Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Azure actions and data actions #516

Closed
wants to merge 1 commit into from
Closed

Support Azure actions and data actions #516

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/operator/api/v1beta1/clientintents_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,13 +258,22 @@ type Intent struct {
//+optional
AzureRoles []string `json:"azureRoles,omitempty" yaml:"azureRoles,omitempty"`

//+optional
AzureDataActions []AzureDataAction `json:"azureDataActions,omitempty" yaml:"azureDataActions,omitempty"`

//+optional
AzureActions []AzureAction `json:"azureActions,omitempty" yaml:"azureActions,omitempty"`

//+optional
AzureKeyVaultPolicy *AzureKeyVaultPolicy `json:"azureKeyVaultPolicy,omitempty" yaml:"azureKeyVaultPolicy,omitempty"`

//+optional
Internet *Internet `json:"internet,omitempty" yaml:"internet,omitempty"`
}

type AzureDataAction string
type AzureAction string

type Internet struct {
//+optional
Domains []string `json:"domains,omitempty" yaml:"domains,omitempty"`
Expand Down
42 changes: 27 additions & 15 deletions src/operator/api/v1beta1/webhooks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,22 +248,28 @@ func (in *ClientIntents) ConvertTo(dstRaw conversion.Hub) error {
}
if call.Type == IntentTypeAzure {
dst.Spec.Targets[i] = v2alpha1.Target{Azure: lo.ToPtr(v2alpha1.AzureTarget{Scope: call.Name, Roles: call.AzureRoles})}
if call.AzureKeyVaultPolicy == nil {
continue
if len(call.AzureActions) > 0 {
dst.Spec.Targets[i].Azure.Actions = lo.Map(call.AzureActions, func(action AzureAction, _ int) v2alpha1.AzureAction { return v2alpha1.AzureAction(action) })
}
if len(call.AzureDataActions) > 0 {
dst.Spec.Targets[i].Azure.DataActions = lo.Map(call.AzureDataActions, func(action AzureDataAction, _ int) v2alpha1.AzureDataAction { return v2alpha1.AzureDataAction(action) })
}

if call.AzureKeyVaultPolicy != nil {
dst.Spec.Targets[i].Azure.KeyVaultPolicy = &v2alpha1.AzureKeyVaultPolicy{}
dst.Spec.Targets[i].Azure.KeyVaultPolicy.KeyPermissions = lo.Map(call.AzureKeyVaultPolicy.KeyPermissions, func(permission AzureKeyVaultKeyPermission, _ int) v2alpha1.AzureKeyVaultKeyPermission {
return v2alpha1.AzureKeyVaultKeyPermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.SecretPermissions = lo.Map(call.AzureKeyVaultPolicy.SecretPermissions, func(permission AzureKeyVaultSecretPermission, _ int) v2alpha1.AzureKeyVaultSecretPermission {
return v2alpha1.AzureKeyVaultSecretPermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.CertificatePermissions = lo.Map(call.AzureKeyVaultPolicy.CertificatePermissions, func(permission AzureKeyVaultCertificatePermission, _ int) v2alpha1.AzureKeyVaultCertificatePermission {
return v2alpha1.AzureKeyVaultCertificatePermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.StoragePermissions = lo.Map(call.AzureKeyVaultPolicy.StoragePermissions, func(permission AzureKeyVaultStoragePermission, _ int) v2alpha1.AzureKeyVaultStoragePermission {
return v2alpha1.AzureKeyVaultStoragePermission(permission)
})
}
dst.Spec.Targets[i].Azure.KeyVaultPolicy = &v2alpha1.AzureKeyVaultPolicy{}
dst.Spec.Targets[i].Azure.KeyVaultPolicy.KeyPermissions = lo.Map(call.AzureKeyVaultPolicy.KeyPermissions, func(permission AzureKeyVaultKeyPermission, _ int) v2alpha1.AzureKeyVaultKeyPermission {
return v2alpha1.AzureKeyVaultKeyPermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.SecretPermissions = lo.Map(call.AzureKeyVaultPolicy.SecretPermissions, func(permission AzureKeyVaultSecretPermission, _ int) v2alpha1.AzureKeyVaultSecretPermission {
return v2alpha1.AzureKeyVaultSecretPermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.CertificatePermissions = lo.Map(call.AzureKeyVaultPolicy.CertificatePermissions, func(permission AzureKeyVaultCertificatePermission, _ int) v2alpha1.AzureKeyVaultCertificatePermission {
return v2alpha1.AzureKeyVaultCertificatePermission(permission)
})
dst.Spec.Targets[i].Azure.KeyVaultPolicy.StoragePermissions = lo.Map(call.AzureKeyVaultPolicy.StoragePermissions, func(permission AzureKeyVaultStoragePermission, _ int) v2alpha1.AzureKeyVaultStoragePermission {
return v2alpha1.AzureKeyVaultStoragePermission(permission)
})
}
if call.Type == IntentTypeInternet && call.Internet != nil {
dst.Spec.Targets[i] = v2alpha1.Target{Internet: lo.ToPtr(v2alpha1.Internet{Domains: call.Internet.Domains, Ports: call.Internet.Ports, Ips: call.Internet.Ips})}
Expand Down Expand Up @@ -335,6 +341,12 @@ func (in *ClientIntents) ConvertFrom(srcRaw conversion.Hub) error {
}
if target.Azure != nil {
in.Spec.Calls[i] = Intent{Type: IntentTypeAzure, Name: target.Azure.Scope, AzureRoles: target.Azure.Roles}
if len(target.Azure.Actions) > 0 {
in.Spec.Calls[i].AzureActions = lo.Map(target.Azure.Actions, func(action v2alpha1.AzureAction, _ int) AzureAction { return AzureAction(action) })
}
if len(target.Azure.DataActions) > 0 {
in.Spec.Calls[i].AzureDataActions = lo.Map(target.Azure.DataActions, func(action v2alpha1.AzureDataAction, _ int) AzureDataAction { return AzureDataAction(action) })
}
if target.Azure.KeyVaultPolicy == nil {
continue
}
Expand Down
45 changes: 45 additions & 0 deletions src/operator/api/v1beta1/webhooks_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,51 @@ func (t *WebhooksTestSuite) TestClientIntentsFromV2_EmptySliceHTTPShouldNotBeTyp
t.Require().Equal("", string(converted.Spec.Calls[1].Type))
}

func (t *WebhooksTestSuite) TestClientIntentsAzureActionsDataActions() {
// Create a ClientIntents with random data
original := &ClientIntents{
ObjectMeta: metav1.ObjectMeta{
Name: "test",
Namespace: "test",
},
Spec: &IntentsSpec{
Service: Service{
Name: "test",
},
Calls: []Intent{
{
Name: "testscope1",
Type: IntentTypeAzure,
AzureDataActions: []AzureDataAction{
"testDataAction1",
"testDataAction2",
},
},
{
Name: "testscope2",
Type: IntentTypeAzure,
AzureActions: []AzureAction{
"testAction1",
"testAction2",
},
},
},
},
}

// ConvertTo
dstRaw := &v2alpha1.ClientIntents{}
err := original.ConvertTo(dstRaw)
t.Require().NoError(err)

// ConvertFrom
converted := &ClientIntents{}
err = converted.ConvertFrom(dstRaw)
t.Require().NoError(err)

t.Require().Equal(original.Spec, converted.Spec)
}

func TestWebhooksTestSuite(t *testing.T) {
suite.Run(t, new(WebhooksTestSuite))
}
10 changes: 10 additions & 0 deletions src/operator/api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 10 additions & 1 deletion src/operator/api/v2alpha1/clientintents_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,12 +276,21 @@ type GCPTarget struct {
}

type AzureTarget struct {
Scope string `json:"scope,omitempty" yaml:"scope,omitempty"`
Scope string `json:"scope,omitempty" yaml:"scope,omitempty"`
//+optional
Roles []string `json:"roles,omitempty" yaml:"roles,omitempty"`
//+optional
KeyVaultPolicy *AzureKeyVaultPolicy `json:"keyVaultPolicy,omitempty" yaml:"keyVaultPolicy,omitempty"`
//+optional
Actions []AzureAction `json:"actions,omitempty" yaml:"actions,omitempty"`
//+optional
DataActions []AzureDataAction `json:"dataActions,omitempty" yaml:"dataActions,omitempty"`
}

type AzureAction string

type AzureDataAction string

type KubernetesTarget struct {
Name string `json:"name" yaml:"name"`
Kind string `json:"kind" yaml:"kind"`
Expand Down
10 changes: 10 additions & 0 deletions src/operator/api/v2alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 16 additions & 0 deletions src/operator/config/crd/k8s.otterize.com_clientintents.patched
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,14 @@ spec:
items:
type: string
type: array
azureActions:
items:
type: string
type: array
azureDataActions:
items:
type: string
type: array
azureKeyVaultPolicy:
properties:
certificatePermissions:
Expand Down Expand Up @@ -737,6 +745,14 @@ spec:
type: object
azure:
properties:
actions:
items:
type: string
type: array
dataActions:
items:
type: string
type: array
keyVaultPolicy:
properties:
certificatePermissions:
Expand Down
16 changes: 16 additions & 0 deletions src/operator/config/crd/k8s.otterize.com_clientintents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,6 +473,14 @@ spec:
items:
type: string
type: array
azureActions:
items:
type: string
type: array
azureDataActions:
items:
type: string
type: array
azureKeyVaultPolicy:
properties:
certificatePermissions:
Expand Down Expand Up @@ -726,6 +734,14 @@ spec:
type: object
azure:
properties:
actions:
items:
type: string
type: array
dataActions:
items:
type: string
type: array
keyVaultPolicy:
properties:
certificatePermissions:
Expand Down
16 changes: 16 additions & 0 deletions src/operator/otterizecrds/clientintents-customresourcedefinition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,14 @@ spec:
items:
type: string
type: array
azureActions:
items:
type: string
type: array
azureDataActions:
items:
type: string
type: array
azureKeyVaultPolicy:
properties:
certificatePermissions:
Expand Down Expand Up @@ -737,6 +745,14 @@ spec:
type: object
azure:
properties:
actions:
items:
type: string
type: array
dataActions:
items:
type: string
type: array
keyVaultPolicy:
properties:
certificatePermissions:
Expand Down
18 changes: 18 additions & 0 deletions src/operator/webhooks/clientintents_webhook_v2alpha1.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -385,6 +385,24 @@ func (v *IntentsValidatorV2alpha1) validateAzureTarget(azureTarget *otterizev2al
Detail: "invalid intent format, field scope is required",
}
}
// check that at least one of the optional fields is set
if len(azureTarget.Actions) == 0 && len(azureTarget.DataActions) == 0 && len(azureTarget.Roles) == 0 && azureTarget.KeyVaultPolicy == nil {
return &field.Error{
Type: field.ErrorTypeRequired,
Field: "actions",
Detail: "invalid intent format, at least one of [actions, dataActions, roles, keyVaultPolicy] must be set",
}
}

// check that that if intents uses actions/dataActions then roles must be empty (and vice versa)
if (len(azureTarget.Actions) > 0 || len(azureTarget.DataActions) > 0) && len(azureTarget.Roles) > 0 {
return &field.Error{
Type: field.ErrorTypeRequired,
Field: "roles",
Detail: "invalid intent format, if actions or dataActions are set, roles must be empty",
}
}

return nil

}
Expand Down
Loading