name: {{ include "kagent-tools.fullname" $ }}-read-role
108+
{{- else }}
109+
name: {{ include "kagent-tools.fullname" $ }}-cluster-admin-role
110+
{{- end }}
111+
namespace: {{ $namespace }}
112+
labels:
113+
{{- include "kagent-tools.labels" $ | nindent 4 }}
114+
rules:
115+
{{- include "kagent-tools.rules" $ | nindent 2 }}
116+
{{- end }}
94117
{{- end }}
95118
{{- end }}

‎helm/kagent-tools/templates/clusterrolebinding.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
{{- if and (not .Values.useDefaultServiceAccount) .Values.rbac.create }}
2+
3+
{{- if .Values.rbac.clusterScoped }}
24
apiVersion: rbac.authorization.k8s.io/v1
35
kind: ClusterRoleBinding
46
metadata:
@@ -21,4 +23,35 @@ subjects:
2123
- kind: ServiceAccount
2224
name: {{ include "kagent-tools.fullname" . }}
2325
namespace: {{ include "kagent-tools.namespace" . }}
26+
27+
{{- else }}
28+
{{- $namespaces := .Values.rbac.namespaces | default (list (include "kagent-tools.namespace" .)) }}
29+
{{- range $namespace := $namespaces }}
30+
---
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: RoleBinding
33+
metadata:
34+
{{- if $.Values.rbac.readOnly }}
35+
name: {{ include "kagent-tools.fullname" $ }}-read-rolebinding
36+
{{- else }}
37+
name: {{ include "kagent-tools.fullname" $ }}-cluster-admin-rolebinding
38+
{{- end }}
39+
namespace: {{ $namespace }}
40+
labels:
41+
{{- include "kagent-tools.labels" $ | nindent 4 }}
42+
roleRef:
43+
apiGroup: rbac.authorization.k8s.io
44+
kind: Role
45+
{{- if $.Values.rbac.readOnly }}
46+
name: {{ include "kagent-tools.fullname" $ }}-read-role
47+
{{- else }}
48+
name: {{ include "kagent-tools.fullname" $ }}-cluster-admin-role
49+
{{- end }}
50+
subjects:
51+
- kind: ServiceAccount
52+
name: {{ include "kagent-tools.fullname" $ }}
53+
namespace: {{ include "kagent-tools.namespace" $ }}
54+
{{- end }}
55+
{{- end }}
56+
2457
{{- end }}

‎helm/kagent-tools/tests/rbac_test.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
suite: test rbac
2+
templates:
3+
- clusterrole.yaml
4+
- clusterrolebinding.yaml
5+
tests:
6+
- it: should render clusterroles by default
7+
asserts:
8+
- isKind:
9+
of: ClusterRole
10+
template: clusterrole.yaml
11+
- isKind:
12+
of: ClusterRoleBinding
13+
template: clusterrolebinding.yaml
14+
15+
- it: should render Roles when clusterScoped is false
16+
set:
17+
rbac.clusterScoped: false
18+
asserts:
19+
- isKind:
20+
of: Role
21+
template: clusterrole.yaml
22+
- isKind:
23+
of: RoleBinding
24+
template: clusterrolebinding.yaml
25+
- equal:
26+
path: metadata.namespace
27+
value: NAMESPACE
28+
template: clusterrole.yaml
29+
- equal:
30+
path: metadata.namespace
31+
value: NAMESPACE
32+
template: clusterrolebinding.yaml
33+
34+
- it: should render multiple roles and bindings when namespaces are specified and clusterScoped is false
35+
set:
36+
rbac.clusterScoped: false
37+
rbac.namespaces:
38+
- ns1
39+
- ns2
40+
asserts:
41+
- hasDocuments:
42+
count: 2
43+
template: clusterrole.yaml
44+
- equal:
45+
path: metadata.namespace
46+
value: ns1
47+
template: clusterrole.yaml
48+
documentIndex: 0
49+
- equal:
50+
path: metadata.namespace
51+
value: ns2
52+
template: clusterrole.yaml
53+
documentIndex: 1
54+
- hasDocuments:
55+
count: 2
56+
template: clusterrolebinding.yaml
57+
- equal:
58+
path: metadata.namespace
59+
value: ns1
60+
template: clusterrolebinding.yaml
61+
documentIndex: 0
62+
- equal:
63+
path: metadata.namespace
64+
value: ns2
65+
template: clusterrolebinding.yaml
66+
documentIndex: 1

‎helm/kagent-tools/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,12 @@ rbac:
104104
# When false, no ClusterRole or ClusterRoleBinding are created.
105105
# The ServiceAccount is still created allowing you to attach your own roles externally.
106106
create: true
107+
# -- If true, creates ClusterRole and ClusterRoleBinding resources.
108+
# If false, creates Role and RoleBinding resources instead.
109+
clusterScoped: true
110+
# -- When clusterScoped is false, specify additional namespaces to create Roles and RoleBindings in.
111+
# If empty, defaults to the release namespace.
112+
namespaces: []
107113
# When true, deploys a read-only ClusterRole (get, list, watch) instead of cluster-admin.
108114
# Pairs well with the --read-only CLI flag which disables write operations at the application layer.
109115
# Only applies when rbac.create is true.

0 commit comments

Comments
 (0)