Skip to content

Commit 9caea34

Browse files
nexus49nexus49
authored
feat: adjusting role name convention to include objectType (#34)
1 parent 96dea19 commit 9caea34

File tree

11 files changed

+88
-101
lines changed

11 files changed

+88
-101
lines changed

‎Taskfile.yml‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ version: '3'
33
dotenv: ['.taskenv', '.secret/.env', '{{.HOME}}/.env' ]
44
vars:
55
LOCAL_BIN: bin
6-
CONTROLLER_TOOLS_VERSION: v0.14.0
6+
CONTROLLER_TOOLS_VERSION: v0.19.0
77
ENVTEST_K8S_VERSION: "1.29.0"
88
ENVTEST_VERSION: release-0.17
99
CRD_DIRECTORY: config/crd
1010
TEST_SETUP_DIRECTORY: test/setup/01-platform-mesh-system
11-
KCP_APIGEN_VERSION: v0.21.0
11+
KCP_APIGEN_VERSION: v0.27.1
1212
KCP_VERSION: 0.27.1
1313
GOMPLATE_VERSION: v4.3.0
1414
GOARCH:
@@ -77,13 +77,6 @@ tasks:
7777
- task: envtest
7878
vars:
7979
ADDITIONAL_COMMAND_ARGS: -coverprofile=./cover.out -covermode=atomic -coverpkg=./...
80-
helm-unittest:
81-
cmds:
82-
- helm unittest chart
83-
validate:
84-
cmds:
85-
- task: lint
86-
- task: test
8780
start-kcp:
8881
deps: [setup:kcp]
8982
cmds:

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/core.platform-mesh.io_accountinfos.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.14.0
6+
controller-gen.kubebuilder.io/version: v0.19.0
77
name: accountinfos.core.platform-mesh.io
88
spec:
99
group: core.platform-mesh.io

‎config/crd/core.platform-mesh.io_accounts.yaml‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.14.0
6+
controller-gen.kubebuilder.io/version: v0.19.0
77
name: accounts.core.platform-mesh.io
88
spec:
99
group: core.platform-mesh.io
@@ -110,16 +110,8 @@ spec:
110110
properties:
111111
conditions:
112112
items:
113-
description: "Condition contains details for one aspect of the current
114-
state of this API Resource.\n---\nThis struct is intended for
115-
direct use as an array at the field path .status.conditions. For
116-
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
117-
observations of a foo's current state.\n\t // Known .status.conditions.type
118-
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
119-
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
120-
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
121-
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
122-
\ // other fields\n\t}"
113+
description: Condition contains details for one aspect of the current
114+
state of this API Resource.
123115
properties:
124116
lastTransitionTime:
125117
description: |-
@@ -160,12 +152,7 @@ spec:
160152
- Unknown
161153
type: string
162154
type:
163-
description: |-
164-
type of condition in CamelCase or in foo.example.com/CamelCase.
165-
---
166-
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
167-
useful (see .node.status.conditions), the ability to deconflict is important.
168-
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
155+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
169156
maxLength: 316
170157
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
171158
type: string

‎config/resources/apiexport-core.platform-mesh.io.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,17 @@ metadata:
55
name: core.platform-mesh.io
66
spec:
77
latestResourceSchemas:
8-
- v250715-5b899f6.accountinfos.core.platform-mesh.io
9-
- v250715-5b899f6.accounts.core.platform-mesh.io
8+
- v250715-5b899f6.accountinfos.core.platform-mesh.io
9+
- v250915-1185c0b.accounts.core.platform-mesh.io
10+
permissionClaims:
11+
- resource: namespaces
12+
all: true
13+
- group: tenancy.kcp.io
14+
identityHash: '{{ .data.apiExportRootTenancyKcpIoIdentityHash }}'
15+
resource: workspaces
16+
all: true
17+
- group: tenancy.kcp.io
18+
identityHash: '{{ .data.apiExportRootTenancyKcpIoIdentityHash }}'
19+
resource: workspacetypes
20+
all: true
1021
status: {}

‎config/resources/apiresourceschema-accounts.core.platform-mesh.io.yaml‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
22
kind: APIResourceSchema
33
metadata:
44
creationTimestamp: null
5-
name: v250715-5b899f6.accounts.core.platform-mesh.io
5+
name: v250915-1185c0b.accounts.core.platform-mesh.io
66
spec:
77
group: core.platform-mesh.io
88
names:
@@ -106,16 +106,8 @@ spec:
106106
properties:
107107
conditions:
108108
items:
109-
description: "Condition contains details for one aspect of the current
110-
state of this API Resource.\n---\nThis struct is intended for direct
111-
use as an array at the field path .status.conditions. For example,\n\n\n\ttype
112-
FooStatus struct{\n\t // Represents the observations of a foo's
113-
current state.\n\t // Known .status.conditions.type are: \"Available\",
114-
\"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t
115-
\ // +patchStrategy=merge\n\t // +listType=map\n\t // +listMapKey=type\n\t
116-
\ Conditions []metav1.Condition `json:\"conditions,omitempty\"
117-
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
118-
\ // other fields\n\t}"
109+
description: Condition contains details for one aspect of the current
110+
state of this API Resource.
119111
properties:
120112
lastTransitionTime:
121113
description: |-
@@ -156,12 +148,7 @@ spec:
156148
- Unknown
157149
type: string
158150
type:
159-
description: |-
160-
type of condition in CamelCase or in foo.example.com/CamelCase.
161-
---
162-
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
163-
useful (see .node.status.conditions), the ability to deconflict is important.
164-
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
151+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
165152
maxLength: 316
166153
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
167154
type: string

‎internal/config/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ type OperatorConfig struct {
1919
Enabled bool `mapstructure:"subroutines-fga-enabled" default:"true"`
2020
RootNamespace string `mapstructure:"subroutines-fga-root-namespace" default:"platform-mesh-root"`
2121
GrpcAddr string `mapstructure:"subroutines-fga-grpc-addr" default:"localhost:8081"`
22-
ObjectType string `mapstructure:"subroutines-fga-object-type" default:"account"`
22+
ObjectType string `mapstructure:"subroutines-fga-object-type" default:"core_platform-mesh_io_account"`
2323
ParentRelation string `mapstructure:"subroutines-fga-parent-relation" default:"parent"`
2424
CreatorRelation string `mapstructure:"subroutines-fga-creator-relation" default:"owner"`
2525
} `mapstructure:",squash"`

‎pkg/subroutines/fga.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,9 @@ func (e *FGASubroutine) Process(ctx context.Context, ro runtimeobject.RuntimeObj
9494

9595
// Determine parent account to create parent relation
9696
writes = append(writes, &openfgav1.TupleKey{
97-
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.GetName()),
98-
Relation: e.parentRelation,
9997
User: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.ParentAccount.OriginClusterId, parentAccountName),
98+
Relation: e.parentRelation,
99+
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.GetName()),
100100
})
101101
}
102102

@@ -110,15 +110,15 @@ func (e *FGASubroutine) Process(ctx context.Context, ro runtimeobject.RuntimeObj
110110
creator := formatUser(*account.Spec.Creator)
111111

112112
writes = append(writes, &openfgav1.TupleKey{
113-
Object: fmt.Sprintf("role:%s/%s/owner", accountInfo.Spec.Account.OriginClusterId, account.Name),
114-
Relation: "assignee",
115113
User: fmt.Sprintf("user:%s", creator),
114+
Relation: "assignee",
115+
Object: fmt.Sprintf("role:%s/%s/%s/owner", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
116116
})
117117

118118
writes = append(writes, &openfgav1.TupleKey{
119-
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
119+
User: fmt.Sprintf("role:%s/%s/%s/owner#assignee", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
120120
Relation: e.creatorRelation,
121-
User: fmt.Sprintf("role:%s/%s/owner#assignee", accountInfo.Spec.Account.OriginClusterId, account.Name),
121+
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
122122
})
123123
}
124124

@@ -167,24 +167,24 @@ func (e *FGASubroutine) Finalize(ctx context.Context, runtimeObj runtimeobject.R
167167
parentAccountName := accountInfo.Spec.Account.Name
168168

169169
deletes = append(deletes, &openfgav1.TupleKeyWithoutCondition{
170-
User: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, parentAccountName),
170+
User: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.ParentAccount.OriginClusterId, parentAccountName),
171171
Relation: e.parentRelation,
172-
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.GeneratedClusterId, account.GetName()),
172+
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.GetName()),
173173
})
174174
}
175175

176176
if account.Spec.Creator != nil {
177177
creator := formatUser(*account.Spec.Creator)
178178
deletes = append(deletes, &openfgav1.TupleKeyWithoutCondition{
179-
Object: fmt.Sprintf("role:%s/%s/owner", accountInfo.Spec.Account.GeneratedClusterId, account.Name),
180-
Relation: "assignee",
181179
User: fmt.Sprintf("user:%s", creator),
180+
Relation: "assignee",
181+
Object: fmt.Sprintf("role:%s/%s/%s/owner", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
182182
})
183183

184184
deletes = append(deletes, &openfgav1.TupleKeyWithoutCondition{
185-
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.GeneratedClusterId, account.Name),
185+
User: fmt.Sprintf("role:%s/%s/%s/owner#assignee", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
186186
Relation: e.creatorRelation,
187-
User: fmt.Sprintf("role:%s/%s/owner#assignee", accountInfo.Spec.Account.GeneratedClusterId, account.Name),
187+
Object: fmt.Sprintf("%s:%s/%s", e.objectType, accountInfo.Spec.Account.OriginClusterId, account.Name),
188188
})
189189
}
190190

‎pkg/subroutines/fga_test.go‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"testing"
66

77
kcpcorev1alpha1 "github.com/kcp-dev/kcp/sdk/apis/core/v1alpha1"
8+
pmconfig "github.com/platform-mesh/golang-commons/config"
89
"k8s.io/apimachinery/pkg/types"
910
"sigs.k8s.io/controller-runtime/pkg/client"
1011
"sigs.k8s.io/controller-runtime/pkg/kontext"
@@ -18,6 +19,7 @@ import (
1819
"k8s.io/utils/ptr"
1920

2021
"github.com/platform-mesh/account-operator/api/v1alpha1"
22+
"github.com/platform-mesh/account-operator/internal/config"
2123
"github.com/platform-mesh/account-operator/pkg/subroutines"
2224
"github.com/platform-mesh/account-operator/pkg/subroutines/mocks"
2325
)
@@ -51,7 +53,7 @@ func TestFGASubroutine_Finalizers(t *testing.T) {
5153

5254
func TestFGASubroutine_Process(t *testing.T) {
5355
creator := "test-creator"
54-
56+
defaultContext := pmconfig.SetConfigInContext(context.Background(), config.OperatorConfig{})
5557
testCases := []struct {
5658
name string
5759
expectedError bool
@@ -62,7 +64,7 @@ func TestFGASubroutine_Process(t *testing.T) {
6264
}{
6365
{
6466
name: "should_fail_if_no_cluster_in_context",
65-
ctx: context.Background(),
67+
ctx: defaultContext,
6668
expectedPanic: true,
6769
account: &v1alpha1.Account{
6870
Spec: v1alpha1.AccountSpec{
@@ -80,7 +82,7 @@ func TestFGASubroutine_Process(t *testing.T) {
8082
},
8183
{
8284
name: "should_skip_processing_if_subroutine_ran_before",
83-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
85+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
8486
account: &v1alpha1.Account{
8587
Spec: v1alpha1.AccountSpec{
8688
Type: v1alpha1.AccountTypeOrg,
@@ -129,7 +131,7 @@ func TestFGASubroutine_Process(t *testing.T) {
129131
},
130132
{
131133
name: "should_fail_if_get_store_id_fails",
132-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
134+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
133135
expectedError: true,
134136
account: &v1alpha1.Account{
135137
ObjectMeta: metav1.ObjectMeta{
@@ -168,7 +170,7 @@ func TestFGASubroutine_Process(t *testing.T) {
168170
},
169171
{
170172
name: "should_fail_if_get_parent_account_fails",
171-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
173+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
172174
expectedError: true,
173175
account: &v1alpha1.Account{
174176
ObjectMeta: metav1.ObjectMeta{
@@ -183,7 +185,7 @@ func TestFGASubroutine_Process(t *testing.T) {
183185
},
184186
{
185187
name: "should_fail_if_write_fails",
186-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
188+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
187189
expectedError: true,
188190
account: &v1alpha1.Account{
189191
ObjectMeta: metav1.ObjectMeta{
@@ -234,7 +236,7 @@ func TestFGASubroutine_Process(t *testing.T) {
234236
},
235237
{
236238
name: "should_ignore_error_if_duplicate_write_error",
237-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
239+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
238240
account: &v1alpha1.Account{
239241
ObjectMeta: metav1.ObjectMeta{
240242
Name: "test-account",
@@ -286,7 +288,7 @@ func TestFGASubroutine_Process(t *testing.T) {
286288
},
287289
{
288290
name: "should_succeed",
289-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
291+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
290292
account: &v1alpha1.Account{
291293
ObjectMeta: metav1.ObjectMeta{
292294
Name: "test-account",
@@ -337,7 +339,7 @@ func TestFGASubroutine_Process(t *testing.T) {
337339
},
338340
{
339341
name: "should_succeed_with_creator_for_sa",
340-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
342+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
341343
account: &v1alpha1.Account{
342344
ObjectMeta: metav1.ObjectMeta{
343345
Name: "test-account",
@@ -397,7 +399,7 @@ func TestFGASubroutine_Process(t *testing.T) {
397399
},
398400
{
399401
name: "should_fail_with_creator_in_sa_range",
400-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
402+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
401403
expectedError: true,
402404
account: &v1alpha1.Account{
403405
ObjectMeta: metav1.ObjectMeta{
@@ -448,7 +450,7 @@ func TestFGASubroutine_Process(t *testing.T) {
448450
},
449451
{
450452
name: "should_succeed_with_creator",
451-
ctx: kontext.WithCluster(context.Background(), "some-cluster"),
453+
ctx: kontext.WithCluster(defaultContext, "some-cluster"),
452454
account: &v1alpha1.Account{
453455
ObjectMeta: metav1.ObjectMeta{
454456
Name: "test-account",
@@ -789,7 +791,7 @@ func TestCreatorSubroutine_Finalize(t *testing.T) {
789791
},
790792
},
791793
}
792-
794+
defaultContext := pmconfig.SetConfigInContext(context.Background(), config.OperatorConfig{})
793795
for _, test := range testCases {
794796
t.Run(test.name, func(t *testing.T) {
795797

@@ -801,7 +803,7 @@ func TestCreatorSubroutine_Finalize(t *testing.T) {
801803
}
802804

803805
routine := subroutines.NewFGASubroutine(k8sClient, openFGAClient, "owner", "parent", "account")
804-
ctx := kontext.WithCluster(context.Background(), "abcdefghi")
806+
ctx := kontext.WithCluster(defaultContext, "abcdefghi")
805807
_, err := routine.Finalize(ctx, test.account)
806808
if test.expectedError {
807809
assert.NotNil(t, err)

0 commit comments

Comments
 (0)