Skip to content

Commit 9cb6321

Browse files
qiujian16qiujian16
authored
Update permission config in addontemplate api (#283)
Signed-off-by: Jian Qiu <[email protected]>
1 parent 0146ddf commit 9cb6321

File tree

4 files changed

+98
-26
lines changed

4 files changed

+98
-26
lines changed

‎addon/v1alpha1/0000_03_addon.open-cluster-management.io_addontemplates.crd.yaml

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -384,38 +384,59 @@ spec:
384384
to bind the user provided ClusterRole/Role to the "system:open-cluster-management:cluster:<cluster-name>:addon:<addon-name>"
385385
Group.
386386
properties:
387-
roleRef:
388-
description: RoleRef is an reference to the permission
389-
resource. it could be a role or a cluster role,
390-
the user must make sure it exist on the hub cluster.
387+
currentCluster:
388+
description: CurrentCluster contains the configuration
389+
of CurrentCluster type binding. It is required when
390+
the type is CurrentCluster.
391391
properties:
392-
apiGroup:
393-
description: APIGroup is the group for the resource
394-
being referenced
395-
type: string
396-
kind:
397-
description: Kind is the type of resource being
398-
referenced
399-
type: string
400-
name:
401-
description: Name is the name of resource being
402-
referenced
392+
clusterRoleName:
393+
description: ClusterRoleName is the name of the
394+
clusterrole the addon agent is bound. A rolebinding
395+
will be created referring to this cluster role
396+
in each cluster namespace. The user must make
397+
sure the clusterrole exists on the hub cluster.
403398
type: string
404399
required:
405-
- apiGroup
406-
- kind
407-
- name
400+
- clusterRoleName
408401
type: object
409-
x-kubernetes-map-type: atomic
410402
singleNamespace:
411403
description: SingleNamespace contains the configuration
412404
of SingleNamespace type binding. It is required
413405
when the type is SingleNamespace
414406
properties:
415407
namespace:
408+
description: Namespace is the namespace the addon
409+
agent has permissions to bind to. A rolebinding
410+
will be created in this namespace referring
411+
to the RoleRef.
416412
type: string
413+
roleRef:
414+
description: RoleRef is an reference to the permission
415+
resource. it could be a role or a cluster role,
416+
the user must make sure it exist on the hub
417+
cluster.
418+
properties:
419+
apiGroup:
420+
description: APIGroup is the group for the
421+
resource being referenced
422+
type: string
423+
kind:
424+
description: Kind is the type of resource
425+
being referenced
426+
type: string
427+
name:
428+
description: Name is the name of resource
429+
being referenced
430+
type: string
431+
required:
432+
- apiGroup
433+
- kind
434+
- name
435+
type: object
436+
x-kubernetes-map-type: atomic
417437
required:
418438
- namespace
439+
- roleRef
419440
type: object
420441
type:
421442
description: 'Type of the permissions setting. It
@@ -429,7 +450,6 @@ spec:
429450
- SingleNamespace
430451
type: string
431452
required:
432-
- roleRef
433453
- type
434454
type: object
435455
type: array

‎addon/v1alpha1/types_addontemplate.go

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,19 +123,33 @@ type HubPermissionConfig struct {
123123
// +kubebuilder:validation:Enum:=CurrentCluster;SingleNamespace
124124
Type HubPermissionsBindingType `json:"type"`
125125

126-
// RoleRef is an reference to the permission resource. it could be a role or a cluster role,
127-
// the user must make sure it exist on the hub cluster.
128-
// +kubebuilder:validation:Required
129-
RoleRef rbacv1.RoleRef `json:"roleRef"`
126+
// CurrentCluster contains the configuration of CurrentCluster type binding.
127+
// It is required when the type is CurrentCluster.
128+
CurrentCluster *CurrentClusterBindingConfig `json:"currentCluster,omitempty"`
130129

131130
// SingleNamespace contains the configuration of SingleNamespace type binding.
132131
// It is required when the type is SingleNamespace
133132
SingleNamespace *SingleNamespaceBindingConfig `json:"singleNamespace,omitempty"`
134133
}
135134

135+
type CurrentClusterBindingConfig struct {
136+
// ClusterRoleName is the name of the clusterrole the addon agent is bound. A rolebinding
137+
// will be created referring to this cluster role in each cluster namespace.
138+
// The user must make sure the clusterrole exists on the hub cluster.
139+
// +kubebuilder:validation:Required
140+
ClusterRoleName string `json:"clusterRoleName"`
141+
}
142+
136143
type SingleNamespaceBindingConfig struct {
144+
// Namespace is the namespace the addon agent has permissions to bind to. A rolebinding
145+
// will be created in this namespace referring to the RoleRef.
137146
// +kubebuilder:validation:Required
138147
Namespace string `json:"namespace"`
148+
149+
// RoleRef is an reference to the permission resource. it could be a role or a cluster role,
150+
// the user must make sure it exist on the hub cluster.
151+
// +kubebuilder:validation:Required
152+
RoleRef rbacv1.RoleRef `json:"roleRef"`
139153
}
140154

141155
type CustomSignerRegistrationConfig struct {

‎addon/v1alpha1/zz_generated.deepcopy.go

Lines changed: 22 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎addon/v1alpha1/zz_generated.swagger_doc_generated.go

Lines changed: 18 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)