1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
package gateway
import (
rbacv1 "k8s.io/api/rbac/v1"
"github.com/johnandersen777/socialweb-computer-kcp/api/v1alpha1"
"github.com/johnandersen777/socialweb-computer-kcp/internal/contract/nodeclaim"
"github.com/johnandersen777/socialweb-computer-kcp/internal/vaultlayout"
)
const (
WebAppAccount = nodeclaim.AgentAccount
WebAppAccountNS = nodeclaim.AgentNamespace
WebAppGrant = "socialweb-computer-k8s-web-app"
RequesterGrant = "socialweb-computer-k8s-requester"
foreignAccountPrefix = "system:kcp:serviceaccount:"
)
type WebApp struct {
FrontKubeconfig string
ClusterCADir string
DownloadsDir string
}
func WebAppAccountRef(workspace string) string {
return nodeclaim.AgentRef(workspace)
}
func ForeignAccount(cluster, namespace, name string) string {
return foreignAccountPrefix + cluster + ":" + namespace + ":" + name
}
func WebAppRootRules(gateway string) []rbacv1.PolicyRule {
return []rbacv1.PolicyRule{
{NonResourceURLs: []string{"/"}, Verbs: []string{"access"}},
{APIGroups: []string{v1alpha1.GroupName}, Resources: []string{"gateways"}, ResourceNames: []string{gateway}, Verbs: []string{"get"}},
{APIGroups: []string{v1alpha1.GroupName}, Resources: []string{"openbaoservers"}, ResourceNames: []string{vaultlayout.RootServerName}, Verbs: []string{"get"}},
}
}
func RequesterRootRules() []rbacv1.PolicyRule {
return []rbacv1.PolicyRule{
{NonResourceURLs: []string{"/"}, Verbs: []string{"access"}},
{APIGroups: []string{v1alpha1.GroupName}, Resources: []string{"openbaoservers"}, ResourceNames: []string{vaultlayout.RootServerName}, Verbs: []string{"get"}},
}
}
