Examples with PolicyRule io.fabric8.kubernetes.api.model.rbac.PolicyRule used on opensource projects

Example 1 with PolicyRule

use of io.fabric8.kubernetes.api.model.rbac.PolicyRule in project strimzi by strimzi.

the class EntityOperator method generateRole.

/**
 * Read the entity operator ClusterRole, and use the rules to create a new Role.
 * This is done to avoid duplication of the rules set defined in source code.
 * If the namespace of the role is not the same as the namespace of the parent resource (Kafka CR), we do not set
 * the owner reference.
 *
 * @param ownerNamespace        The namespace of the parent resource (the Kafka CR)
 * @param namespace             The namespace this role will be located
 *
 * @return role for the entity operator
 */
public Role generateRole(String ownerNamespace, String namespace) {
    List<PolicyRule> rules;
    try (BufferedReader br = new BufferedReader(new InputStreamReader(Main.class.getResourceAsStream("/cluster-roles/031-ClusterRole-strimzi-entity-operator.yaml"), StandardCharsets.UTF_8))) {
        String yaml = br.lines().collect(Collectors.joining(System.lineSeparator()));
        ObjectMapper yamlReader = new ObjectMapper(new YAMLFactory());
        ClusterRole cr = yamlReader.readValue(yaml, ClusterRole.class);
        rules = cr.getRules();
    } catch (IOException e) {
        LOGGER.errorCr(reconciliation, "Failed to read entity-operator ClusterRole.", e);
        throw new RuntimeException(e);
    }
    Role role = super.generateRole(namespace, rules);
    // We set OwnerReference only within the same namespace since it does not work cross-namespace
    if (!namespace.equals(ownerNamespace)) {
        role.getMetadata().setOwnerReferences(Collections.emptyList());
    }
    return role;
}

Example 2 with PolicyRule

use of io.fabric8.kubernetes.api.model.rbac.PolicyRule in project strimzi by strimzi.

the class EntityOperatorTest method testRole.

@ParallelTest
public void testRole() {
    Kafka resource = new KafkaBuilder(ResourceUtils.createKafka(namespace, cluster, replicas, image, healthDelay, healthTimeout)).editSpec().editOrNewEntityOperator().endEntityOperator().endSpec().build();
    EntityOperator eo = EntityOperator.fromCrd(new Reconciliation("test", resource.getKind(), resource.getMetadata().getNamespace(), resource.getMetadata().getName()), resource, VERSIONS);
    Role role = eo.generateRole(namespace, namespace);
    assertThat(role.getMetadata().getName(), is("foo-entity-operator"));
    assertThat(role.getMetadata().getNamespace(), is(namespace));
    List<PolicyRule> rules = new ArrayList<>();
    rules.add(new PolicyRuleBuilder().addToResources("kafkatopics", "kafkatopics/status", "kafkausers", "kafkausers/status").addToVerbs("get", "list", "watch", "create", "patch", "update", "delete").addToApiGroups(Constants.RESOURCE_GROUP_NAME).build());
    rules.add(new PolicyRuleBuilder().addToResources("events").addToVerbs("create").addToApiGroups("").build());
    rules.add(new PolicyRuleBuilder().addToResources("secrets").addToVerbs("get", "list", "watch", "create", "delete", "patch", "update").addToApiGroups("").build());
    assertThat(role.getRules(), is(rules));
}

Example 3 with PolicyRule

use of io.fabric8.kubernetes.api.model.rbac.PolicyRule in project strimzi-kafka-operator by strimzi.

the class EntityOperatorTest method testRole.

@ParallelTest
public void testRole() {
    Kafka resource = new KafkaBuilder(ResourceUtils.createKafka(namespace, cluster, replicas, image, healthDelay, healthTimeout)).editSpec().editOrNewEntityOperator().endEntityOperator().endSpec().build();
    EntityOperator eo = EntityOperator.fromCrd(new Reconciliation("test", resource.getKind(), resource.getMetadata().getNamespace(), resource.getMetadata().getName()), resource, VERSIONS);
    Role role = eo.generateRole(namespace, namespace);
    assertThat(role.getMetadata().getName(), is("foo-entity-operator"));
    assertThat(role.getMetadata().getNamespace(), is(namespace));
    List<PolicyRule> rules = new ArrayList<>();
    rules.add(new PolicyRuleBuilder().addToResources("kafkatopics", "kafkatopics/status", "kafkausers", "kafkausers/status").addToVerbs("get", "list", "watch", "create", "patch", "update", "delete").addToApiGroups(Constants.RESOURCE_GROUP_NAME).build());
    rules.add(new PolicyRuleBuilder().addToResources("events").addToVerbs("create").addToApiGroups("").build());
    rules.add(new PolicyRuleBuilder().addToResources("secrets").addToVerbs("get", "list", "watch", "create", "delete", "patch", "update").addToApiGroups("").build());
    assertThat(role.getRules(), is(rules));
}

Example 4 with PolicyRule

use of io.fabric8.kubernetes.api.model.rbac.PolicyRule in project strimzi-kafka-operator by strimzi.

the class EntityOperator method generateRole.

/**
 * Read the entity operator ClusterRole, and use the rules to create a new Role.
 * This is done to avoid duplication of the rules set defined in source code.
 * If the namespace of the role is not the same as the namespace of the parent resource (Kafka CR), we do not set
 * the owner reference.
 *
 * @param ownerNamespace        The namespace of the parent resource (the Kafka CR)
 * @param namespace             The namespace this role will be located
 *
 * @return role for the entity operator
 */
public Role generateRole(String ownerNamespace, String namespace) {
    List<PolicyRule> rules;
    try (BufferedReader br = new BufferedReader(new InputStreamReader(Main.class.getResourceAsStream("/cluster-roles/031-ClusterRole-strimzi-entity-operator.yaml"), StandardCharsets.UTF_8))) {
        String yaml = br.lines().collect(Collectors.joining(System.lineSeparator()));
        ObjectMapper yamlReader = new ObjectMapper(new YAMLFactory());
        ClusterRole cr = yamlReader.readValue(yaml, ClusterRole.class);
        rules = cr.getRules();
    } catch (IOException e) {
        LOGGER.errorCr(reconciliation, "Failed to read entity-operator ClusterRole.", e);
        throw new RuntimeException(e);
    }
    Role role = super.generateRole(namespace, rules);
    // We set OwnerReference only within the same namespace since it does not work cross-namespace
    if (!namespace.equals(ownerNamespace)) {
        role.getMetadata().setOwnerReferences(Collections.emptyList());
    }
    return role;
}