feat(plugins): add optional consumer name to show consumer permissions#1455
Conversation
| echo "DESCRIPTION" | ||
| echo " kubectl show consumer permissions shows the permissions for kubeplus-saas-consumer service account in the namespace where kubeplus is installed." | ||
| echo " kubectl show consumer permissions shows the RBAC permissions for a consumer service account." | ||
| echo " Namespace is the namespace where KubePlus is installed (where the consumer service account lives)." |
There was a problem hiding this comment.
We should change how we use the Namespace parameter. Till now we have only supported creating consumer service accounts in the same namespace where KubePlus is installed. But going forward, we want to support use cases of the following nature. Suppose as a Platform team, I have enabled CustomMySQLService on my cluster. Suppose team1 deploys an instance of this service (call it team1mysql). KubePlus will generate a namespace by this name corresponding to this instance. Now, suppose the Platform team wants to provide team1 access to this namespace. In this case, we want the Platform team to be able to create a service account in the "team1mysql" namespace. We should view the Namespace parameter from this lens.
| echo " kubectl show consumer permissions shows the permissions for kubeplus-saas-consumer service account in the namespace where kubeplus is installed." | ||
| echo " kubectl show consumer permissions shows the RBAC permissions for a consumer service account." | ||
| echo " Namespace is the namespace where KubePlus is installed (where the consumer service account lives)." | ||
| echo " ConsumerName is optional; if omitted, defaults to kubeplus-saas-consumer." |
There was a problem hiding this comment.
Given the above comment regarding Namespace, it would mean that the consumer name cannot be optional. If we keep it optional, then it will not be clear which specific consumer service account will be used. So let's not make this parameter optional.
|
It seems like we have two separate use-cases for consumer service accounts. 1) A consumer service account that has the permission to create an application instance. This account is not restricted to any namespace. 2) A consumer service account that has the permissions restricted to an application instance's namespace. This type of service account can be used for debugging purposes. We should accommodate for both these types of service accounts. |
- Add optional ConsumerName parameter (defaults to kubeplus-saas-consumer) - Supports custom consumers created via provider-kubeconfig.py -c (e.g. team1, team2) - Update help text and kubectl-kubeplus-commands documentation - Fixes cloud-ark#1091
anniegracehu
force-pushed
the
consumer-permissions-plugin-accept-name
branch
from
69cb169 to
269175d
Compare
| } | ||
|
|
||
| if (( $# < 1 || $# >= 2)); then | ||
| if (( $# != 2)); then |
devdattakulkarni
left a comment
devdattakulkarni
left a comment
There was a problem hiding this comment.
Mostly looks good. I have only one more comment (see below). You can remove the draft status on the PR after you address the comment.
plugins/kubectl-kubeplus-commands
Outdated
| echo " kubectl upload chart" | ||
| echo " kubectl show provider permissions" | ||
| echo " kubectl show consumer permissions" | ||
| echo " kubectl show consumer permissions <Namespace> <ConsumerName>" |
There was a problem hiding this comment.
No need to include parameters here. This file (and the "kubectl kubeplus commands" command) just shows all the available commands. The details about individual command's parameters are defined in each command's file.
Also, if you notice, none of the other commands include parameters in this file.
2 participants
Summary
Updates
kubectl show consumer permissionsto require bothNamespaceandConsumerName, and aligns the plugin with the new namespace/consumer semantics for issue #1439.Changes
kubectl-show-consumer-permissions
kubectl show consumer permissions <Namespace> <ConsumerName>— both are required.kubeplus-saas-consumer; callers must specify the consumer SA.kubeplus-saas-consumerin the KubePlus namespace).kubectl-kubeplus-commands
kubeconfigretriever.py
Usage
Instance-creation consumer (built-in, lives in KubePlus namespace)
kubectl show consumer permissions default kubeplus-saas-consumer
Instance-scoped consumer for debugging (lives in instance namespace)
kubectl show consumer permissions team1mysql team1-debug