github-personal/cozystack
1
0
Fork 0
mirror of https://github.com/outbackdingo/cozystack.git synced 2026-01-28 02:18:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add extra helper function to generate subjects

Browse Source 
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
This commit is contained in:
Andrei Kvapil
2025-06-16 20:10:17 +02:00
parent 028f2e4e8d
commit f83741eb09
1 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
packages/library/cozy-lib/templates/_rbac.tpl
View File

@@ -35,6 +35,9 @@ super-admin: 3
{{- range $tenants }}
- {{ . }}
{{- end }}
{{- if not (eq . "tenant-root") }}
- tenant-root
{{- end }}
{{- end }}
{{- define "cozy-lib.rbac.groupSubject" -}}
@@ -43,6 +46,12 @@ super-admin: 3
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- define "cozy-lib.rbac.serviceAccountSubject" -}}
- kind: ServiceAccount
name: {{ . }}
namespace: {{ . }}
{{- end }}
{{- /*
A helper function to get a list of groups that should have access, given a
minimal access level and the tenant. Invoked as:
@@ -75,12 +84,23 @@ super-admin: 3
{{- define "cozy-lib.rbac.subjectsForTenantAndAccessLevel" }}
{{- include "cozy-lib.checkInput" . }}
{{- $level := index . 0 }}
{{- $global := index . 1 }}
{{- $tenant := index . 1 }}
{{- $levels := include "cozy-lib.rbac.accessLevelsAtOrAbove" $level | fromYamlArray }}
{{- $tenants := include "cozy-lib.rbac.allParentTenantsAndThis" $global.Release.Namespace | fromYamlArray }}
{{- range $l := $levels }}
{{- range $t := $tenants }}
{{- $tenants := include "cozy-lib.rbac.allParentTenantsAndThis" $tenant | fromYamlArray }}
{{- range $t := $tenants }}
{{- include "cozy-lib.rbac.serviceAccountSubject" $t }}{{ printf "\n" }}
{{- range $l := $levels }}
{{- include "cozy-lib.rbac.groupSubject" (printf "%s-%s" $t $l) }}{{ printf "\n" }}
{{- end }}
{{- end}}
{{- end }}
{{- define "cozy-lib.rbac.subjectsForTenant" }}
{{- include "cozy-lib.checkInput" . }}
{{- $level := index . 0 }}
{{- $tenant := index . 1 }}
{{- $tenants := include "cozy-lib.rbac.allParentTenantsAndThis" $tenant | fromYamlArray }}
{{- range $t := $tenants }}
{{- include "cozy-lib.rbac.groupSubject" (printf "%s-%s" $t $level) }}{{ printf "\n" }}
{{- end}}
{{- end }}