@@ -27,56 +27,98 @@ import (
2727type Role string
2828
2929const (
30- Admin Role = "admin"
31- BaseUser Role = "user-base"
32- StandardUser Role = "user"
33- ClusterOwner Role = "cluster-owner"
34- ClusterMember Role = "cluster-member"
35- ProjectOwner Role = "project-owner"
36- ProjectMember Role = "project-member"
37- CreateNS Role = "create-ns"
38- ReadOnly Role = "read-only"
39- CustomManageProjectMember Role = "projectroletemplatebindings-manage"
40- CrtbView Role = "clusterroletemplatebindings-view"
41- PrtbView Role = "projectroletemplatebindings-view"
42- ProjectsCreate Role = "projects-create"
43- ProjectsView Role = "projects-view"
44- ManageWorkloads Role = "workloads-manage"
45- ActiveStatus = "active"
46- ForbiddenError = "403 Forbidden"
47- RancherDeploymentNamespace = "cattle-system"
48- DefaultNamespace = "fleet-default"
49- RancherDeploymentName = "rancher"
50- CattleResyncEnvVarName = "CATTLE_RESYNC_DEFAULT"
51- LocalCluster = "local"
52- UserKind = "User"
53- ImageName = "nginx"
54- ManageUsersVerb = "manage-users"
55- UpdatePsaVerb = "updatepsa"
56- ManagementAPIGroup = "management.cattle.io"
57- UsersResource = "users"
58- UserAttributeResource = "userattribute"
59- GroupsResource = "groups"
60- GroupMembersResource = "groupmembers"
61- ProjectResource = "projects"
62- PrtbResource = "projectroletemplatebindings"
63- SecretsResource = "secrets"
64- ClusterContext = "cluster"
65- ProjectContext = "project"
66- GrbOwnerLabel = "authz.management.cattle.io/grb-owner"
67- GlobalDataNS = "cattle-global-data"
68- MembershipBindingOwnerLabel = "membership-binding-owner"
69- PSALabelKey = "pod-security.kubernetes.io/"
70- PSAEnforceLabelKey = "pod-security.kubernetes.io/enforce"
71- PSAWarnLabelKey = "pod-security.kubernetes.io/warn"
72- PSAAuditLabelKey = "pod-security.kubernetes.io/audit"
73- PSAPrivilegedPolicy = "privileged"
74- PSABaselinePolicy = "baseline"
75- PSARestrictedPolicy = "restricted"
76- PSAEnforceVersionLabelKey = "pod-security.kubernetes.io/enforce-version"
77- PSAWarnVersionLabelKey = "pod-security.kubernetes.io/warn-version"
78- PSAAuditVersionLabelKey = "pod-security.kubernetes.io/audit-version"
79- PSALatestValue = "latest"
30+ Admin Role = "admin"
31+ BaseUser Role = "user-base"
32+ StandardUser Role = "user"
33+ ClusterOwner Role = "cluster-owner"
34+ ClusterMember Role = "cluster-member"
35+ ProjectOwner Role = "project-owner"
36+ ProjectMember Role = "project-member"
37+ CreateNS Role = "create-ns"
38+ ReadOnly Role = "read-only"
39+ CustomManageProjectMember Role = "projectroletemplatebindings-manage"
40+ CrtbView Role = "clusterroletemplatebindings-view"
41+ PrtbView Role = "projectroletemplatebindings-view"
42+ ProjectsCreate Role = "projects-create"
43+ ProjectsView Role = "projects-view"
44+ ManageWorkloads Role = "workloads-manage"
45+ ActiveStatus = "active"
46+ ForbiddenError = "403 Forbidden"
47+ RancherDeploymentNamespace = "cattle-system"
48+ DefaultNamespace = "fleet-default"
49+ RancherDeploymentName = "rancher"
50+ CattleResyncEnvVarName = "CATTLE_RESYNC_DEFAULT"
51+ LocalCluster = "local"
52+ UserKind = "User"
53+ ImageName = "nginx"
54+ ManageUsersVerb = "manage-users"
55+ UpdatePsaVerb = "updatepsa"
56+ ManagementAPIGroup = "management.cattle.io"
57+ UsersResource = "users"
58+ UserAttributeResource = "userattribute"
59+ GroupsResource = "groups"
60+ GroupMembersResource = "groupmembers"
61+ ProjectResource = "projects"
62+ PrtbResource = "projectroletemplatebindings"
63+ SecretsResource = "secrets"
64+ ClusterContext = "cluster"
65+ ProjectContext = "project"
66+ GrbOwnerLabel = "authz.management.cattle.io/grb-owner"
67+ GlobalDataNS = "cattle-global-data"
68+ MembershipBindingOwnerLabel = "membership-binding-owner"
69+ PSALabelKey = "pod-security.kubernetes.io/"
70+ PSAEnforceLabelKey = "pod-security.kubernetes.io/enforce"
71+ PSAWarnLabelKey = "pod-security.kubernetes.io/warn"
72+ PSAAuditLabelKey = "pod-security.kubernetes.io/audit"
73+ PSAPrivilegedPolicy = "privileged"
74+ PSABaselinePolicy = "baseline"
75+ PSARestrictedPolicy = "restricted"
76+ PSAEnforceVersionLabelKey = "pod-security.kubernetes.io/enforce-version"
77+ PSAWarnVersionLabelKey = "pod-security.kubernetes.io/warn-version"
78+ PSAAuditVersionLabelKey = "pod-security.kubernetes.io/audit-version"
79+ PSALatestValue = "latest"
80+ RkeCattleAPIGroup = "rke.cattle.io"
81+ ProjectCattleAPIGroup = "project.cattle.io"
82+ AppsAPIGroup = "apps"
83+ CrtbOwnerLabel = "authz.cluster.cattle.io/crtb-owner"
84+ PrtbOwnerLabel = "authz.cluster.cattle.io/prtb-owner"
85+ ClusterNameAnnotationKey = "cluster.cattle.io/name"
86+ RegularResourceAggregator = "-aggregator"
87+ ClusterMgmtResourceAggregator = "-cluster-mgmt-aggregator"
88+ ProjectMgmtResourceAggregator = "-project-mgmt-aggregator"
89+ ClusterMgmtResource = "-cluster-mgmt"
90+ ProjectMgmtResource = "-project-mgmt"
91+ )
92+
93+ var (
94+ ClusterMgmtResources = map [string ]string {
95+ "clusterscans" : ManagementAPIGroup ,
96+ "clusterregistrationtokens" : ManagementAPIGroup ,
97+ "clusterroletemplatebindings" : ManagementAPIGroup ,
98+ "etcdbackups" : ManagementAPIGroup ,
99+ "nodes" : ManagementAPIGroup ,
100+ "nodepools" : ManagementAPIGroup ,
101+ "projects" : ManagementAPIGroup ,
102+ "etcdsnapshots" : RkeCattleAPIGroup ,
103+ }
104+
105+ ProjectMgmtResources = map [string ]string {
106+ "sourcecodeproviderconfigs" : ProjectCattleAPIGroup ,
107+ "projectroletemplatebindings" : ManagementAPIGroup ,
108+ "secrets" : "" ,
109+ }
110+
111+ PolicyRules = map [string ][]rbacv1.PolicyRule {
112+ "readProjects" : definePolicyRules ([]string {"get" , "list" }, []string {"projects" }, []string {ManagementAPIGroup }),
113+ "editProjects" : definePolicyRules ([]string {"create" , "update" , "patch" }, []string {"projects" }, []string {ManagementAPIGroup }),
114+ "manageProjects" : definePolicyRules ([]string {"create" , "update" , "patch" , "delete" }, []string {"projects" }, []string {ManagementAPIGroup }),
115+ "readPrtbs" : definePolicyRules ([]string {"get" , "list" }, []string {"projectroletemplatebindings" }, []string {ManagementAPIGroup }),
116+ "updatePrtbs" : definePolicyRules ([]string {"update" , "patch" }, []string {"projectroletemplatebindings" }, []string {ManagementAPIGroup }),
117+ "readDeployments" : definePolicyRules ([]string {"get" , "list" }, []string {"deployments" }, []string {AppsAPIGroup }),
118+ "readPods" : definePolicyRules ([]string {"get" , "list" }, []string {"pods" }, []string {"" }),
119+ "readNamespaces" : definePolicyRules ([]string {"get" , "list" }, []string {"namespaces" }, []string {"" }),
120+ "readSecrets" : definePolicyRules ([]string {"get" , "list" }, []string {"secrets" }, []string {"" }),
121+ }
80122)
81123
82124func (r Role ) String () string {
@@ -761,3 +803,91 @@ func CreateGroupProjectRoleTemplateBinding(client *rancher.Client, projectID str
761803
762804 return prtb , nil
763805}
806+
807+ // DeleteClusterRoleTemplateBinding deletes the cluster role template binding using wrangler context
808+ func DeleteClusterRoleTemplateBinding (client * rancher.Client , crtbNamespace , crtbName string ) error {
809+ err := client .WranglerContext .Mgmt .ClusterRoleTemplateBinding ().Delete (crtbNamespace , crtbName , & metav1.DeleteOptions {})
810+ if err != nil {
811+ return fmt .Errorf ("failed to delete ClusterRoleTemplateBinding %s: %w" , crtbName , err )
812+ }
813+
814+ err = kwait .PollUntilContextTimeout (context .TODO (), defaults .FiveHundredMillisecondTimeout , defaults .OneMinuteTimeout , false , func (ctx context.Context ) (done bool , err error ) {
815+ _ , err = client .WranglerContext .Mgmt .ClusterRoleTemplateBinding ().Get (crtbNamespace , crtbName , metav1.GetOptions {})
816+
817+ if apierrors .IsNotFound (err ) {
818+ return true , nil
819+ }
820+
821+ if err != nil {
822+ return false , fmt .Errorf ("error checking CRTB deletion status: %w" , err )
823+ }
824+
825+ return false , nil
826+ })
827+
828+ if err != nil {
829+ return fmt .Errorf ("timed out waiting for ClusterRoleTemplateBinding %s to be deleted: %w" , crtbName , err )
830+ }
831+
832+ return nil
833+ }
834+
835+ // DeleteProjectRoleTemplateBinding deletes the project role template binding using wrangler context
836+ func DeleteProjectRoleTemplateBinding (client * rancher.Client , prtbNamespace , prtbName string ) error {
837+ err := client .WranglerContext .Mgmt .ProjectRoleTemplateBinding ().Delete (prtbNamespace , prtbName , & metav1.DeleteOptions {})
838+ if err != nil {
839+ return fmt .Errorf ("failed to delete ProjectRoleTemplateBinding %s: %w" , prtbName , err )
840+ }
841+
842+ err = kwait .PollUntilContextTimeout (context .TODO (), defaults .FiveHundredMillisecondTimeout , defaults .OneMinuteTimeout , false , func (ctx context.Context ) (done bool , err error ) {
843+ _ , err = client .WranglerContext .Mgmt .ProjectRoleTemplateBinding ().Get (prtbNamespace , prtbName , metav1.GetOptions {})
844+
845+ if apierrors .IsNotFound (err ) {
846+ return true , nil
847+ }
848+
849+ if err != nil {
850+ return false , fmt .Errorf ("error checking PRTB deletion status: %w" , err )
851+ }
852+
853+ return false , nil
854+ })
855+
856+ if err != nil {
857+ return fmt .Errorf ("timed out waiting for ProjectRoleTemplateBinding %s to be deleted: %w" , prtbName , err )
858+ }
859+
860+ return nil
861+ }
862+
863+ // UpdateRoleTemplateInheritance updates the inheritance of a role template using wrangler context
864+ func UpdateRoleTemplateInheritance (client * rancher.Client , roleTemplateName string , inheritedRoles []* v3.RoleTemplate ) (* v3.RoleTemplate , error ) {
865+ var roleTemplateNames []string
866+ for _ , inheritedRole := range inheritedRoles {
867+ if inheritedRole != nil {
868+ roleTemplateNames = append (roleTemplateNames , inheritedRole .Name )
869+ }
870+ }
871+
872+ existingRoleTemplate , err := GetRoleTemplateByName (client , roleTemplateName )
873+ if err != nil {
874+ return nil , fmt .Errorf ("failed to get existing RoleTemplate: %w" , err )
875+ }
876+
877+ existingRoleTemplate .RoleTemplateNames = roleTemplateNames
878+
879+ updatedRoleTemplate , err := client .WranglerContext .Mgmt .RoleTemplate ().Update (existingRoleTemplate )
880+ if err != nil {
881+ return nil , fmt .Errorf ("failed to update RoleTemplate inheritance: %w" , err )
882+ }
883+
884+ return GetRoleTemplateByName (client , updatedRoleTemplate .Name )
885+ }
886+
887+ func definePolicyRules (verbs , resources , apiGroups []string ) []rbacv1.PolicyRule {
888+ return []rbacv1.PolicyRule {{
889+ Verbs : verbs ,
890+ Resources : resources ,
891+ APIGroups : apiGroups ,
892+ }}
893+ }
0 commit comments