github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-02-14 09:59:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(tenant): allow additional metadata for rolebindings (#1695)

Browse Source 
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
This commit is contained in:
Oliver Bähler
2025-10-12 11:42:41 +02:00
committed by GitHub
parent ea2b6ec1e3
commit beafe09f71
6 changed files with 79 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/v1beta2/owner.go
View File

@@ -13,6 +13,10 @@ type OwnerSpec struct {
ClusterRoles []string `json:"clusterRoles,omitempty"`
// Proxy settings for tenant owner.
ProxyOperations []ProxySettings `json:"proxySettings,omitempty"`
// Additional Labels for the synchronized rolebindings
Labels map[string]string `json:"labels,omitempty"`
// Additional Annotations for the synchronized rolebindings
Annotations map[string]string `json:"annotations,omitempty"`
}
// +kubebuilder:validation:Enum=User;Group;ServiceAccount

14
api/v1beta2/zz_generated.deepcopy.go
View File

@@ -462,6 +462,20 @@ func (in *OwnerSpec) DeepCopyInto(out *OwnerSpec) {
(*in)[i].DeepCopyInto(&(*out)[i])
}
}
if in.Labels != nil {
in, out := &in.Labels, &out.Labels
*out = make(map[string]string, len(*in))
for key, val := range *in {
(*out)[key] = val
}
}
if in.Annotations != nil {
in, out := &in.Annotations, &out.Annotations
*out = make(map[string]string, len(*in))
for key, val := range *in {
(*out)[key] = val
}
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OwnerSpec.

30
charts/capsule/crds/capsule.clastix.io_tenants.yaml
View File

@@ -68,8 +68,18 @@ spec:
the RoleBinding for the given ClusterRole. Optional.
items:
properties:
annotations:
additionalProperties:
type: string
description: Additional Annotations for the synchronized rolebindings
type: object
clusterRoleName:
type: string
labels:
additionalProperties:
type: string
description: Additional Labels for the synchronized rolebindings
type: object
subjects:
description: kubebuilder:validation:Minimum=1
items:
@@ -1099,8 +1109,18 @@ spec:
the RoleBinding for the given ClusterRole. Optional.
items:
properties:
annotations:
additionalProperties:
type: string
description: Additional Annotations for the synchronized rolebindings
type: object
clusterRoleName:
type: string
labels:
additionalProperties:
type: string
description: Additional Labels for the synchronized rolebindings
type: object
subjects:
description: kubebuilder:validation:Minimum=1
items:
@@ -2026,6 +2046,11 @@ spec:
Optional
items:
properties:
annotations:
additionalProperties:
type: string
description: Additional Annotations for the synchronized rolebindings
type: object
clusterRoles:
default:
- admin
@@ -2043,6 +2068,11 @@ spec:
- Group
- ServiceAccount
type: string
labels:
additionalProperties:
type: string
description: Additional Labels for the synchronized rolebindings
type: object
name:
description: Name of tenant owner.
type: string

15
controllers/tenant/rolebindings.go
View File

@@ -45,6 +45,8 @@ func (r *Manager) ownerClusterRoleBindings(owner capsulev1beta2.OwnerSpec, clust
Subjects: []rbacv1.Subject{
subject,
},
Labels: owner.Labels,
Annotations: owner.Annotations,
}
}
@@ -129,17 +131,26 @@ func (r *Manager) syncAdditionalRoleBinding(ctx context.Context, tenant *capsule
var res controllerutil.OperationResult
res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() error {
if target.Labels == nil {
target.Labels = map[string]string{}
target.Labels = map[string]string{}
target.Annotations = map[string]string{}
if roleBinding.Labels != nil {
target.Labels = roleBinding.Labels
}
target.Labels[tenantLabel] = tenant.Name
target.Labels[roleBindingLabel] = roleBindingHashLabel
if roleBinding.Annotations != nil {
target.Annotations = roleBinding.Annotations
}
target.RoleRef = rbacv1.RoleRef{
APIGroup: rbacv1.GroupName,
Kind: "ClusterRole",
Name: roleBinding.ClusterRoleName,
}
target.Subjects = roleBinding.Subjects
return controllerutil.SetControllerReference(tenant, target, r.Scheme())

4
pkg/api/additional_role_bindings.go
View File

@@ -11,4 +11,8 @@ type AdditionalRoleBindingsSpec struct {
ClusterRoleName string `json:"clusterRoleName"`
// kubebuilder:validation:Minimum=1
Subjects []rbacv1.Subject `json:"subjects"`
// Additional Labels for the synchronized rolebindings
Labels map[string]string `json:"labels,omitempty"`
// Additional Annotations for the synchronized rolebindings
Annotations map[string]string `json:"annotations,omitempty"`
}

14
pkg/api/zz_generated.deepcopy.go
View File

@@ -85,6 +85,20 @@ func (in *AdditionalRoleBindingsSpec) DeepCopyInto(out *AdditionalRoleBindingsSp
*out = make([]rbacv1.Subject, len(*in))
copy(*out, *in)
}
if in.Labels != nil {
in, out := &in.Labels, &out.Labels
*out = make(map[string]string, len(*in))
for key, val := range *in {
(*out)[key] = val
}
}
if in.Annotations != nil {
in, out := &in.Annotations, &out.Annotations
*out = make(map[string]string, len(*in))
for key, val := range *in {
(*out)[key] = val
}
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdditionalRoleBindingsSpec.