Skip to content

Commit 6204a55

Browse files
skestwalskestwal
authored
feat(RHIDP-9864): add real world RBAC config and new POLICY (realistic) (#297)
* feat(RHIDP-9864): add real world RBAC config and new POLICY(realistic) Signed-off-by: skestwal <skestwal@redhat.com> * feat(RHIDP-9864): add new file for orchestrator RBAC for realistic policy Signed-off-by: skestwal <skestwal@redhat.com> --------- Signed-off-by: skestwal <skestwal@redhat.com>
1 parent 6515f8a commit 6204a55

File tree

4 files changed

+104
-2
lines changed

4 files changed

+104
-2
lines changed

‎ci-scripts/rhdh-setup/create_resource.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,7 @@ export RBAC_POLICY_ALL_GROUPS_ADMIN="all_groups_admin" #default
338338
export RBAC_POLICY_STATIC="static"
339339
export RBAC_POLICY_USER_IN_MULTIPLE_GROUPS="user_in_multiple_groups"
340340
export RBAC_POLICY_NESTED_GROUPS="nested_groups"
341+
export RBAC_POLICY_REALISTIC="realistic"
341342

342343
create_rbac_policy() {
343344
policy="${1:-$RBAC_POLICY_ALL_GROUPS_ADMIN}"
@@ -382,6 +383,13 @@ create_rbac_policy() {
382383
fi
383384
done
384385
;;
386+
"$RBAC_POLICY_REALISTIC")
387+
ROLES=("platform_admin" "engineering_lead" "senior_engineer" "backend_engineer" "frontend_engineer" "product_manager" "QA_engineer" "external_contractor" "compliance_security" "on_call_team")
388+
ROLES_LEN=${#ROLES[@]}
389+
for i in $(seq 1 "$GROUP_COUNT"); do
390+
echo " g, group:default/g${i}, role:default/${ROLES[$(((i - 1) % ROLES_LEN))]}" >>"$TMP_DIR/group-rbac.yaml"
391+
done
392+
;;
385393
\?)
386394
log_error "Invalid RBAC policy: ${policy}"
387395
exit 1
@@ -412,7 +420,7 @@ create_user() {
412420
[[ $grp -eq 0 ]] && grp=${GROUP_COUNT}
413421
groups="["
414422
case $RBAC_POLICY in
415-
"$RBAC_POLICY_ALL_GROUPS_ADMIN" | "$RBAC_POLICY_STATIC")
423+
"$RBAC_POLICY_ALL_GROUPS_ADMIN" | "$RBAC_POLICY_STATIC" | "$RBAC_POLICY_REALISTIC")
416424
groups="$groups\"g${grp}\""
417425
;;
418426
"$RBAC_POLICY_NESTED_GROUPS")

‎ci-scripts/rhdh-setup/deploy.sh‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,10 +342,16 @@ backstage_install() {
342342
until $clin create configmap app-config-rhdh --from-file "app-config.rhdh.yaml=$TMP_DIR/app-config.yaml"; do $clin delete configmap app-config-rhdh --ignore-not-found=true; done
343343
if ${ENABLE_RBAC}; then
344344
cp template/backstage/rbac-config.yaml "${TMP_DIR}/rbac-config.yaml"
345+
if [[ $RBAC_POLICY == "$RBAC_POLICY_REALISTIC" ]]; then
346+
cat template/backstage/realistic-rbac-config.yaml >> "${TMP_DIR}/rbac-config.yaml"
347+
fi
345348
create_rbac_policy "$RBAC_POLICY"
346349
cat "$TMP_DIR/group-rbac.yaml" >>"$TMP_DIR/rbac-config.yaml"
347350
if [[ "$INSTALL_METHOD" == "helm" ]] && ${ENABLE_ORCHESTRATOR}; then
348351
cat template/backstage/helm/orchestrator-rbac-patch.yaml >>"$TMP_DIR/rbac-config.yaml"
352+
if [[ $RBAC_POLICY == "$RBAC_POLICY_REALISTIC" ]]; then
353+
cat template/backstage/helm/realistic-orchestrator-rbac-patch.yaml>>"${TMP_DIR}/rbac-config.yaml"
354+
fi
349355
fi
350356
until $clin create -f "$TMP_DIR/rbac-config.yaml"; do $clin delete configmap rbac-policy --ignore-not-found=true; done
351357
fi
@@ -363,7 +369,8 @@ backstage_install() {
363369
fi
364370
date -u -Ins >"${TMP_DIR}/populate-before"
365371
# shellcheck disable=SC2064
366-
trap "date -u -Ins >'${TMP_DIR}/populate-after'" EXIT
372+
trap "date -u -Ins >'${TMP_DIR}/populate-after'" RETURN EXIT
373+
367374
if ${RHDH_METRIC}; then
368375
log_info "Setting up RHDH metrics"
369376
if [ "${AUTH_PROVIDER}" == "keycloak" ]; then

‎ci-scripts/rhdh-setup/template/backstage/helm/realistic-orchestrator-rbac-patch.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
p, role:default/platform_admin, orchestrator.workflow, read, allow
2+
p, role:default/platform_admin, orchestrator.workflow.use, update, allow
3+
p, role:default/platform_admin, orchestrator.workflowAdminView, read, allow
4+
p, role:default/engineering_lead, orchestrator.workflow, read, allow
5+
p, role:default/engineering_lead, orchestrator.workflow.use, update, allow
6+
p, role:default/senior_engineer, orchestrator.workflow, read, allow
7+
p, role:default/senior_engineer, orchestrator.workflow.use, update, allow

‎ci-scripts/rhdh-setup/template/backstage/realistic-rbac-config.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
p, role:default/platform_admin, catalog-entity, read, allow
2+
p, role:default/platform_admin, catalog.entity.create, create, allow
3+
p, role:default/platform_admin, catalog.entity.update, update, allow
4+
p, role:default/platform_admin, catalog.entity.delete, delete, allow
5+
p, role:default/platform_admin, catalog.location.create, create, allow
6+
p, role:default/platform_admin, catalog.location.read, read, allow
7+
p, role:default/platform_admin, catalog.location.update, update, allow
8+
p, role:default/platform_admin, catalog.location.delete, delete, allow
9+
p, role:default/platform_admin, scaffolder.action.execute, use, allow
10+
p, role:default/platform_admin, scaffolder.task.create, create, allow
11+
p, role:default/platform_admin, scaffolder.task.read, read, allow
12+
p, role:default/platform_admin, kubernetes.proxy, use, allow
13+
p, role:default/platform_admin, techdocs.entity.read, read, allow
14+
p, role:default/platform_admin, techdocs.entity.create, create, allow
15+
p, role:default/platform_admin, rbac.policy.entity.read, read, allow
16+
p, role:default/platform_admin, rbac.policy.entity.create, create, allow
17+
p, role:default/platform_admin, rbac.policy.entity.update, update, allow
18+
p, role:default/platform_admin, rbac.policy.entity.delete, delete, allow
19+
p, role:default/engineering_lead, catalog-entity, read, allow
20+
p, role:default/engineering_lead, catalog.entity.create, create, allow
21+
p, role:default/engineering_lead, catalog.entity.update, update, allow
22+
p, role:default/engineering_lead, catalog.entity.delete, delete, allow
23+
p, role:default/engineering_lead, catalog.location.create, create, allow
24+
p, role:default/engineering_lead, catalog.location.read, read, allow
25+
p, role:default/engineering_lead, catalog.location.update, update, allow
26+
p, role:default/engineering_lead, catalog.location.delete, delete, allow
27+
p, role:default/engineering_lead, scaffolder.action.execute, use, allow
28+
p, role:default/engineering_lead, scaffolder.task.create, create, allow
29+
p, role:default/engineering_lead, scaffolder.task.read, read, allow
30+
p, role:default/engineering_lead, kubernetes.proxy, use, allow
31+
p, role:default/engineering_lead, techdocs.entity.read, read, allow
32+
p, role:default/engineering_lead, techdocs.entity.create, create, allow
33+
p, role:default/senior_engineer, catalog-entity, read, allow
34+
p, role:default/senior_engineer, catalog.entity.create, create, allow
35+
p, role:default/senior_engineer, catalog.entity.update, update, allow
36+
p, role:default/senior_engineer, catalog.entity.delete, delete, allow
37+
p, role:default/senior_engineer, catalog.location.create, create, allow
38+
p, role:default/senior_engineer, catalog.location.read, read, allow
39+
p, role:default/senior_engineer, scaffolder.action.execute, use, allow
40+
p, role:default/senior_engineer, scaffolder.task.create, create, allow
41+
p, role:default/senior_engineer, scaffolder.task.read, read, allow
42+
p, role:default/senior_engineer, kubernetes.proxy, use, allow
43+
p, role:default/senior_engineer, techdocs.entity.read, read, allow
44+
p, role:default/backend_engineer, catalog-entity, read, allow
45+
p, role:default/backend_engineer, catalog.entity.create, create, allow
46+
p, role:default/backend_engineer, catalog.entity.update, update, allow
47+
p, role:default/backend_engineer, catalog.location.create, create, allow
48+
p, role:default/backend_engineer, catalog.location.read, read, allow
49+
p, role:default/backend_engineer, scaffolder.action.execute, use, allow
50+
p, role:default/backend_engineer, scaffolder.task.create, create, allow
51+
p, role:default/backend_engineer, scaffolder.task.read, read, allow
52+
p, role:default/backend_engineer, kubernetes.proxy, use, allow
53+
p, role:default/backend_engineer, techdocs.entity.read, read, allow
54+
p, role:default/frontend_engineer, catalog-entity, read, allow
55+
p, role:default/frontend_engineer, catalog.entity.create, create, allow
56+
p, role:default/frontend_engineer, catalog.entity.update, update, allow
57+
p, role:default/frontend_engineer, catalog.location.create, create, allow
58+
p, role:default/frontend_engineer, catalog.location.read, read, allow
59+
p, role:default/frontend_engineer, scaffolder.action.execute, use, allow
60+
p, role:default/frontend_engineer, scaffolder.task.create, create, allow
61+
p, role:default/frontend_engineer, scaffolder.task.read, read, allow
62+
p, role:default/frontend_engineer, kubernetes.proxy, use, allow
63+
p, role:default/frontend_engineer, techdocs.entity.read, read, allow
64+
p, role:default/product_manager, catalog-entity, read, allow
65+
p, role:default/product_manager, catalog.location.read, read, allow
66+
p, role:default/product_manager, techdocs.entity.read, read, allow
67+
p, role:default/QA_engineer, catalog-entity, read, allow
68+
p, role:default/QA_engineer, catalog.location.read, read, allow
69+
p, role:default/QA_engineer, kubernetes.proxy, use, allow
70+
p, role:default/QA_engineer, techdocs.entity.read, read, allow
71+
p, role:default/external_contractor, catalog-entity, read, allow
72+
p, role:default/external_contractor, techdocs.entity.read, read, allow
73+
p, role:default/compliance_security, catalog-entity, read, allow
74+
p, role:default/compliance_security, catalog.location.read, read, allow
75+
p, role:default/compliance_security, rbac.policy.entity.read, read, allow
76+
p, role:default/on_call_team, catalog-entity, read, allow
77+
p, role:default/on_call_team, catalog.entity.update, update, allow
78+
p, role:default/on_call_team, catalog.location.read, read, allow
79+
p, role:default/on_call_team, kubernetes.proxy, use, allow
80+
p, role:default/on_call_team, techdocs.entity.read, read, allow

0 commit comments

Comments
 (0)