Skip to content

Commit 2be9d87

Browse files
mpwshmpwsh
authored
Merge pull request #24 from holaplex/mpw/hub-permisions-chart
add hub-permissions helm chart
2 parents 3763bcd + a839ae5 commit 2be9d87

File tree

9 files changed

+243
-0
lines changed

9 files changed

+243
-0
lines changed

‎.github/workflows/linters/ct.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ chart-dirs:
66
chart-repos:
77
- holaplex=https://holaplex.github.io/helm-charts
88
- apisix=https://charts.apiseven.com
9+
- ory=https://k8s.ory.sh/helm/charts
910
helm-extra-args: --timeout 600s
1011
validate-maintainers: false
1112
excluded-charts:

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ jobs:
3434
run: |
3535
helm repo add holaplex https://holaplex.github.io/helm-charts
3636
helm repo add apisix https://charts.apiseven.com
37+
helm repo add ory https://k8s.ory.sh/helm/charts
3738
3839
- name: Run chart-releaser
3940
uses: helm/[email protected]

‎charts/hub-permissions/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/hub-permissions/Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: keto
3+
repository: https://k8s.ory.sh/helm/charts
4+
version: 0.28.0
5+
digest: sha256:0e41623a2a26aa262e48f0323ef1eda5fbfa181d6047d70ac6b61c2f3b4c9402
6+
generated: "2023-02-27T17:08:48.89705-03:00"

‎charts/hub-permissions/Chart.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: v2
2+
name: hub-permissions
3+
description: Helm chart for hub-permissions
4+
maintainers:
5+
- name: Holaplex Engineering
6+
email: [email protected]
7+
8+
# A chart can be either an 'application' or a 'library' chart.
9+
#
10+
# Application charts are a collection of templates that can be packaged into versioned archives
11+
# to be deployed.
12+
#
13+
# Library charts provide useful utilities or functions for the chart developer. They're included as
14+
# a dependency of application charts to inject those utilities and functions into the rendering
15+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
16+
type: application
17+
18+
# This is the chart version. This version number should be incremented each time you make changes
19+
# to the chart and its templates, including the app version.
20+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
21+
22+
version: "0.0.1"
23+
24+
# This is the version number of the application being deployed. This version number should be
25+
# incremented each time you make changes to the application. Versions are not expected to
26+
# follow Semantic Versioning. They should reflect the version the application is using.
27+
# It is recommended to use it with quotes.
28+
appVersion: "0.1"
29+
sources:
30+
- https://github.com/holaplex/helm-charts
31+
32+
dependencies:
33+
- name: keto
34+
version: 0.28.0
35+
repository: https://k8s.ory.sh/helm/charts

‎charts/hub-permissions/policies/namespaces.keto.ts‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
import { Namespace, Context } from "@ory/keto-namespace-types"
2+
class User implements Namespace {}
3+
4+
class Project implements Namespace {
5+
related: {
6+
owners: User[]
7+
editors: User[]
8+
viewers: User[]
9+
parents: Organization[]
10+
}
11+
12+
permits = {
13+
view: (ctx: Context): boolean =>
14+
this.related.viewers.includes(ctx.subject) ||
15+
this.related.parents.traverse((parent) => parent.permits.view(ctx)) ||
16+
this.permits.edit(ctx),
17+
edit: (ctx: Context): boolean =>
18+
this.related.editors.includes(ctx.subject) ||
19+
this.related.parents.traverse((parent) => parent.permits.edit(ctx)) ||
20+
this.permits.delete(ctx),
21+
delete: (ctx: Context): boolean =>
22+
this.related.owners.includes(ctx.subject) ||
23+
this.related.parents.traverse((parent) => parent.permits.delete(ctx)),
24+
}
25+
}
26+
27+
class Organization implements Namespace {
28+
related: {
29+
owners: User[]
30+
editors: User[]
31+
viewers: User[]
32+
parents: Organization[]
33+
}
34+
35+
permits = {
36+
view: (ctx: Context): boolean =>
37+
this.related.viewers.includes(ctx.subject) ||
38+
this.permits.edit(ctx),
39+
edit: (ctx: Context): boolean =>
40+
this.related.editors.includes(ctx.subject) ||
41+
this.permits.delete(ctx),
42+
invite: (ctx: Context): boolean =>
43+
this.permits.view(ctx),
44+
delete: (ctx: Context): boolean =>
45+
this.related.owners.includes(ctx.subject) ||
46+
this.related.parents.traverse((parent) => parent.permits.delete(ctx)),
47+
}
48+
}

‎charts/hub-permissions/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "hub-permissions.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "hub-permissions.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "hub-permissions.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "hub-permissions.labels" -}}
37+
helm.sh/chart: {{ include "hub-permissions.chart" . }}
38+
{{ include "hub-permissions.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "hub-permissions.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "hub-permissions.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "hub-permissions.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "hub-permissions.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/hub-permissions/templates/configmap.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{{- $files := .Files }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: keto-namespaces
6+
labels:
7+
{{- include "hub-permissions.labels" $ | nindent 4 }}
8+
data:
9+
{{- with .Values.customNamespaces.files}}
10+
{{- range . }}
11+
{{ (splitList "/" .) | last | nindent 2}}: |-
12+
{{ $.Files.Get . | nindent 8 }}
13+
{{- end }}
14+
{{- end }}

‎charts/hub-permissions/values.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
customNamespaces:
2+
files:
3+
- policies/namespaces.keto.ts
4+
5+
keto:
6+
replicaCount: 1
7+
image:
8+
repository: oryd/keto
9+
pullPolicy: Always
10+
tag: v0.11.0-alpha.0
11+
12+
service:
13+
metrics:
14+
enabled: true
15+
16+
secret:
17+
enabled: true
18+
19+
deployment:
20+
extraVolumes:
21+
- configMap:
22+
defaultMode: 420
23+
name: keto-namespaces
24+
name: keto-namespaces-volume
25+
extraVolumeMounts:
26+
- mountPath: /app/namespaces
27+
name: keto-namespaces-volume
28+
readOnly: true
29+
30+
keto:
31+
automigration:
32+
enabled: true
33+
type: initContainer
34+
config:
35+
dsn: memory
36+
log:
37+
level: info
38+
format: json
39+
leak_sensitive_values: false
40+
serve:
41+
read:
42+
port: 4466
43+
write:
44+
port: 4467
45+
metrics:
46+
port: 4468
47+
namespaces:
48+
location: file:///app/namespaces/
49+
50+
pdb:
51+
enabled: false
52+
spec:
53+
minAvailable: 1

0 commit comments

Comments
 (0)