Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expand docstring for hub_cloud_permissions #16

Merged
merged 3 commits into from
Apr 20, 2024
Merged

Expand docstring for hub_cloud_permissions #16

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1089f40
Expand docstring for `hub_cloud_permissions`
yuvipanda Apr 20, 2024
2d15c17
docs: minor clarification regarding k8s namespace and hub
consideRatio Apr 20, 2024
664c7f0
Add clarity to where constraints are, basehub as compared to terraform
consideRatio Apr 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 21 additions & 11 deletions terraform/aws/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,17 +55,27 @@ variable "hub_cloud_permissions" {
)
default = {}
description = <<-EOT
Map of cloud permissions given to a particular hub (k8s namespace) and
its associated IAM Role's that are 1:1 with k8s ServiceAccounts.

Currently supported are:

1. bucket_admin_access: List of S3 storage buckets that the associated aws-iam-role/k8s-service-account should have read
and write permissions for.
2. bucket_readonly_access: List of S3 storage buckets that users on this hub should have read
permissions for.
3. extra_iam_policy: An AWS IAM Policy document that grants additional rights to the users
on this hub when talking to AWS services.
Cloud permissions attached to Kubernetes Service Accounts in a particular
k8s namespace (hub) in this cluster.

The key is a Kubernetes namespace, which by convention in 2i2c clusters
is also the name of the hub.

The value is itself a map, as each hub can have multiple Kubernetes Service
Accounts attached to it, for different kinds of users. The key is the name
of the Kubernetes Service Account. By convention, the currently supported keys
are are `user-sa` (for non-admin users on the hub) and `admin-sa` (for admin
users on the hub). The value can be one of:
consideRatio marked this conversation as resolved.
Show resolved Hide resolved

1. bucket_admin_access: List of S3 storage buckets to grant full read & write
permissions to.
2. bucket_readonly_access: List of S3 storage buckets to grant full read
permissions to.
3. extra_iam_policy: An AWS IAM Policy document that grants additional rights
to this Kubernetes Service Account.

Note that these are independent of each other - so if you want both admins
and non-admins to have a set of permissions, you may need to repeat them.
EOT
}

Expand Down