Skip to content

Commit ceef11c

Browse files
mikeciriolimikecirioli
authored
[JENKINS-73103] Prepare plugin to allow users with overall/manage to manage clouds/pod/container templates (#1546)
1 parent daf622a commit ceef11c

File tree

15 files changed

+47
-38
lines changed

15 files changed

+47
-38
lines changed

‎src/main/java/org/csanchez/jenkins/plugins/kubernetes/ContainerTemplate.java

+7
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
package org.csanchez.jenkins.plugins.kubernetes;
22

3+
import edu.umd.cs.findbugs.annotations.NonNull;
34
import hudson.Extension;
45
import hudson.Util;
56
import hudson.model.AbstractDescribableImpl;
67
import hudson.model.Descriptor;
78
import hudson.model.DescriptorVisibilityFilter;
9+
import hudson.security.Permission;
810
import hudson.util.FormValidation;
911
import java.io.Serializable;
1012
import java.util.ArrayList;
@@ -321,6 +323,11 @@ public String getDisplayName() {
321323
return "Container Template";
322324
}
323325

326+
@NonNull
327+
public Permission getRequiredGlobalConfigPagePermission() {
328+
return Jenkins.MANAGE;
329+
}
330+
324331
@SuppressWarnings("unused") // Used by jelly
325332
@Restricted(DoNotUse.class) // Used by jelly
326333
public List<? extends Descriptor> getEnvVarsDescriptors() {

‎src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubectlBuildWrapper.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,7 @@ public String getDisplayName() {
147147

148148
public ListBoxModel doFillCredentialsIdItems(
149149
@AncestorInPath Item item, @QueryParameter String serverUrl, @QueryParameter String credentialsId) {
150-
if (item == null
151-
? !Jenkins.get().hasPermission(Jenkins.ADMINISTER)
152-
: !item.hasPermission(Item.EXTENDED_READ)) {
150+
if (item == null ? !Jenkins.get().hasPermission(Jenkins.MANAGE) : !item.hasPermission(Item.EXTENDED_READ)) {
153151
return new StandardListBoxModel().includeCurrentValue(credentialsId);
154152
}
155153
StandardListBoxModel result = new StandardListBoxModel();

‎src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubernetesCloud.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -832,7 +832,7 @@ public PodTemplate.DescriptorImpl getTemplateDescriptor() {
832832
public HttpResponse doCreate(StaplerRequest req, StaplerResponse rsp)
833833
throws IOException, ServletException, Descriptor.FormException {
834834
Jenkins j = Jenkins.get();
835-
j.checkPermission(Jenkins.ADMINISTER);
835+
j.checkPermission(Jenkins.MANAGE);
836836
PodTemplate newTemplate = getTemplateDescriptor().newInstance(req, req.getSubmittedForm());
837837
addTemplate(newTemplate);
838838
j.save();
@@ -873,7 +873,7 @@ public FormValidation doTestConnection(
873873
@QueryParameter int readTimeout,
874874
@QueryParameter boolean useJenkinsProxy)
875875
throws Exception {
876-
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
876+
Jenkins.get().checkPermission(Jenkins.MANAGE);
877877

878878
if (StringUtils.isBlank(name)) return FormValidation.error("name is required");
879879

@@ -913,7 +913,7 @@ public FormValidation doTestConnection(
913913
@SuppressWarnings("unused") // used by jelly
914914
public ListBoxModel doFillCredentialsIdItems(
915915
@AncestorInPath ItemGroup context, @QueryParameter String serverUrl) {
916-
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
916+
Jenkins.get().checkPermission(Jenkins.MANAGE);
917917
StandardListBoxModel result = new StandardListBoxModel();
918918
result.includeEmptyValue();
919919
result.includeMatchingAs(

‎src/main/java/org/csanchez/jenkins/plugins/kubernetes/PodTemplate.java

+8-2
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import hudson.model.Saveable;
1414
import hudson.model.TaskListener;
1515
import hudson.model.labels.LabelAtom;
16+
import hudson.security.Permission;
1617
import hudson.slaves.NodeProperty;
1718
import hudson.util.FormApply;
1819
import hudson.util.XStream2;
@@ -646,7 +647,7 @@ public void addEnvVars(List<TemplateEnvVar> envVars) {
646647
@POST
647648
public HttpResponse doDoDelete(@AncestorInPath PodTemplateGroup owner) throws IOException {
648649
Jenkins j = Jenkins.get();
649-
j.checkPermission(Jenkins.ADMINISTER);
650+
j.checkPermission(Jenkins.MANAGE);
650651
if (owner == null) {
651652
throw new IllegalStateException("Cloud could not be found");
652653
}
@@ -660,7 +661,7 @@ public HttpResponse doDoDelete(@AncestorInPath PodTemplateGroup owner) throws IO
660661
public HttpResponse doConfigSubmit(StaplerRequest req, @AncestorInPath PodTemplateGroup owner)
661662
throws IOException, ServletException, Descriptor.FormException {
662663
Jenkins j = Jenkins.get();
663-
j.checkPermission(Jenkins.ADMINISTER);
664+
j.checkPermission(Jenkins.MANAGE);
664665
if (owner == null) {
665666
throw new IllegalStateException("Cloud could not be found");
666667
}
@@ -1055,6 +1056,11 @@ public static class DescriptorImpl extends Descriptor<PodTemplate> {
10551056
"activeDeadlineSeconds", "idleMinutes", "instanceCap", "slaveConnectTimeout",
10561057
};
10571058

1059+
@NonNull
1060+
public Permission getRequiredGlobalConfigPagePermission() {
1061+
return Jenkins.MANAGE;
1062+
}
1063+
10581064
public DescriptorImpl() {
10591065
for (String field : STRING_FIELDS) {
10601066
addHelpFileRedirect(field + "Str", PodTemplate.class, field);

‎src/main/java/org/csanchez/jenkins/plugins/kubernetes/pipeline/PodTemplateStep.java

+2-4
Original file line numberDiff line numberDiff line change
@@ -449,8 +449,7 @@ public DescriptorImpl() {
449449
public ListBoxModel doFillCloudItems() {
450450
ListBoxModel result = new ListBoxModel();
451451
result.add("—any—", "");
452-
// TODO track use of SYSTEM_READ and/or MANAGE in GlobalCloudConfiguration
453-
if (!Jenkins.get().hasPermission(Jenkins.ADMINISTER)) {
452+
if (!Jenkins.get().hasPermission(Jenkins.MANAGE)) {
454453
return result;
455454
}
456455
Jenkins.get().clouds.getAll(KubernetesCloud.class).forEach(cloud -> result.add(cloud.name));
@@ -463,8 +462,7 @@ public ListBoxModel doFillInheritFromItems(@QueryParameter("cloud") String cloud
463462
ListBoxModel result = new ListBoxModel();
464463
result.add("—Default inheritance—", "<default>");
465464
result.add("—Disable inheritance—", " ");
466-
// TODO track use of SYSTEM_READ and/or MANAGE in GlobalCloudConfiguration
467-
if (!Jenkins.get().hasPermission(Jenkins.ADMINISTER)) {
465+
if (!Jenkins.get().hasPermission(Jenkins.MANAGE)) {
468466
return result;
469467
}
470468
Cloud cloud;

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesCloud/new.jelly

+6-6
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ THE SOFTWARE.
1919
-->
2020
<?jelly escape-by-default='true'?>
2121
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:l="/lib/layout" xmlns:f="/lib/form">
22-
<l:layout permission="${app.SYSTEM_READ}" title="${%New pod template}">
23-
<j:set var="readOnlyMode" value="${!app.hasPermission(app.ADMINISTER)}"/>
22+
<l:layout permission="${app.MANAGE_AND_SYSTEM_READ}" title="${%New pod template}">
23+
<j:set var="readOnlyMode" value="${!app.hasPermission(app.MANAGE)}"/>
2424
<l:breadcrumb title="${%New pod template }"/>
2525
<st:include page="sidepanel.jelly" it="${it}"/>
2626
<l:main-panel>
@@ -30,15 +30,15 @@ THE SOFTWARE.
3030

3131
<j:set var="descriptor" value="${it.templateDescriptor}"/>
3232
<st:include class="${descriptor.clazz}" page="config.jelly"/>
33-
<l:isAdmin>
33+
<l:hasAdministerOrManage>
3434
<f:bottomButtonBar>
3535
<f:submit value="${%Create}"/>
3636
</f:bottomButtonBar>
37-
</l:isAdmin>
37+
</l:hasAdministerOrManage>
3838
</f:form>
39-
<l:isAdmin>
39+
<l:hasAdministerOrManage>
4040
<st:adjunct includes="lib.form.confirm"/>
41-
</l:isAdmin>
41+
</l:hasAdministerOrManage>
4242
</l:main-panel>
4343
</l:layout>
4444
</j:jelly>

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesCloud/sidepanel.jelly

+2-2
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ THE SOFTWARE.
2525
<l:task contextMenu="false" href="." icon="symbol-computer" title="${%Status}"/>
2626
<l:task href="templates" icon="symbol-details" title="${%Pod Templates}"/>
2727
<l:task href="configure" icon="symbol-settings"
28-
title="${app.hasPermission(app.ADMINISTER) ? '%Configure' : '%View Configuration'}"/>
29-
<l:delete permission="${app.ADMINISTER}" title="${%Delete Cloud}" message="${%delete.cloud(it.displayName)}"/>
28+
title="${app.hasPermission(app.MANAGE) ? '%Configure' : '%View Configuration'}"/>
29+
<l:delete permission="${app.MANAGE}" title="${%Delete Cloud}" message="${%delete.cloud(it.displayName)}"/>
3030
<t:actions />
3131
</l:tasks>
3232
<j:forEach var="action" items="${it.allActions}">

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesCloud/templates.jelly

+2-2
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,12 @@ THE SOFTWARE.
2929
<j:choose>
3030
<j:when test="${not empty it.templates}">
3131
<l:app-bar title="${it.name} - ${%Pod templates}">
32-
<l:isAdmin>
32+
<l:hasAdministerOrManage>
3333
<a name="newTemplate" class="jenkins-button jenkins-button--primary" href="new">
3434
<l:icon src="symbol-add"/>
3535
${%Add a pod template}
3636
</a>
37-
</l:isAdmin>
37+
</l:hasAdministerOrManage>
3838
</l:app-bar>
3939
<table id="templates" class="jenkins-table sortable">
4040
<thead>

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesComputer/container.jelly

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ THE SOFTWARE.
2424

2525
<?jelly escape-by-default='true'?>
2626
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
27-
<l:layout title="${it.displayName} log" permission="${app.ADMINISTER}">
27+
<l:layout title="${it.displayName} log" permission="${app.MANAGE}">
2828
<st:include page="sidepanel.jelly" />
2929
<l:main-panel>
3030
<pre id="out" />

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesComputer/events.jelly

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ THE SOFTWARE.
2424

2525
<?jelly escape-by-default='true'?>
2626
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
27-
<l:layout title="${it.displayName} log" permission="${app.ADMINISTER}">
27+
<l:layout title="${it.displayName} log" permission="${app.MANAGE}">
2828
<st:include page="sidepanel.jelly" />
2929
<l:main-panel>
3030
<table class="sortable jenkins-table">

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesComputer/podLog.jelly

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ THE SOFTWARE.
2424

2525
<?jelly escape-by-default='true'?>
2626
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
27-
<l:layout title="${it.displayName} log" permission="${app.ADMINISTER}">
27+
<l:layout title="${it.displayName} log" permission="${app.MANAGE}">
2828
<st:include page="sidepanel.jelly" />
2929
<l:main-panel>
3030
<table class="sortable jenkins-table">

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/KubernetesComputer/sidepanel2.jelly

+4-4
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ THE SOFTWARE.
2424

2525
<?jelly escape-by-default='true'?>
2626
<j:jelly xmlns:j="jelly:core" xmlns:l="/lib/layout">
27-
<l:task icon="symbol-terminal icon-md" href="${rootURL}/${it.url}log" title="${%Log}" permission="${app.ADMINISTER}"/>
28-
<l:task icon="symbol-terminal icon-md" href="${rootURL}/${it.url}podLog" title="${%Pod Log}" permission="${app.ADMINISTER}"/>
29-
<l:task icon="symbol-list icon-md" href="${rootURL}/${it.url}events" title="${%Events}" permission="${app.ADMINISTER}"/>
27+
<l:task icon="symbol-terminal icon-md" href="${rootURL}/${it.url}log" title="${%Log}" permission="${app.MANAGE}"/>
28+
<l:task icon="symbol-terminal icon-md" href="${rootURL}/${it.url}podLog" title="${%Pod Log}" permission="${app.MANAGE}"/>
29+
<l:task icon="symbol-list icon-md" href="${rootURL}/${it.url}events" title="${%Events}" permission="${app.MANAGE}"/>
3030
<j:if test="${it.channel!=null}">
31-
<l:task icon="symbol-computer icon-md" href="${rootURL}/${it.url}systemInfo" title="${%System Information}" permission="${app.ADMINISTER}"/>
31+
<l:task icon="symbol-computer icon-md" href="${rootURL}/${it.url}systemInfo" title="${%System Information}" permission="${app.MANAGE}"/>
3232
</j:if>
3333
</j:jelly>

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/PodTemplate/index.jelly

+6-6
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ THE SOFTWARE.
1919
-->
2020
<?jelly escape-by-default='true'?>
2121
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:l="/lib/layout" xmlns:f="/lib/form">
22-
<l:layout permission="${app.SYSTEM_READ}" title="${%Pod template settings}">
23-
<j:set var="readOnlyMode" value="${!app.hasPermission(app.ADMINISTER)}"/>
22+
<l:layout permission="${app.MANAGE_AND_SYSTEM_READ}" title="${%Pod template settings}">
23+
<j:set var="readOnlyMode" value="${!app.hasPermission(app.MANAGE)}"/>
2424
<l:breadcrumb title="${it.name}"/>
2525

2626
<st:include page="sidepanel.jelly"/>
@@ -33,15 +33,15 @@ THE SOFTWARE.
3333
<!-- main body of the configuration -->
3434
<st:include it="${instance}" page="config.jelly"/>
3535

36-
<l:isAdmin>
36+
<l:hasAdministerOrManage>
3737
<f:bottomButtonBar>
3838
<f:submit value="${%Save}"/>
3939
</f:bottomButtonBar>
40-
</l:isAdmin>
40+
</l:hasAdministerOrManage>
4141
</f:form>
42-
<l:isAdmin>
42+
<l:hasAdministerOrManage>
4343
<st:adjunct includes="lib.form.confirm"/>
44-
</l:isAdmin>
44+
</l:hasAdministerOrManage>
4545
</l:main-panel>
4646
</l:layout>
4747
</j:jelly>

‎src/main/resources/org/csanchez/jenkins/plugins/kubernetes/PodTemplate/sidepanel.jelly

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ THE SOFTWARE.
2323
<l:side-panel>
2424
<l:tasks>
2525
<l:task href="" icon="symbol-settings"
26-
title="${app.hasPermission(app.ADMINISTER) ? '%Configure' : '%View Configuration'}"/>
27-
<l:delete permission="${app.ADMINISTER}" title="${%Delete Pod Template}" message="${%delete.template(it.name)}"/>
26+
title="${app.hasPermission(app.MANAGE) ? '%Configure' : '%View Configuration'}"/>
27+
<l:delete permission="${app.MANAGE}" title="${%Delete Pod Template}" message="${%delete.template(it.name)}"/>
2828
<t:actions />
2929
</l:tasks>
3030
</l:side-panel>

‎src/test/java/org/csanchez/jenkins/plugins/kubernetes/pipeline/KubernetesPipelineTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -630,7 +630,7 @@ public void cascadingDelete() throws Exception {
630630
public void computerCantBeConfigured() throws Exception {
631631
r.jenkins.setSecurityRealm(r.createDummySecurityRealm());
632632
r.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy()
633-
.grant(Jenkins.ADMINISTER)
633+
.grant(Jenkins.MANAGE)
634634
.everywhere()
635635
.to("admin"));
636636
SemaphoreStep.waitForStart("pod/1", b);

0 commit comments

Comments
 (0)