Skip to content

Commit cb029a1

Browse files
oliverbaehleroliverbaehler
authored
feat(config): add usernames property identify specific users as capsule users (#1606)
* feat(config): add usernames property identify specific users as capsule users Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): improve admission configurations Signed-off-by: Oliver Bähler <[email protected]> * feat(helm): improve admission configurations Signed-off-by: Oliver Bähler <[email protected]> * feat(config): add usernames property identify specific users as capsule users Signed-off-by: Oliver Bähler <[email protected]> * feat(config): add usernames property identify specific users as capsule users Signed-off-by: Oliver Bähler <[email protected]> --------- Signed-off-by: Oliver Bähler <[email protected]>
1 parent 8ba8aa7 commit cb029a1

File tree

16 files changed

+94
-145
lines changed

16 files changed

+94
-145
lines changed

‎api/v1beta2/capsuleconfiguration_types.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ import (
1111

1212
// CapsuleConfigurationSpec defines the Capsule configuration.
1313
type CapsuleConfigurationSpec struct {
14-
// Names of the groups for Capsule users.
14+
// Names of the users considered as Capsule users.
15+
UserNames []string `json:"userNames,omitempty"`
16+
// Names of the groups considered as Capsule users.
1517
// +kubebuilder:default={capsule.clastix.io}
1618
UserGroups []string `json:"userGroups,omitempty"`
1719
// Define groups which when found in the request of a user will be ignored by the Capsule

‎api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/capsule/README.md‎

Lines changed: 3 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,6 @@
22

33
Use the Capsule Operator for easily implementing, managing, and maintaining multitenancy and access control in Kubernetes.
44

5-
## Requirements
6-
7-
* [Helm 3](https://github.com/helm/helm/releases) is required when installing the Capsule Operator chart. Follow Helm’s official [steps](https://helm.sh/docs/intro/install/) for installing helm on your particular operating system.
8-
9-
* A Kubernetes cluster 1.16+ with following [Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) enabled:
10-
11-
* PodNodeSelector
12-
* LimitRanger
13-
* ResourceQuota
14-
* MutatingAdmissionWebhook
15-
* ValidatingAdmissionWebhook
16-
17-
* A [`kubeconfig`](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file accessing the Kubernetes cluster with cluster admin permissions.
18-
195
## Major Changes
206

217
In the following sections you see actions which are required when you are upgrading to a specific version.
@@ -33,58 +19,7 @@ The following Values have changed key or Value:
3319
* `mutatingWebhooksTimeoutSeconds` has moved to `webhooks.mutatingWebhooksTimeoutSeconds`
3420
* `validatingWebhooksTimeoutSeconds` has moved to `webhooks.validatingWebhooksTimeoutSeconds`
3521

36-
## Installation
37-
38-
**When using OCI we recommend our dedicated [OCI Repository](https://artifacthub.io/packages/helm/capsule/capsule) for this chart**
39-
40-
The Capsule Operator requires it's CRDs to be installed before the operator itself. Since the Helm CRD lifecycle has limitations, we recommend to install the CRDs separately. Our chart supports the installation of crds via a dedicated Release.
41-
The Capsule Operator Chart can be used to instantly deploy the Capsule Operator on your Kubernetes cluster.
42-
43-
1. Add this repository:
44-
45-
$ helm repo add projectcapsule https://projectcapsule.github.io/charts
46-
47-
2. Install Capsule:
48-
49-
$ helm install capsule projectcapsule/capsule --version 0.7.0 -n capsule-system --create-namespace
50-
51-
or
52-
53-
$ helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.7.0 -n capsule-system --create-namespace
54-
55-
3. Show the status:
56-
57-
$ helm status capsule -n capsule-system
58-
59-
4. Upgrade the Chart
60-
61-
$ helm upgrade capsule projectcapsule/capsule -n capsule-system
62-
63-
or
64-
65-
$ helm upgrade capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.4.7
66-
67-
5. Uninstall the Chart
68-
69-
$ helm uninstall capsule -n capsule-system
70-
71-
## Customize the installation
72-
73-
There are two methods for specifying overrides of values during chart installation: `--values` and `--set`.
74-
75-
The `--values` option is the preferred method because it allows you to keep your overrides in a YAML file, rather than specifying them all on the command line. Create a copy of the YAML file `values.yaml` and add your overrides to it.
76-
77-
Specify your overrides file when you install the chart:
78-
79-
$ helm install capsule capsule-helm-chart --values myvalues.yaml -n capsule-system
80-
81-
The values in your overrides file `myvalues.yaml` will override their counterparts in the chart's values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
82-
83-
If you only need to make minor customizations, you can specify them on the command line by using the `--set` option. For example:
84-
85-
$ helm install capsule capsule-helm-chart --set manager.options.forceTenantPrefix=false -n capsule-system
86-
87-
Here the values you can override:
22+
## Values
8823

8924
### CustomResourceDefinition Lifecycle
9025

@@ -162,13 +97,14 @@ Here the values you can override:
16297
| manager.kind | string | `"Deployment"` | Set the controller deployment mode as `Deployment` or `DaemonSet`. |
16398
| manager.livenessProbe | object | `{"httpGet":{"path":"/healthz","port":10080}}` | Configure the liveness probe using Deployment probe spec |
16499
| manager.options.capsuleConfiguration | string | `"default"` | Change the default name of the capsule configuration name |
165-
| manager.options.capsuleUserGroups | list | `["projectcapsule.dev"]` | Override the Capsule user groups |
100+
| manager.options.capsuleUserGroups | list | `["projectcapsule.dev"]` | Names of the groups considered as Capsule users. |
166101
| manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
167102
| manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
168103
| manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
169104
| manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
170105
| manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
171106
| manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
107+
| manager.options.userNames | list | `[]` | Names of the users considered as Capsule users. |
172108
| manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
173109
| manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
174110
| manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |

‎charts/capsule/README.md.gotmpl‎

Lines changed: 1 addition & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,6 @@
22

33
Use the Capsule Operator for easily implementing, managing, and maintaining multitenancy and access control in Kubernetes.
44

5-
## Requirements
6-
7-
* [Helm 3](https://github.com/helm/helm/releases) is required when installing the Capsule Operator chart. Follow Helm’s official [steps](https://helm.sh/docs/intro/install/) for installing helm on your particular operating system.
8-
9-
* A Kubernetes cluster 1.16+ with following [Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) enabled:
10-
11-
* PodNodeSelector
12-
* LimitRanger
13-
* ResourceQuota
14-
* MutatingAdmissionWebhook
15-
* ValidatingAdmissionWebhook
16-
17-
* A [`kubeconfig`](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file accessing the Kubernetes cluster with cluster admin permissions.
18-
195
## Major Changes
206

217
In the following sections you see actions which are required when you are upgrading to a specific version.
@@ -33,59 +19,7 @@ The following Values have changed key or Value:
3319
* `mutatingWebhooksTimeoutSeconds` has moved to `webhooks.mutatingWebhooksTimeoutSeconds`
3420
* `validatingWebhooksTimeoutSeconds` has moved to `webhooks.validatingWebhooksTimeoutSeconds`
3521

36-
37-
## Installation
38-
39-
**When using OCI we recommend our dedicated [OCI Repository](https://artifacthub.io/packages/helm/capsule/capsule) for this chart**
40-
41-
The Capsule Operator requires it's CRDs to be installed before the operator itself. Since the Helm CRD lifecycle has limitations, we recommend to install the CRDs separately. Our chart supports the installation of crds via a dedicated Release.
42-
The Capsule Operator Chart can be used to instantly deploy the Capsule Operator on your Kubernetes cluster.
43-
44-
1. Add this repository:
45-
46-
$ helm repo add projectcapsule https://projectcapsule.github.io/charts
47-
48-
2. Install Capsule:
49-
50-
$ helm install capsule projectcapsule/capsule --version 0.7.0 -n capsule-system --create-namespace
51-
52-
or
53-
54-
$ helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.7.0 -n capsule-system --create-namespace
55-
56-
3. Show the status:
57-
58-
$ helm status capsule -n capsule-system
59-
60-
4. Upgrade the Chart
61-
62-
$ helm upgrade capsule projectcapsule/capsule -n capsule-system
63-
64-
or
65-
66-
$ helm upgrade capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.4.7
67-
68-
5. Uninstall the Chart
69-
70-
$ helm uninstall capsule -n capsule-system
71-
72-
## Customize the installation
73-
74-
There are two methods for specifying overrides of values during chart installation: `--values` and `--set`.
75-
76-
The `--values` option is the preferred method because it allows you to keep your overrides in a YAML file, rather than specifying them all on the command line. Create a copy of the YAML file `values.yaml` and add your overrides to it.
77-
78-
Specify your overrides file when you install the chart:
79-
80-
$ helm install capsule capsule-helm-chart --values myvalues.yaml -n capsule-system
81-
82-
The values in your overrides file `myvalues.yaml` will override their counterparts in the chart's values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
83-
84-
If you only need to make minor customizations, you can specify them on the command line by using the `--set` option. For example:
85-
86-
$ helm install capsule capsule-helm-chart --set manager.options.forceTenantPrefix=false -n capsule-system
87-
88-
Here the values you can override:
22+
## Values
8923

9024
### CustomResourceDefinition Lifecycle
9125

‎charts/capsule/crds/capsule.clastix.io_capsuleconfigurations.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,12 @@ spec:
127127
userGroups:
128128
default:
129129
- capsule.clastix.io
130-
description: Names of the groups for Capsule users.
130+
description: Names of the groups considered as Capsule users.
131+
items:
132+
type: string
133+
type: array
134+
userNames:
135+
description: Names of the users considered as Capsule users.
131136
items:
132137
type: string
133138
type: array

‎charts/capsule/templates/configuration-default.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ spec:
2020
{{- range .Values.manager.options.capsuleUserGroups }}
2121
- {{ . }}
2222
{{- end }}
23+
userNames:
24+
{{- range .Values.manager.options.userNames }}
25+
- {{ . }}
26+
{{- end }}
2327
ignoreUserWithGroups:
2428
{{- range .Values.manager.options.ignoreUserWithGroups }}
2529
- {{ . }}

‎charts/capsule/values.schema.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@
249249
"type": "string"
250250
},
251251
"capsuleUserGroups": {
252-
"description": "Override the Capsule user groups",
252+
"description": "Names of the groups considered as Capsule users.",
253253
"type": "array",
254254
"items": {
255255
"type": "string"
@@ -302,6 +302,10 @@
302302
"protectedNamespaceRegex": {
303303
"description": "If specified, disallows creation of namespaces matching the passed regexp",
304304
"type": "string"
305+
},
306+
"userNames": {
307+
"description": "Names of the users considered as Capsule users.",
308+
"type": "array"
305309
}
306310
}
307311
},

‎charts/capsule/values.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,9 @@ manager:
141141
logLevel: '4'
142142
# -- Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash
143143
forceTenantPrefix: false
144-
# -- Override the Capsule user groups
144+
# -- Names of the users considered as Capsule users.
145+
userNames: []
146+
# -- Names of the groups considered as Capsule users.
145147
capsuleUserGroups: ["projectcapsule.dev"]
146148
# -- Define groups which when found in the request of a user will be ignored by the Capsule
147149
# this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.

‎controllers/rbac/manager.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,13 @@ func (r *Manager) EnsureClusterRoleBindings(ctx context.Context) (err error) {
104104
})
105105
}
106106

107+
for _, user := range r.Configuration.UserNames() {
108+
crb.Subjects = append(crb.Subjects, rbacv1.Subject{
109+
Kind: "User",
110+
Name: user,
111+
})
112+
}
113+
107114
return
108115
})
109116

‎e2e/custom_capsule_group_test.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ var _ = Describe("creating a Namespace as Tenant owner with custom --capsule-gro
2727
Name: "alice",
2828
Kind: "User",
2929
},
30+
{
31+
Name: "bob",
32+
Kind: "User",
33+
},
3034
},
3135
},
3236
}
@@ -96,4 +100,40 @@ var _ = Describe("creating a Namespace as Tenant owner with custom --capsule-gro
96100
NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
97101
})
98102

103+
It("should succeed and be available in Tenant namespaces list with default single user", func() {
104+
ModifyCapsuleConfigurationOpts(func(configuration *capsulev1beta2.CapsuleConfiguration) {
105+
configuration.Spec.UserGroups = []string{}
106+
configuration.Spec.IgnoreUserWithGroups = []string{}
107+
configuration.Spec.UserNames = []string{tnt.Spec.Owners[0].Name}
108+
})
109+
110+
ns := NewNamespace("")
111+
112+
NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
113+
})
114+
115+
It("should succeed and be available in Tenant namespaces list with default single user", func() {
116+
ModifyCapsuleConfigurationOpts(func(configuration *capsulev1beta2.CapsuleConfiguration) {
117+
configuration.Spec.UserGroups = []string{}
118+
configuration.Spec.IgnoreUserWithGroups = []string{}
119+
configuration.Spec.UserNames = []string{tnt.Spec.Owners[0].Name}
120+
})
121+
122+
ns := NewNamespace("")
123+
124+
NamespaceCreation(ns, tnt.Spec.Owners[1], defaultTimeoutInterval).ShouldNot(Succeed())
125+
})
126+
127+
It("should fail when group is ignored", func() {
128+
ModifyCapsuleConfigurationOpts(func(configuration *capsulev1beta2.CapsuleConfiguration) {
129+
configuration.Spec.UserGroups = []string{}
130+
configuration.Spec.UserNames = []string{tnt.Spec.Owners[0].Name}
131+
configuration.Spec.IgnoreUserWithGroups = []string{"projectcapsule.dev"}
132+
})
133+
134+
ns := NewNamespace("")
135+
136+
NamespaceCreation(ns, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
137+
})
138+
99139
})

0 commit comments

Comments
 (0)