feat: add rolebindings to rules api (#2032)

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: implement review

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

hack/distro/capsule/example-setup/rbac.yaml

@@ -20,3 +20,12 @@ rules:
 - apiGroups: [""]
   resources: ["secrets"]
   verbs: ["get", "create", "patch", "watch", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: custom:proxy-viewer
+rules:
+- apiGroups: [""]
+  resources: ["*"]
+  verbs: ["list"]

hack/distro/capsule/example-setup/tenants.yaml

@@ -11,9 +11,25 @@ spec:
     kind: User
   rules:
     - permissions:
-        promotions:
-          - clusterRoles:
-            - "configmap-replicator"
+        bindings:
+          - clusterRoleName: 'custom:proxy-viewer'
+            subjects:
+            - apiGroup: rbac.authorization.k8s.io
+              kind: User
+              name: joe
+            labels:
+              reflection.proxy.projectcapsule.dev/enabled: "true"
+      enforce:
+        action: deny
+        metadata:
+          - apiGroups:
+              - "rbac.authorization.k8s.io/v1"
+            kinds:
+              - "RoleBinding"
+            labels:
+              reflection.proxy.projectcapsule.dev/enabled:
+                values:
+                  - exp: ".*"
     - namespaceSelector:
         matchExpressions:
           - key: env
@@ -49,12 +65,6 @@ spec:
     additionalMetadataList:
       - labels:
           customer: a
-  additionalRoleBindings:
-  - clusterRoleName: 'view'
-    subjects:
-    - apiGroup: rbac.authorization.k8s.io
-      kind: User
-      name: joe
   resourceQuotas:
     scope: Tenant
     items:
@@ -82,13 +92,17 @@ spec:
   owners:
   - name: bob
     kind: User
-  additionalRoleBindings:
-  - clusterRoleName: 'view'
-    subjects:
-    - apiGroup: rbac.authorization.k8s.io
-      kind: User
-      name: alice
   rules:
+  - permissions:
+      bindings:
+        - clusterRoleName: 'custom:proxy-viewer'
+          subjects:
+          - apiGroup: rbac.authorization.k8s.io
+            kind: User
+            name: alice
+          labels:
+            reflection.proxy.projectcapsule.dev/enabled: "true"
+
   - enforce:
       action: "allow"
       services:
@@ -149,9 +163,11 @@ spec:
   owners:
   - name: joe
     kind: User
-  additionalRoleBindings:
-  - clusterRoleName: 'view'
-    subjects:
-    - apiGroup: rbac.authorization.k8s.io
-      kind: Group
-      name: wind-users
+  rules:
+  - permissions:
+      bindings:
+        - clusterRoleName: 'view'
+          subjects:
+            - apiGroup: rbac.authorization.k8s.io
+              kind: Group
+              name: wind-users