Skip to content

Commit e84f397

Browse files
OmeramscOmeramsc
committed
chore: kyverno to assign roles to users from user group in dev/stg
Add a new policy that watches the konflux-support Group and automatically creates/updates a ClusterRoleBinding with individual User subjects. This enables the namespace-lister service to grant access based on users in the group. This change reflects on dev and stg envs only Signed-off-by: Omer Turner <[email protected]>
1 parent 67027d1 commit e84f397

File tree

11 files changed

+550
-0
lines changed

11 files changed

+550
-0
lines changed

‎components/policies/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/chainsaw-assert-clusterpolicy.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: generate-konflux-support-nslister-clusterrolebinding
5+
status:
6+
conditions:
7+
- reason: Succeeded
8+
status: "True"
9+
type: Ready
10+

‎components/policies/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/chainsaw-test.yaml‎

Lines changed: 358 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,358 @@
1+
---
2+
apiVersion: chainsaw.kyverno.io/v1alpha1
3+
kind: Test
4+
metadata:
5+
name: verify-clusterpolicy-is-ready
6+
spec:
7+
concurrent: false
8+
description: |
9+
Tests that the ClusterPolicy for generating konflux-support-nslister
10+
ClusterRoleBinding is applied successfully and becomes Ready.
11+
steps:
12+
- name: given-kyverno-has-permission-on-resources
13+
try:
14+
- apply:
15+
file: ../kyverno_rbac.yaml
16+
- name: given-viewer-clusterrole-exists
17+
try:
18+
- apply:
19+
resource:
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
kind: ClusterRole
22+
metadata:
23+
name: konflux-viewer-user-actions
24+
rules: []
25+
- name: given-group-crd-exists
26+
try:
27+
- apply:
28+
file: resources/group-crd.yaml
29+
- assert:
30+
resource:
31+
apiVersion: apiextensions.k8s.io/v1
32+
kind: CustomResourceDefinition
33+
metadata:
34+
name: groups.user.openshift.io
35+
status:
36+
conditions:
37+
- type: NamesAccepted
38+
status: "True"
39+
- type: Established
40+
status: "True"
41+
- name: Apply Kyverno ClusterPolicy and assert it exists
42+
try:
43+
- apply:
44+
file: ../generate-support-nslister-clusterrolebinding-clusterpolicy.yaml
45+
- assert:
46+
file: chainsaw-assert-clusterpolicy.yaml
47+
---
48+
apiVersion: chainsaw.kyverno.io/v1alpha1
49+
kind: Test
50+
metadata:
51+
name: clusterrolebinding-created-with-users
52+
spec:
53+
concurrent: false
54+
description: |
55+
Tests that when a konflux-support Group is created with users,
56+
a ClusterRoleBinding is generated with individual User subjects,
57+
the correct label, and the konflux-viewer-user-actions ClusterRole.
58+
steps:
59+
- name: given-kyverno-has-permission-on-resources
60+
try:
61+
- apply:
62+
file: ../kyverno_rbac.yaml
63+
- name: given-viewer-clusterrole-exists
64+
try:
65+
- apply:
66+
resource:
67+
apiVersion: rbac.authorization.k8s.io/v1
68+
kind: ClusterRole
69+
metadata:
70+
name: konflux-viewer-user-actions
71+
rules: []
72+
- name: given-group-crd-exists
73+
try:
74+
- apply:
75+
file: resources/group-crd.yaml
76+
- assert:
77+
resource:
78+
apiVersion: apiextensions.k8s.io/v1
79+
kind: CustomResourceDefinition
80+
metadata:
81+
name: groups.user.openshift.io
82+
status:
83+
conditions:
84+
- type: NamesAccepted
85+
status: "True"
86+
- type: Established
87+
status: "True"
88+
- name: Apply Kyverno ClusterPolicy
89+
try:
90+
- apply:
91+
file: ../generate-support-nslister-clusterrolebinding-clusterpolicy.yaml
92+
- assert:
93+
file: chainsaw-assert-clusterpolicy.yaml
94+
- name: Create konflux-support Group with users
95+
try:
96+
- create:
97+
file: ./resources/group-with-users.yaml
98+
- name: Assert ClusterRoleBinding is created correctly
99+
try:
100+
- assert:
101+
resource:
102+
apiVersion: rbac.authorization.k8s.io/v1
103+
kind: ClusterRoleBinding
104+
metadata:
105+
name: konflux-support-nslister
106+
labels:
107+
namespace-lister.konflux-ci.dev/use-for-access: 'true'
108+
roleRef:
109+
apiGroup: rbac.authorization.k8s.io
110+
kind: ClusterRole
111+
name: konflux-viewer-user-actions
112+
subjects:
113+
- apiGroup: rbac.authorization.k8s.io
114+
kind: User
115+
name: alice
116+
- apiGroup: rbac.authorization.k8s.io
117+
kind: User
118+
name: bob
119+
- apiGroup: rbac.authorization.k8s.io
120+
kind: User
121+
name: charlie
122+
---
123+
apiVersion: chainsaw.kyverno.io/v1alpha1
124+
kind: Test
125+
metadata:
126+
name: clusterrolebinding-updated-when-users-added
127+
spec:
128+
concurrent: false
129+
description: |
130+
Tests that when users are added to the konflux-support Group,
131+
the ClusterRoleBinding subjects are updated to include the new users.
132+
steps:
133+
- name: given-kyverno-has-permission-on-resources
134+
try:
135+
- apply:
136+
file: ../kyverno_rbac.yaml
137+
- name: given-viewer-clusterrole-exists
138+
try:
139+
- apply:
140+
resource:
141+
apiVersion: rbac.authorization.k8s.io/v1
142+
kind: ClusterRole
143+
metadata:
144+
name: konflux-viewer-user-actions
145+
rules: []
146+
- name: given-group-crd-exists
147+
try:
148+
- apply:
149+
file: resources/group-crd.yaml
150+
- assert:
151+
resource:
152+
apiVersion: apiextensions.k8s.io/v1
153+
kind: CustomResourceDefinition
154+
metadata:
155+
name: groups.user.openshift.io
156+
status:
157+
conditions:
158+
- type: NamesAccepted
159+
status: "True"
160+
- type: Established
161+
status: "True"
162+
- name: Apply Kyverno ClusterPolicy
163+
try:
164+
- apply:
165+
file: ../generate-support-nslister-clusterrolebinding-clusterpolicy.yaml
166+
- assert:
167+
file: chainsaw-assert-clusterpolicy.yaml
168+
- name: Create konflux-support Group with initial users
169+
try:
170+
- create:
171+
file: ./resources/group-with-users.yaml
172+
- name: Verify initial ClusterRoleBinding
173+
try:
174+
- assert:
175+
resource:
176+
apiVersion: rbac.authorization.k8s.io/v1
177+
kind: ClusterRoleBinding
178+
metadata:
179+
name: konflux-support-nslister
180+
- name: Update Group with more users
181+
try:
182+
- apply:
183+
file: ./resources/group-with-more-users.yaml
184+
- name: Assert ClusterRoleBinding is updated with new users
185+
try:
186+
- assert:
187+
resource:
188+
apiVersion: rbac.authorization.k8s.io/v1
189+
kind: ClusterRoleBinding
190+
metadata:
191+
name: konflux-support-nslister
192+
labels:
193+
namespace-lister.konflux-ci.dev/use-for-access: 'true'
194+
roleRef:
195+
apiGroup: rbac.authorization.k8s.io
196+
kind: ClusterRole
197+
name: konflux-viewer-user-actions
198+
subjects:
199+
- apiGroup: rbac.authorization.k8s.io
200+
kind: User
201+
name: alice
202+
- apiGroup: rbac.authorization.k8s.io
203+
kind: User
204+
name: bob
205+
- apiGroup: rbac.authorization.k8s.io
206+
kind: User
207+
name: charlie
208+
- apiGroup: rbac.authorization.k8s.io
209+
kind: User
210+
name: david
211+
- apiGroup: rbac.authorization.k8s.io
212+
kind: User
213+
name: eve
214+
---
215+
apiVersion: chainsaw.kyverno.io/v1alpha1
216+
kind: Test
217+
metadata:
218+
name: clusterrolebinding-updated-when-users-removed
219+
spec:
220+
concurrent: false
221+
description: |
222+
Tests that when users are removed from the konflux-support Group,
223+
the ClusterRoleBinding subjects are updated to remove those users.
224+
steps:
225+
- name: given-kyverno-has-permission-on-resources
226+
try:
227+
- apply:
228+
file: ../kyverno_rbac.yaml
229+
- name: given-viewer-clusterrole-exists
230+
try:
231+
- apply:
232+
resource:
233+
apiVersion: rbac.authorization.k8s.io/v1
234+
kind: ClusterRole
235+
metadata:
236+
name: konflux-viewer-user-actions
237+
rules: []
238+
- name: given-group-crd-exists
239+
try:
240+
- apply:
241+
file: resources/group-crd.yaml
242+
- assert:
243+
resource:
244+
apiVersion: apiextensions.k8s.io/v1
245+
kind: CustomResourceDefinition
246+
metadata:
247+
name: groups.user.openshift.io
248+
status:
249+
conditions:
250+
- type: NamesAccepted
251+
status: "True"
252+
- type: Established
253+
status: "True"
254+
- name: Apply Kyverno ClusterPolicy
255+
try:
256+
- apply:
257+
file: ../generate-support-nslister-clusterrolebinding-clusterpolicy.yaml
258+
- assert:
259+
file: chainsaw-assert-clusterpolicy.yaml
260+
- name: Create konflux-support Group with multiple users
261+
try:
262+
- create:
263+
file: ./resources/group-with-users.yaml
264+
- name: Verify initial ClusterRoleBinding
265+
try:
266+
- assert:
267+
resource:
268+
apiVersion: rbac.authorization.k8s.io/v1
269+
kind: ClusterRoleBinding
270+
metadata:
271+
name: konflux-support-nslister
272+
- name: Update Group with fewer users
273+
try:
274+
- apply:
275+
file: ./resources/group-with-fewer-users.yaml
276+
- name: Assert ClusterRoleBinding is updated with fewer users
277+
try:
278+
- assert:
279+
resource:
280+
apiVersion: rbac.authorization.k8s.io/v1
281+
kind: ClusterRoleBinding
282+
metadata:
283+
name: konflux-support-nslister
284+
labels:
285+
namespace-lister.konflux-ci.dev/use-for-access: 'true'
286+
roleRef:
287+
apiGroup: rbac.authorization.k8s.io
288+
kind: ClusterRole
289+
name: konflux-viewer-user-actions
290+
subjects:
291+
- apiGroup: rbac.authorization.k8s.io
292+
kind: User
293+
name: alice
294+
---
295+
apiVersion: chainsaw.kyverno.io/v1alpha1
296+
kind: Test
297+
metadata:
298+
name: clusterrolebinding-with-empty-group
299+
spec:
300+
concurrent: false
301+
description: |
302+
Tests that when the konflux-support Group has no users,
303+
the ClusterRoleBinding is still created but with empty subjects.
304+
steps:
305+
- name: given-kyverno-has-permission-on-resources
306+
try:
307+
- apply:
308+
file: ../kyverno_rbac.yaml
309+
- name: given-viewer-clusterrole-exists
310+
try:
311+
- apply:
312+
resource:
313+
apiVersion: rbac.authorization.k8s.io/v1
314+
kind: ClusterRole
315+
metadata:
316+
name: konflux-viewer-user-actions
317+
rules: []
318+
- name: given-group-crd-exists
319+
try:
320+
- apply:
321+
file: resources/group-crd.yaml
322+
- assert:
323+
resource:
324+
apiVersion: apiextensions.k8s.io/v1
325+
kind: CustomResourceDefinition
326+
metadata:
327+
name: groups.user.openshift.io
328+
status:
329+
conditions:
330+
- type: NamesAccepted
331+
status: "True"
332+
- type: Established
333+
status: "True"
334+
- name: Apply Kyverno ClusterPolicy
335+
try:
336+
- apply:
337+
file: ../generate-support-nslister-clusterrolebinding-clusterpolicy.yaml
338+
- assert:
339+
file: chainsaw-assert-clusterpolicy.yaml
340+
- name: Create konflux-support Group with no users
341+
try:
342+
- create:
343+
file: ./resources/group-empty.yaml
344+
- name: Assert ClusterRoleBinding exists with correct metadata
345+
try:
346+
- assert:
347+
resource:
348+
apiVersion: rbac.authorization.k8s.io/v1
349+
kind: ClusterRoleBinding
350+
metadata:
351+
name: konflux-support-nslister
352+
labels:
353+
namespace-lister.konflux-ci.dev/use-for-access: 'true'
354+
roleRef:
355+
apiGroup: rbac.authorization.k8s.io
356+
kind: ClusterRole
357+
name: konflux-viewer-user-actions
358+

‎components/policies/development/konflux-rbac/konflux-support-nslister-access/.chainsaw-test/resources/group-crd.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: groups.user.openshift.io
5+
spec:
6+
group: user.openshift.io
7+
names:
8+
kind: Group
9+
listKind: GroupList
10+
plural: groups
11+
singular: group
12+
scope: Cluster
13+
versions:
14+
- name: v1
15+
served: true
16+
storage: true
17+
schema:
18+
openAPIV3Schema:
19+
type: object
20+
required:
21+
- users
22+
properties:
23+
users:
24+
type: array
25+
items:
26+
type: string
27+

0 commit comments

Comments
 (0)