@@ -78,6 +78,141 @@ if ! oc adm policy add-cluster-role-to-user self-provisioner system:serviceaccou
7878 exit 1
7979fi
8080
81+ # Create a new role 'edit-atlassian-team' without secret-related resources access
82+ if ! oc get clusterrole edit-atlassian-team > /dev/null 2>&1 ; then
83+ echo " You might not have enough rights to create the new role 'edit-atlassian-team'."
84+ echo " This script needs to be run by a cluster admin."
85+
86+ # Create a temporary file
87+ TEMP_FILE=$( mktemp 2> /dev/null || echo " /tmp/tempfile_$$ " )
88+
89+ # Get the edit role YAML and rename it
90+ oc get clusterrole edit -o yaml | sed ' s/name: edit/name: edit-atlassian-team/' > $TEMP_FILE
91+
92+ # Process the YAML to remove secret-related resources, empty sections, and metadata fields
93+ PROCESSED_FILE=$( mktemp 2> /dev/null || echo " /tmp/tempfile_$$ " )
94+
95+ awk '
96+ BEGIN {
97+ skip_current_group = 0;
98+ inside_api_group = 0;
99+ api_group_buffer = "";
100+ skip_section = 0;
101+ in_metadata = 0;
102+ contains_secret = 0;
103+ }
104+
105+ # Skip metadata fields and sections
106+ /creationTimestamp:/ || /resourceVersion:/ || /uid:/ {
107+ next;
108+ }
109+
110+ # Detect start of aggregationRule section and skip it
111+ /^aggregationRule:/ {
112+ skip_section = 1;
113+ next;
114+ }
115+
116+ # Detect end of aggregationRule section (when we see apiVersion)
117+ /^apiVersion:/ {
118+ skip_section = 0;
119+ print $0;
120+ next;
121+ }
122+
123+ # Track if we are in metadata section
124+ /^metadata:/ {
125+ in_metadata = 1;
126+ print $0;
127+ next;
128+ }
129+
130+ # Detect start of annotations or labels in metadata and skip them
131+ /^ annotations:/ || /^ labels:/ {
132+ if (in_metadata) {
133+ skip_section = 1;
134+ next;
135+ }
136+ }
137+
138+ # Detect when we leave annotations or labels section (any line with single indent level)
139+ /^ [a-zA-Z]/ {
140+ if (skip_section && in_metadata && $0 !~ /^ annotations:/ && $0 !~ /^ labels:/) {
141+ skip_section = 0;
142+ }
143+ }
144+
145+ # Detect end of metadata section
146+ /^[a-zA-Z]/ && in_metadata && $0 !~ /^metadata:/ {
147+ in_metadata = 0;
148+ }
149+
150+ # Skip lines while in a section we want to skip
151+ {
152+ if (skip_section) {
153+ next;
154+ }
155+ }
156+
157+ # Detect API Groups line
158+ /^- apiGroups:/ {
159+ # If we were previously in an API group, print it if it wasnt being skipped and has no secrets
160+ if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
161+ print api_group_buffer;
162+ }
163+
164+ # Reset variables for new group
165+ inside_api_group = 1;
166+ api_group_buffer = $0;
167+ skip_current_group = 0;
168+ contains_secret = 0;
169+
170+ # Check if this apiGroup itself contains "secret"
171+ if ($0 ~ /secret/ || $0 ~ /external-secrets\.io/) {
172+ skip_current_group = 1;
173+ }
174+ next;
175+ }
176+
177+ # Look for resources section that might contain secrets
178+ /^ resources:/ {
179+ api_group_buffer = api_group_buffer "\n" $0;
180+ next;
181+ }
182+
183+ # Check for secret in resource names
184+ /^ - / && inside_api_group {
185+ # If this resource contains "secret", mark the group for skipping
186+ if ($0 ~ /secret/) {
187+ contains_secret = 1;
188+ }
189+ api_group_buffer = api_group_buffer "\n" $0;
190+ next;
191+ }
192+
193+ # Process all other lines
194+ {
195+ if (inside_api_group) {
196+ # Add to buffer
197+ api_group_buffer = api_group_buffer "\n" $0;
198+ } else {
199+ # Not in an API group, print directly
200+ print $0;
201+ }
202+ }
203+
204+ END {
205+ # Print the last API group if it wasnt being skipped and has no secrets
206+ if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
207+ print api_group_buffer;
208+ }
209+ }' $TEMP_FILE > $PROCESSED_FILE
210+
211+ # Create the role and clean up
212+ oc create -f $PROCESSED_FILE
213+ rm $TEMP_FILE $PROCESSED_FILE
214+ fi
215+
81216# Create cd-user secret
82217cd ${SCRIPT_DIR} /ocp-config/cd-user
83218${TAILOR} -n ${NAMESPACE} apply ${NON_INTERACTIVE} ${REVEAL_SECRETS}
0 commit comments