From 5d0571c54699e9df3605919e4a7bca2fde9f29cd Mon Sep 17 00:00:00 2001 From: David Peraza Date: Tue, 23 Jul 2024 16:07:19 -0400 Subject: [PATCH] Enabling role, rolebinding and sa management for workspace admins (#4162) Signed-off-by: David Peraza --- .../tiers/src/appstudio/spacerole_admin.yaml | 29 ++ .../staging/appstudio/kustomization.yaml | 1 + .../appstudio/nstemplatetier-appstudio.yaml | 2 +- ...appstudio-admin-1876853981-1876853981.yaml | 309 ++++++++++++++++++ .../staging/appstudiolarge/kustomization.yaml | 1 + .../nstemplatetier-appstudiolarge.yaml | 2 +- ...udiolarge-admin-1884308846-1876853981.yaml | 309 ++++++++++++++++++ 7 files changed, 651 insertions(+), 2 deletions(-) create mode 100644 components/sandbox/tiers/staging/appstudio/tiertemplate-appstudio-admin-1876853981-1876853981.yaml create mode 100644 components/sandbox/tiers/staging/appstudiolarge/tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml diff --git a/components/sandbox/tiers/src/appstudio/spacerole_admin.yaml b/components/sandbox/tiers/src/appstudio/spacerole_admin.yaml index 7b4069859e0..42015206b0e 100644 --- a/components/sandbox/tiers/src/appstudio/spacerole_admin.yaml +++ b/components/sandbox/tiers/src/appstudio/spacerole_admin.yaml @@ -241,6 +241,35 @@ objects: - update - patch - delete + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create # RoleBinding that grants limited CRUD permissions to the User - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/components/sandbox/tiers/staging/appstudio/kustomization.yaml b/components/sandbox/tiers/staging/appstudio/kustomization.yaml index 3f9879e1f7f..b097223c91c 100644 --- a/components/sandbox/tiers/staging/appstudio/kustomization.yaml +++ b/components/sandbox/tiers/staging/appstudio/kustomization.yaml @@ -6,6 +6,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - nstemplatetier-appstudio.yaml +- tiertemplate-appstudio-admin-1876853981-1876853981.yaml - tiertemplate-appstudio-admin-2415879015-2415879015.yaml - tiertemplate-appstudio-clusterresources-809836689-809836689.yaml - tiertemplate-appstudio-contributor-1817914940-1817914940.yaml diff --git a/components/sandbox/tiers/staging/appstudio/nstemplatetier-appstudio.yaml b/components/sandbox/tiers/staging/appstudio/nstemplatetier-appstudio.yaml index 0e11825a7b1..fa81fa04c71 100644 --- a/components/sandbox/tiers/staging/appstudio/nstemplatetier-appstudio.yaml +++ b/components/sandbox/tiers/staging/appstudio/nstemplatetier-appstudio.yaml @@ -14,7 +14,7 @@ spec: - templateRef: appstudio-tenant-199961605-199961605 spaceRoles: admin: - templateRef: appstudio-admin-2415879015-2415879015 + templateRef: appstudio-admin-1876853981-1876853981 contributor: templateRef: appstudio-contributor-1817914940-1817914940 maintainer: diff --git a/components/sandbox/tiers/staging/appstudio/tiertemplate-appstudio-admin-1876853981-1876853981.yaml b/components/sandbox/tiers/staging/appstudio/tiertemplate-appstudio-admin-1876853981-1876853981.yaml new file mode 100644 index 00000000000..c831d07b39c --- /dev/null +++ b/components/sandbox/tiers/staging/appstudio/tiertemplate-appstudio-admin-1876853981-1876853981.yaml @@ -0,0 +1,309 @@ +# ---------------------------------------------------------------- +# Generated by cli - DO NOT EDIT +# ---------------------------------------------------------------- + +apiVersion: toolchain.dev.openshift.com/v1alpha1 +kind: TierTemplate +metadata: + name: appstudio-admin-1876853981-1876853981 + namespace: toolchain-host-operator +spec: + revision: 1876853981-1876853981 + template: + apiVersion: template.openshift.io/v1 + kind: Template + metadata: {} + objects: + - apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: appstudio-admin-user-actions + namespace: ${NAMESPACE} + rules: + - apiGroups: + - appstudio.redhat.com + resources: + - applications + - components + - imagerepositories + - componentdetectionqueries + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection + - apiGroups: + - appstudio.redhat.com + resources: + - promotionruns + - snapshotenvironmentbindings + - snapshots + - environments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - deploymenttargets + - deploymenttargetclaims + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - managed-gitops.redhat.com + resources: + - gitopsdeployments + - gitopsdeploymentmanagedenvironments + - gitopsdeploymentrepositorycredentials + - gitopsdeploymentsyncruns + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - results.tekton.dev + resources: + - results + - records + - logs + verbs: + - get + - list + - apiGroups: + - appstudio.redhat.com + resources: + - enterprisecontractpolicies + - integrationtestscenarios + - releases + - releasestrategies + - releaseplans + - releaseplanadmissions + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - jvmbuildservice.io + resources: + - jbsconfigs + - artifactbuilds + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - spiaccesstokenbindings + - spiaccesschecks + - spiaccesstokens + - spifilecontentrequests + - spiaccesstokendataupdates + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - remotesecrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - buildpipelineselectors + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resourceNames: + - appstudio-pipeline + resources: + - serviceaccounts + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - pods/exec + verbs: + - create + - apiGroups: + - toolchain.dev.openshift.com + resources: + - spacebindingrequests + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - projctl.konflux.dev + resources: + - projects + - projectdevelopmentstreams + - projectdevelopmentstreamtemplates + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - external-secrets.io + resources: + - secretstores + - externalsecrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create + - apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: appstudio-admin-${USERNAME}-actions-user + namespace: ${NAMESPACE} + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: appstudio-admin-user-actions + subjects: + - kind: User + name: ${USERNAME} + - apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: appstudio-${USERNAME}-view-user + namespace: ${NAMESPACE} + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view + subjects: + - kind: User + name: ${USERNAME} + parameters: + - name: NAMESPACE + required: true + - name: USERNAME + required: true + tierName: appstudio + type: admin diff --git a/components/sandbox/tiers/staging/appstudiolarge/kustomization.yaml b/components/sandbox/tiers/staging/appstudiolarge/kustomization.yaml index af4b81d48f2..381f5d086b4 100644 --- a/components/sandbox/tiers/staging/appstudiolarge/kustomization.yaml +++ b/components/sandbox/tiers/staging/appstudiolarge/kustomization.yaml @@ -6,6 +6,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - nstemplatetier-appstudiolarge.yaml +- tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml - tiertemplate-appstudiolarge-admin-1884308846-2415879015.yaml - tiertemplate-appstudiolarge-clusterresources-1884308846-809836689.yaml - tiertemplate-appstudiolarge-contributor-1884308846-1817914940.yaml diff --git a/components/sandbox/tiers/staging/appstudiolarge/nstemplatetier-appstudiolarge.yaml b/components/sandbox/tiers/staging/appstudiolarge/nstemplatetier-appstudiolarge.yaml index af3b1d1f931..76f3bd7818a 100644 --- a/components/sandbox/tiers/staging/appstudiolarge/nstemplatetier-appstudiolarge.yaml +++ b/components/sandbox/tiers/staging/appstudiolarge/nstemplatetier-appstudiolarge.yaml @@ -14,7 +14,7 @@ spec: - templateRef: appstudiolarge-tenant-1884308846-199961605 spaceRoles: admin: - templateRef: appstudiolarge-admin-1884308846-2415879015 + templateRef: appstudiolarge-admin-1884308846-1876853981 contributor: templateRef: appstudiolarge-contributor-1884308846-1817914940 maintainer: diff --git a/components/sandbox/tiers/staging/appstudiolarge/tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml b/components/sandbox/tiers/staging/appstudiolarge/tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml new file mode 100644 index 00000000000..5d0eee26903 --- /dev/null +++ b/components/sandbox/tiers/staging/appstudiolarge/tiertemplate-appstudiolarge-admin-1884308846-1876853981.yaml @@ -0,0 +1,309 @@ +# ---------------------------------------------------------------- +# Generated by cli - DO NOT EDIT +# ---------------------------------------------------------------- + +apiVersion: toolchain.dev.openshift.com/v1alpha1 +kind: TierTemplate +metadata: + name: appstudiolarge-admin-1884308846-1876853981 + namespace: toolchain-host-operator +spec: + revision: 1884308846-1876853981 + template: + apiVersion: template.openshift.io/v1 + kind: Template + metadata: {} + objects: + - apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: appstudio-admin-user-actions + namespace: ${NAMESPACE} + rules: + - apiGroups: + - appstudio.redhat.com + resources: + - applications + - components + - imagerepositories + - componentdetectionqueries + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection + - apiGroups: + - appstudio.redhat.com + resources: + - promotionruns + - snapshotenvironmentbindings + - snapshots + - environments + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - deploymenttargets + - deploymenttargetclaims + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - managed-gitops.redhat.com + resources: + - gitopsdeployments + - gitopsdeploymentmanagedenvironments + - gitopsdeploymentrepositorycredentials + - gitopsdeploymentsyncruns + verbs: + - get + - list + - watch + - apiGroups: + - tekton.dev + resources: + - pipelineruns + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - results.tekton.dev + resources: + - results + - records + - logs + verbs: + - get + - list + - apiGroups: + - appstudio.redhat.com + resources: + - enterprisecontractpolicies + - integrationtestscenarios + - releases + - releasestrategies + - releaseplans + - releaseplanadmissions + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - jvmbuildservice.io + resources: + - jbsconfigs + - artifactbuilds + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - spiaccesstokenbindings + - spiaccesschecks + - spiaccesstokens + - spifilecontentrequests + - spiaccesstokendataupdates + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - remotesecrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - appstudio.redhat.com + resources: + - buildpipelineselectors + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resourceNames: + - appstudio-pipeline + resources: + - serviceaccounts + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - "" + resources: + - pods/exec + verbs: + - create + - apiGroups: + - toolchain.dev.openshift.com + resources: + - spacebindingrequests + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - projctl.konflux.dev + resources: + - projects + - projectdevelopmentstreams + - projectdevelopmentstreamtemplates + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - external-secrets.io + resources: + - secretstores + - externalsecrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - serviceaccounts/token + verbs: + - create + - apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: appstudio-admin-${USERNAME}-actions-user + namespace: ${NAMESPACE} + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: appstudio-admin-user-actions + subjects: + - kind: User + name: ${USERNAME} + - apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: appstudio-${USERNAME}-view-user + namespace: ${NAMESPACE} + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view + subjects: + - kind: User + name: ${USERNAME} + parameters: + - name: NAMESPACE + required: true + - name: USERNAME + required: true + tierName: appstudiolarge + type: admin