Merge pull request #12 from appuio/feat/aggregated-roles

Aggregate permissions for upgrade controller custom resources to `view` and `edit` cluster roles

Author: simu

class/openshift-upgrade-controller.yml

@@ -8,6 +8,7 @@ parameters:
       - input_paths:
           - ${_base_directory}/component/main.jsonnet
           - ${_base_directory}/component/cluster-version.jsonnet
+          - ${_base_directory}/component/rbac.jsonnet
         input_type: jsonnet
         output_path: openshift-upgrade-controller/
 

component/rbac.jsonnet

@@ -0,0 +1,57 @@
+local kube = import 'lib/kube.libjsonnet';
+
+local aggregatedRoles = [
+  kube.ClusterRole('syn:openshift-upgrade-controller:view') {
+    metadata+: {
+      labels+: {
+        'rbac.authorization.k8s.io/aggregate-to-admin': 'true',
+        'rbac.authorization.k8s.io/aggregate-to-edit': 'true',
+        'rbac.authorization.k8s.io/aggregate-to-view': 'true',
+      },
+    },
+    rules: [
+      {
+        apiGroups: 'managedupgrade.appuio.io',
+        resources: [
+          'clusterversions',
+          'upgradeconfigs',
+          'upgradejobs',
+        ],
+        verbs: [
+          'get',
+          'list',
+          'watch',
+        ],
+      },
+    ],
+  },
+  kube.ClusterRole('syn:openshift-upgrade-controller:edit') {
+    metadata+: {
+      labels+: {
+        'rbac.authorization.k8s.io/aggregate-to-admin': 'true',
+        'rbac.authorization.k8s.io/aggregate-to-edit': 'true',
+      },
+    },
+    rules: [
+      {
+        apiGroups: 'managedupgrade.appuio.io',
+        resources: [
+          'clusterversions',
+          'upgradeconfigs',
+          'upgradejobs',
+        ],
+        verbs: [
+          'create',
+          'delete',
+          'deletecollection',
+          'patch',
+          'update',
+        ],
+      },
+    ],
+  },
+];
+
+{
+  '30_rbac': aggregatedRoles,
+}

tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/30_rbac.yaml

@@ -0,0 +1,42 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: syn-openshift-upgrade-controller-view
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+    rbac.authorization.k8s.io/aggregate-to-edit: 'true'
+    rbac.authorization.k8s.io/aggregate-to-view: 'true'
+  name: syn:openshift-upgrade-controller:view
+rules:
+  - apiGroups: managedupgrade.appuio.io
+    resources:
+      - clusterversions
+      - upgradeconfigs
+      - upgradejobs
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: syn-openshift-upgrade-controller-edit
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+    rbac.authorization.k8s.io/aggregate-to-edit: 'true'
+  name: syn:openshift-upgrade-controller:edit
+rules:
+  - apiGroups: managedupgrade.appuio.io
+    resources:
+      - clusterversions
+      - upgradeconfigs
+      - upgradejobs
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update