Add support for azure custom roles

src/operator/api/v1beta1/clientintents_types.go

@@ -258,13 +258,22 @@ type Intent struct {
 	//+optional
 	AzureRoles []string `json:"azureRoles,omitempty" yaml:"azureRoles,omitempty"`
 
+	//+optional
+	AzureDataActions []AzureDataAction `json:"azureDataActions,omitempty" yaml:"azureDataActions,omitempty"`
+
+	//+optional
+	AzureActions []AzureAction `json:"azureActions,omitempty" yaml:"azureActions,omitempty"`
+
 	//+optional
 	AzureKeyVaultPolicy *AzureKeyVaultPolicy `json:"azureKeyVaultPolicy,omitempty" yaml:"azureKeyVaultPolicy,omitempty"`
 
 	//+optional
 	Internet *Internet `json:"internet,omitempty" yaml:"internet,omitempty"`
 }
 
+type AzureDataAction string
+type AzureAction string
+
 type Internet struct {
 	//+optional
 	Domains []string `json:"domains,omitempty" yaml:"domains,omitempty"`

src/operator/api/v1beta1/webhooks.go

@@ -248,22 +248,28 @@ func (in *ClientIntents) ConvertTo(dstRaw conversion.Hub) error {
 		}
 		if call.Type == IntentTypeAzure {
 			dst.Spec.Targets[i] = v2alpha1.Target{Azure: lo.ToPtr(v2alpha1.AzureTarget{Scope: call.Name, Roles: call.AzureRoles})}
-			if call.AzureKeyVaultPolicy == nil {
-				continue
+			if len(call.AzureActions) > 0 {
+				dst.Spec.Targets[i].Azure.Actions = lo.Map(call.AzureActions, func(action AzureAction, _ int) v2alpha1.AzureAction { return v2alpha1.AzureAction(action) })
+			}
+			if len(call.AzureDataActions) > 0 {
+				dst.Spec.Targets[i].Azure.DataActions = lo.Map(call.AzureDataActions, func(action AzureDataAction, _ int) v2alpha1.AzureDataAction { return v2alpha1.AzureDataAction(action) })
+			}
+
+			if call.AzureKeyVaultPolicy != nil {
+				dst.Spec.Targets[i].Azure.KeyVaultPolicy = &v2alpha1.AzureKeyVaultPolicy{}
+				dst.Spec.Targets[i].Azure.KeyVaultPolicy.KeyPermissions = lo.Map(call.AzureKeyVaultPolicy.KeyPermissions, func(permission AzureKeyVaultKeyPermission, _ int) v2alpha1.AzureKeyVaultKeyPermission {
+					return v2alpha1.AzureKeyVaultKeyPermission(permission)
+				})
+				dst.Spec.Targets[i].Azure.KeyVaultPolicy.SecretPermissions = lo.Map(call.AzureKeyVaultPolicy.SecretPermissions, func(permission AzureKeyVaultSecretPermission, _ int) v2alpha1.AzureKeyVaultSecretPermission {
+					return v2alpha1.AzureKeyVaultSecretPermission(permission)
+				})
+				dst.Spec.Targets[i].Azure.KeyVaultPolicy.CertificatePermissions = lo.Map(call.AzureKeyVaultPolicy.CertificatePermissions, func(permission AzureKeyVaultCertificatePermission, _ int) v2alpha1.AzureKeyVaultCertificatePermission {
+					return v2alpha1.AzureKeyVaultCertificatePermission(permission)
+				})
+				dst.Spec.Targets[i].Azure.KeyVaultPolicy.StoragePermissions = lo.Map(call.AzureKeyVaultPolicy.StoragePermissions, func(permission AzureKeyVaultStoragePermission, _ int) v2alpha1.AzureKeyVaultStoragePermission {
+					return v2alpha1.AzureKeyVaultStoragePermission(permission)
+				})
 			}
-			dst.Spec.Targets[i].Azure.KeyVaultPolicy = &v2alpha1.AzureKeyVaultPolicy{}
-			dst.Spec.Targets[i].Azure.KeyVaultPolicy.KeyPermissions = lo.Map(call.AzureKeyVaultPolicy.KeyPermissions, func(permission AzureKeyVaultKeyPermission, _ int) v2alpha1.AzureKeyVaultKeyPermission {
-				return v2alpha1.AzureKeyVaultKeyPermission(permission)
-			})
-			dst.Spec.Targets[i].Azure.KeyVaultPolicy.SecretPermissions = lo.Map(call.AzureKeyVaultPolicy.SecretPermissions, func(permission AzureKeyVaultSecretPermission, _ int) v2alpha1.AzureKeyVaultSecretPermission {
-				return v2alpha1.AzureKeyVaultSecretPermission(permission)
-			})
-			dst.Spec.Targets[i].Azure.KeyVaultPolicy.CertificatePermissions = lo.Map(call.AzureKeyVaultPolicy.CertificatePermissions, func(permission AzureKeyVaultCertificatePermission, _ int) v2alpha1.AzureKeyVaultCertificatePermission {
-				return v2alpha1.AzureKeyVaultCertificatePermission(permission)
-			})
-			dst.Spec.Targets[i].Azure.KeyVaultPolicy.StoragePermissions = lo.Map(call.AzureKeyVaultPolicy.StoragePermissions, func(permission AzureKeyVaultStoragePermission, _ int) v2alpha1.AzureKeyVaultStoragePermission {
-				return v2alpha1.AzureKeyVaultStoragePermission(permission)
-			})
 		}
 		if call.Type == IntentTypeInternet && call.Internet != nil {
 			dst.Spec.Targets[i] = v2alpha1.Target{Internet: lo.ToPtr(v2alpha1.Internet{Domains: call.Internet.Domains, Ports: call.Internet.Ports, Ips: call.Internet.Ips})}
@@ -335,6 +341,12 @@ func (in *ClientIntents) ConvertFrom(srcRaw conversion.Hub) error {
 		}
 		if target.Azure != nil {
 			in.Spec.Calls[i] = Intent{Type: IntentTypeAzure, Name: target.Azure.Scope, AzureRoles: target.Azure.Roles}
+			if len(target.Azure.Actions) > 0 {
+				in.Spec.Calls[i].AzureActions = lo.Map(target.Azure.Actions, func(action v2alpha1.AzureAction, _ int) AzureAction { return AzureAction(action) })
+			}
+			if len(target.Azure.DataActions) > 0 {
+				in.Spec.Calls[i].AzureDataActions = lo.Map(target.Azure.DataActions, func(action v2alpha1.AzureDataAction, _ int) AzureDataAction { return AzureDataAction(action) })
+			}
 			if target.Azure.KeyVaultPolicy == nil {
 				continue
 			}

src/operator/api/v1beta1/webhooks_test.go

@@ -241,6 +241,51 @@ func (t *WebhooksTestSuite) TestClientIntentsFromV2_EmptySliceHTTPShouldNotBeTyp
 	t.Require().Equal("", string(converted.Spec.Calls[1].Type))
 }
 
+func (t *WebhooksTestSuite) TestClientIntentsAzureActionsDataActions() {
+	// Create a ClientIntents with random data
+	original := &ClientIntents{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test",
+			Namespace: "test",
+		},
+		Spec: &IntentsSpec{
+			Service: Service{
+				Name: "test",
+			},
+			Calls: []Intent{
+				{
+					Name: "testscope1",
+					Type: IntentTypeAzure,
+					AzureDataActions: []AzureDataAction{
+						"testDataAction1",
+						"testDataAction2",
+					},
+				},
+				{
+					Name: "testscope2",
+					Type: IntentTypeAzure,
+					AzureActions: []AzureAction{
+						"testAction1",
+						"testAction2",
+					},
+				},
+			},
+		},
+	}
+
+	// ConvertTo
+	dstRaw := &v2alpha1.ClientIntents{}
+	err := original.ConvertTo(dstRaw)
+	t.Require().NoError(err)
+
+	// ConvertFrom
+	converted := &ClientIntents{}
+	err = converted.ConvertFrom(dstRaw)
+	t.Require().NoError(err)
+
+	t.Require().Equal(original.Spec, converted.Spec)
+}
+
 func TestWebhooksTestSuite(t *testing.T) {
 	suite.Run(t, new(WebhooksTestSuite))
 }

src/operator/api/v2alpha1/clientintents_types.go

@@ -276,12 +276,21 @@ type GCPTarget struct {
 }
 
 type AzureTarget struct {
-	Scope string   `json:"scope,omitempty" yaml:"scope,omitempty"`
+	Scope string `json:"scope,omitempty" yaml:"scope,omitempty"`
+	//+optional
 	Roles []string `json:"roles,omitempty" yaml:"roles,omitempty"`
 	//+optional
 	KeyVaultPolicy *AzureKeyVaultPolicy `json:"keyVaultPolicy,omitempty" yaml:"keyVaultPolicy,omitempty"`
+	//+optional
+	Actions []AzureAction `json:"actions,omitempty" yaml:"actions,omitempty"`
+	//+optional
+	DataActions []AzureDataAction `json:"dataActions,omitempty" yaml:"dataActions,omitempty"`
 }
 
+type AzureAction string
+
+type AzureDataAction string
+
 type KubernetesTarget struct {
 	Name string `json:"name" yaml:"name"`
 	//+optional
@@ -874,6 +883,13 @@ func (in *Target) ConvertToCloudFormat(ctx context.Context, k8sClient client.Cli
 
 	if in.Azure != nil {
 		intentInput.AzureRoles = lo.ToSlicePtr(in.Azure.Roles)
+		intentInput.AzureActions = lo.Map(in.Azure.Actions, func(action AzureAction, _ int) *string {
+			return lo.ToPtr(string(action))
+		})
+		intentInput.AzureDataActions = lo.Map(in.Azure.DataActions, func(action AzureDataAction, _ int) *string {
+			return lo.ToPtr(string(action))
+		})
+
 		if in.Azure.KeyVaultPolicy != nil {
 			intentInput.AzureKeyVaultPolicy = &graphqlclient.AzureKeyVaultPolicyInput{
 				CertificatePermissions: enumSliceToStrPtrSlice(in.Azure.KeyVaultPolicy.CertificatePermissions),

src/operator/config/crd/k8s.otterize.com_clientintents.patched

@@ -485,6 +485,14 @@ spec:
                         items:
                           type: string
                         type: array
+                      azureActions:
+                        items:
+                          type: string
+                        type: array
+                      azureDataActions:
+                        items:
+                          type: string
+                        type: array
                       azureKeyVaultPolicy:
                         properties:
                           certificatePermissions:
@@ -737,6 +745,14 @@ spec:
                         type: object
                       azure:
                         properties:
+                          actions:
+                            items:
+                              type: string
+                            type: array
+                          dataActions:
+                            items:
+                              type: string
+                            type: array
                           keyVaultPolicy:
                             properties:
                               certificatePermissions:

src/operator/config/crd/k8s.otterize.com_clientintents.yaml

@@ -473,6 +473,14 @@ spec:
                       items:
                         type: string
                       type: array
+                    azureActions:
+                      items:
+                        type: string
+                      type: array
+                    azureDataActions:
+                      items:
+                        type: string
+                      type: array
                     azureKeyVaultPolicy:
                       properties:
                         certificatePermissions:
@@ -726,6 +734,14 @@ spec:
                       type: object
                     azure:
                       properties:
+                        actions:
+                          items:
+                            type: string
+                          type: array
+                        dataActions:
+                          items:
+                            type: string
+                          type: array
                         keyVaultPolicy:
                           properties:
                             certificatePermissions: