Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/add sso roles #480

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+232 −11
Open

Feature/add sso roles #480

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0731074
add sso roles
klinch0 Nov 21, 2024
4f58d24
add KeycloakRealmGroup
klinch0 Nov 25, 2024
f02bbf0
fix configure and add KeycloakRealmGroup
klinch0 Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/apps/tenant/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ description: Separated tenant namespace
icon: /logos/tenant.svg

type: application
version: 1.5.0
version: 1.6.0
49 changes: 49 additions & 0 deletions packages/apps/tenant/templates/keycloakgroups.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmGroup
metadata:
name: {{ include "tenant.name" . }}-view
namespace: {{ include "tenant.name" . }}
spec:
name: {{ include "tenant.name" . }}-view
realmRef:
name: keycloakrealm-cozy
kind: ClusterKeycloakRealm

---

apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmGroup
metadata:
name: {{ include "tenant.name" . }}-use
namespace: {{ include "tenant.name" . }}
spec:
name: {{ include "tenant.name" . }}-use
realmRef:
name: keycloakrealm-cozy
kind: ClusterKeycloakRealm

---

apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmGroup
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: {{ include "tenant.name" . }}
spec:
name: {{ include "tenant.name" . }}-admin
realmRef:
name: keycloakrealm-cozy
kind: ClusterKeycloakRealm

---

apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmGroup
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: {{ include "tenant.name" . }}
spec:
name: {{ include "tenant.name" . }}-super-admin
realmRef:
name: keycloakrealm-cozy
kind: ClusterKeycloakRealm
140 changes: 140 additions & 0 deletions packages/apps/tenant/templates/tenant.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,3 +88,143 @@ roleRef:
kind: Role
name: {{ include "tenant.name" . }}
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-view
namespace: {{ include "tenant.name" . }}
rules:
- apiGroups: ["apps.cozystack.io"]
resources: ["*"]
verbs: ["get", "list", "watch"]
Comment on lines +98 to +100
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Restrict wildcard access to specific resources

Using resources: ["*"] for apps.cozystack.io is overly permissive, even for read-only access. Consider explicitly listing the allowed resources as done in the admin role.

  - apiGroups: ["apps.cozystack.io"]
-   resources: ["*"]
+   resources: ["buckets", "clickhouses", "ferretdb", "foos", "httpcaches", "kafkas", "kuberneteses", "mysqls", "natses", "postgreses", "rabbitmqs", "redises", "seaweedfses", "tcpbalancers", "virtualmachines", "vmdisks", "vminstances"]
    verbs: ["get", "list", "watch"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- apiGroups: ["apps.cozystack.io"]
resources: ["*"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps.cozystack.io"]
resources: ["buckets", "clickhouses", "ferretdb", "foos", "httpcaches", "kafkas", "kuberneteses", "mysqls", "natses", "postgreses", "rabbitmqs", "redises", "seaweedfses", "tcpbalancers", "virtualmachines", "vmdisks", "vminstances"]
verbs: ["get", "list", "watch"]

- apiGroups: ["helm.toolkit.fluxcd.io"]
resources: ["helmreleases"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-view
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-view
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-view
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-use
namespace: {{ include "tenant.name" . }}
rules:
- apiGroups: ["apps.cozystack.io"]
resources: ["*"]
verbs: ["get", "list", "watch"]
kvaps marked this conversation as resolved.
Show resolved Hide resolved
- apiGroups: ["helm.toolkit.fluxcd.io"]
resources: ["helmreleases"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
kvaps marked this conversation as resolved.
Show resolved Hide resolved
- apiGroups: ["kubevirt.io"]
resources: ["virtualmachines"]
verbs: ["get", "list"]
- apiGroups: ["subresources.kubevirt.io"]
resources: ["virtualmachineinstances/console", "virtualmachineinstances/vnc"]
verbs: ["get", "list"]
kvaps marked this conversation as resolved.
Show resolved Hide resolved
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-use
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-use
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-use
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: {{ include "tenant.name" . }}
rules:
- apiGroups: ["helm.toolkit.fluxcd.io"]
resources: ["helmreleases"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["pods/log", "pods"]
verbs: ["get", "list", "watch", "delete"]
kvaps marked this conversation as resolved.
Show resolved Hide resolved
- apiGroups: ["kubevirt.io"]
resources: ["virtualmachines"]
verbs: ["get", "list"]
- apiGroups: ["subresources.kubevirt.io"]
resources: ["virtualmachineinstances/console", "virtualmachineinstances/vnc"]
verbs: ["get", "list"]
- apiGroups: ["apps.cozystack.io"]
resources: ["buckets", "clickhouses", "ferretdb", "foos", "httpcaches", "kafkas", "kuberneteses", "mysqls", "natses", "postgreses", "rabbitmqs", "redises", "seaweedfses", "tcpbalancers", "virtualmachines", "vmdisks", "vminstances"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-admin
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-admin
apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: {{ include "tenant.name" . }}
rules:
- apiGroups: ["helm.toolkit.fluxcd.io"]
resources: ["helmreleases"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["pods/log", "pods"]
verbs: ["get", "list", "watch", "delete"]
Comment on lines +204 to +206
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Standardize permissions between related resources

Same inconsistency as admin role between pods and virtualmachines permissions.

  - apiGroups: [""]
    resources: ["pods/log", "pods"]
    verbs: ["get", "list", "watch", "delete"]
  - apiGroups: ["kubevirt.io"]
    resources: ["virtualmachines"]
-   verbs: ["get", "list"]
+   verbs: ["get", "list", "watch", "delete"]

Also applies to: 207-209

- apiGroups: ["kubevirt.io"]
resources: ["virtualmachines"]
verbs: ["get", "list"]
- apiGroups: ["subresources.kubevirt.io"]
resources: ["virtualmachineinstances/console", "virtualmachineinstances/vnc"]
verbs: ["get", "list"]
- apiGroups: ["apps.cozystack.io"]
resources: ["*"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "tenant.name" . }}-super-admin
namespace: {{ include "tenant.name" . }}
subjects:
- kind: Group
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: {{ include "tenant.name" . }}-super-admin
apiGroup: rbac.authorization.k8s.io
3 changes: 2 additions & 1 deletion packages/apps/versions_map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,8 @@ tenant 1.2.0 15478a88
tenant 1.3.0 ceefae03
tenant 1.3.1 c56e5769
tenant 1.4.0 94c688f7
tenant 1.5.0 HEAD
tenant 1.5.0 48128743
kvaps marked this conversation as resolved.
Show resolved Hide resolved
tenant 1.6.0 HEAD
virtual-machine 0.1.4 f2015d6
virtual-machine 0.1.5 7cd7de7
virtual-machine 0.2.0 5ca8823
Expand Down
7 changes: 7 additions & 0 deletions packages/core/platform/bundles/distro-full.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,3 +188,10 @@ releases:
namespace: cozy-keycloak
optional: true
dependsOn: [keycloak]

- name: keycloak-configure
releaseName: keycloak-configure
chart: cozy-keycloak-configure
namespace: cozy-keycloak
optional: true
dependsOn: [keycloak-operator]
7 changes: 7 additions & 0 deletions packages/core/platform/bundles/distro-hosted.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,3 +138,10 @@ releases:
namespace: cozy-keycloak
optional: true
dependsOn: [keycloak]

- name: keycloak-configure
releaseName: keycloak-configure
chart: cozy-keycloak-configure
namespace: cozy-keycloak
optional: true
dependsOn: [keycloak-operator]
6 changes: 6 additions & 0 deletions packages/core/platform/bundles/paas-full.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,3 +261,9 @@ releases:
chart: cozy-keycloak-operator
namespace: cozy-keycloak
dependsOn: [keycloak]

- name: keycloak-configure
releaseName: keycloak-configure
chart: cozy-keycloak-configure
namespace: cozy-keycloak
dependsOn: [keycloak-operator]
kvaps marked this conversation as resolved.
Show resolved Hide resolved
6 changes: 6 additions & 0 deletions packages/core/platform/bundles/paas-hosted.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,3 +157,9 @@ releases:
chart: cozy-keycloak-operator
namespace: cozy-keycloak
dependsOn: [keycloak]

- name: keycloak-configure
releaseName: keycloak-configure
chart: cozy-keycloak-configure
namespace: cozy-keycloak
dependsOn: [keycloak-operator]
3 changes: 3 additions & 0 deletions packages/system/keycloak-configure/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
apiVersion: v2
name: cozy-keycloak-configure
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
18 changes: 9 additions & 9 deletions ...loak-operator/templates/configure-kk.yaml → ...oak-configure/templates/configure-kk.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,25 @@
{{- $apiServerAdress := index $cozyConfig.data "api-server-adress" }}
{{- $k8sClient := randAlphaNum 32 -}}

apiVersion: v1.edp.epam.com/v1
kind: Keycloak
apiVersion: v1.edp.epam.com/v1alpha1
kind: ClusterKeycloak
metadata:
name: keycloak-cozy
namespace: {{ .Release.Namespace }}
spec:
secret: keycloak-credentials
url: https://keycloak.{{ $host }}

---

apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealm
apiVersion: v1.edp.epam.com/v1alpha1
kind: ClusterKeycloakRealm
metadata:
name: keycloakrealm-cozy
namespace: {{ .Release.Namespace }}
spec:
realmName: cozy
keycloakRef:
name: keycloak-cozy
kind: Keycloak
clusterKeycloakRef: keycloak-cozy

---

Expand All @@ -33,7 +33,7 @@ spec:
name: groups
realmRef:
name: keycloakrealm-cozy
kind: KeycloakRealm
kind: ClusterKeycloakRealm
description: "Group Membership"
protocol: openid-connect
protocolMappers:
Expand Down Expand Up @@ -68,7 +68,7 @@ spec:
enabled: true
realmRef:
name: keycloakrealm-cozy
kind: KeycloakRealm
kind: ClusterKeycloakRealm
secret: $k8s-client:client-secret-key
advancedProtocolMappers: true
authorizationServicesEnabled: true
Expand Down
2 changes: 2 additions & 0 deletions packages/system/keycloak-operator/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
keycloak-operator:
clusterReconciliationEnabled: true
Loading