Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KO-251: Added auth sub-command to grant RBAC access #6

Merged
merged 7 commits into from
Sep 28, 2023
Merged
Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,5 @@
# vendor/

dist/
bin/
.idea/
90 changes: 62 additions & 28 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,41 +1,21 @@
# Aerospike-kubernetes-operator-ctl

This is a command line tool for Aerospike kubernetes operator.

## Aerospike Kubernetes Operator Log Collector

### Overview

collectinfo command collects all the required info from kubernetes cluster, which are available at the time of command being executed.

There are certain flags associated with command:
* **all-namespaces** - (shorthand -A, type bool) Collect info from all namespaces present in cluster.
* **namespaces** - (shorthand -n, type string) Comma separated list of namespaces from which data needs to be collected.
* **kubeconfig** - (type string) Absolute path to the kubeconfig file.
* **path** - (type string) Absolute path to save output tar file.
* **cluster-scope** - (type bool) Permission to collect cluster scoped objects info. Default true.

### Requirements
* Current user should have the list and get permission for all the objects collected by the command.
* If **cluster-scope** flag is set, along with permission mentioned above, user should have list and get permission for cluster-scoped resources like(nodes and storageclasses).
* **Kubectl** binary should be available in **PATH** environment variable.
This is a command line tool for Aerospike Kubernetes Operator. It provides multiple sub-commands to perform different functions related to Aerospike Kubernetes Operator and Aerospike Kubernetes Cluster.

Available sub-commands:
1. [`collectinfo`](#aerospike-kubernetes-operator-log-collector)
2. [`auth`](#grant-aerospike-kubernetes-cluster-rbac)
### Building and quick start

#### Building akoctl binary
#### Building akoctl binary for local testing
```sh
make build
```

#### Collect cluster info
```sh
./bin/akoctl collectinfo -n aerospike,olm --path ~/abc/
```

#### Install via krew plugin manager
#### Install via Krew plugin manager
[Krew](https://krew.sigs.k8s.io) is the plugin manager for kubectl command-line tool. Here `akoctl` has been added as a custom plugin to krew.

##### Install krew
##### Install Krew
To install krew on any platform, follow [this](https://krew.sigs.k8s.io/docs/user-guide/setup/install/).
##### Install akoctl
```sh
Expand All @@ -57,7 +37,25 @@ Installed plugin: akoctl
| Documentation:
| https://github.com/aerospike/aerospike-kubernetes-operator-ctl
/
```

## Aerospike Kubernetes Operator Log Collector

### Overview

`collectinfo` command collects all the required info from kubernetes cluster, which are available at the time of command being executed.

Flag associated with this command:
* **path** - (type string) Absolute path to save output tar file.

### Requirements
* Current user should have the list and get permission for all the objects collected by the command.
* If **cluster-scope** flag is set, along with permissions mentioned above, user should have list and get permission for cluster-scoped resources like(nodes and storageclasses).
* * **Kubectl** binary should be available in **PATH** environment variable.

#### Collect cluster info using local binary
```sh
./bin/akoctl collectinfo -n aerospike,olm --path ~/abc/
```

#### Collect cluster info using krew
Expand Down Expand Up @@ -123,4 +121,40 @@ akoctl_collectinfo
│   ├── events.txt
└──────────────────────────

```
```

## Grant Aerospike Kubernetes Cluster RBAC

### Overview

`auth` command creates/deletes RBAC resources for Aerospike cluster for the given namespaces.
It creates/deletes ServiceAccount, RoleBinding or ClusterRoleBinding as per given scope of operation.

There are 2 sub-commands associated with this command:
* `create` - It creates/updates RBAC resources for the given namespaces.
* `delete` - It deletes RBAC resources for the given namespaces.

If `cluster-scope` is set (Default true), auth command grants cluster level RBAC whereas in case of `cluster-scope` false, it grants namespace level RBAC.

### Permission required
* Current user should have the CREATE, GET, UPDATE and DELETE permission for ServiceAccount and RoleBinding.
* If **cluster-scope** flag is set, user should have the CREATE, GET, UPDATE and DELETE permission for ServiceAccount and ClusterRoleBinding.

#### Collect cluster info
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change heading

```sh
./bin/akoctl auth create -n aerospike,olm
./bin/akoctl auth delete -n aerospike,olm
```

#### Collect cluster info using krew
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change heading

```sh
kubectl akoctl auth create -n aerospike,olm
kubectl akoctl auth delete -n aerospike,olm
```

## Global Flags:
There are certain global flags associated with akoctl:
* **all-namespaces** - (shorthand -A, type bool) Specify all namespaces present in cluster.
* **namespaces** - (shorthand -n, type string) Comma separated list of namespaces to perform operation in.
* **kubeconfig** - (type string) Absolute path to the kubeconfig file.
* **cluster-scope** - (type bool) Permission to work in cluster scoped mode (operate on cluster scoped resources like ClusterRoleBinding). Default true.
74 changes: 74 additions & 0 deletions cmd/auth.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
/*
Copyright 2023 The aerospike-operator Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package cmd

import (
"context"

"github.com/spf13/cobra"

"github.com/aerospike/aerospike-kubernetes-operator-ctl/pkg/auth"
"github.com/aerospike/aerospike-kubernetes-operator-ctl/pkg/configuration"
)

// authCmd represents the auth command
var authCmd = &cobra.Command{
Use: "auth",
Short: "auth command is used to create or delete RBAC resources for Aerospike cluster for the given namespaces",
Long: `This command has subcommands that will create or delete RBAC resources for Aerospike cluster for the given
namespaces.
It creates/deletes ServiceAccount, RoleBinding or ClusterRoleBinding as per given scope`,
}

var authCreateCmd = &cobra.Command{
Use: "create",
Short: "create command is used to create or update RBAC resources for Aerospike cluster for the given namespaces",
Long: `This command will create RBAC resources for Aerospike cluster for the given
namespaces.
It creates ServiceAccount, RoleBinding or ClusterRoleBinding as per given scope`,
RunE: func(cmd *cobra.Command, args []string) error {
ctx := context.TODO()
params, err := configuration.NewParams(ctx, namespaces, allNamespaces, clusterScope)
if err != nil {
return err
}

return auth.Create(ctx, params)
},
}

var authDeleteCmd = &cobra.Command{
Use: "delete",
Short: "delete command is used to delete RBAC resources for Aerospike cluster for the given namespaces",
Long: `This command will delete RBAC resources for Aerospike cluster for the given
namespaces.
It deletes ServiceAccount, RoleBinding or ClusterRoleBinding as per given scope`,
RunE: func(cmd *cobra.Command, args []string) error {
ctx := context.TODO()
params, err := configuration.NewParams(ctx, namespaces, allNamespaces, clusterScope)
if err != nil {
return err
}

return auth.Delete(ctx, params)
},
}

func init() {
rootCmd.AddCommand(authCmd)
authCmd.AddCommand(authCreateCmd)
authCmd.AddCommand(authDeleteCmd)
}
25 changes: 11 additions & 14 deletions cmd/collectinfo.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,16 @@ limitations under the License.
package cmd

import (
"context"

"github.com/spf13/cobra"

"github.com/aerospike/aerospike-kubernetes-operator-ctl/pkg/collectinfo"
"github.com/aerospike/aerospike-kubernetes-operator-ctl/pkg/configuration"
)

var (
kubeconfig string
namespaces []string
path string
allNamespaces bool
clusterScope bool
path string
)

// collectinfoCmd represents the collectinfo command
Expand All @@ -39,21 +38,19 @@ var collectinfoCmd = &cobra.Command{
* containers logs.
* events logs.`,
RunE: func(cmd *cobra.Command, args []string) error {
return collectinfo.RunCollectInfo(namespaces, path, allNamespaces, clusterScope)
ctx := context.TODO()
params, err := configuration.NewParams(ctx, namespaces, allNamespaces, clusterScope)
if err != nil {
return err
}

return collectinfo.RunCollectInfo(ctx, params, path)
},
}

func init() {
rootCmd.AddCommand(collectinfoCmd)

collectinfoCmd.Flags().StringVar(&kubeconfig, "kubeconfig", "",
"Absolute path to the kubeconfig file")
collectinfoCmd.Flags().StringSliceVarP(&namespaces, "namespaces", "n", namespaces,
"Namespaces for which logs to be collected")
collectinfoCmd.Flags().StringVar(&path, "path", "",
"Absolute path where generated tar file will be saved")
collectinfoCmd.Flags().BoolVarP(&allNamespaces, "all-namespaces", "A", false,
"Collect info from all namespaces")
collectinfoCmd.Flags().BoolVar(&clusterScope, "cluster-scope", true,
"Permission to collect cluster scoped objects info")
}
23 changes: 21 additions & 2 deletions cmd/root.go
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,19 @@ import (
"github.com/spf13/cobra"
)

var (
kubeconfig string
namespaces []string
allNamespaces bool
clusterScope bool
)

var rootCmd = &cobra.Command{
Use: "akoctl",
Short: "A command line tool for Aerospike Kubernetes Operator",
Long: `A CLI which is used to interact with
Aerospike Kubernetes Operator cluster. For example:
Long: `A CLI which is used to perform different functions related to Aerospike Kubernetes Operator and
Aerospike Kubernetes Operator cluster.
For example:
akoctl collectinfo --namespaces aerospike,olm`,
}

Expand All @@ -35,3 +43,14 @@ func Execute() {
os.Exit(1)
}
}

func init() {
rootCmd.PersistentFlags().StringSliceVarP(&namespaces, "namespaces", "n", namespaces,
"Comma separated list of namespaces to perform operation in")
rootCmd.PersistentFlags().StringVar(&kubeconfig, "kubeconfig", "",
"Absolute path to the kubeconfig file")
rootCmd.PersistentFlags().BoolVarP(&allNamespaces, "all-namespaces", "A", false,
"Specify all namespaces present in cluster")
rootCmd.PersistentFlags().BoolVar(&clusterScope, "cluster-scope", true,
"Permission to work in cluster scoped mode (operate on cluster scoped resources like ClusterRoleBinding)")
}
8 changes: 4 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,13 @@ require (
github.com/onsi/gomega v1.27.6
github.com/spf13/cobra v1.7.0
go.uber.org/zap v1.24.0
gopkg.in/yaml.v2 v2.4.0
golang.org/x/net v0.13.0
k8s.io/api v0.27.1
k8s.io/apiextensions-apiserver v0.27.1
k8s.io/apimachinery v0.27.1
k8s.io/client-go v0.27.1
k8s.io/kube-openapi v0.0.0-20230515203736-54b630e78af5
sigs.k8s.io/controller-runtime v0.14.6
sigs.k8s.io/yaml v1.3.0
)

require (
Expand Down Expand Up @@ -45,7 +45,6 @@ require (
github.com/spf13/pflag v1.0.5 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/net v0.13.0 // indirect
golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 // indirect
golang.org/x/sys v0.10.0 // indirect
golang.org/x/term v0.10.0 // indirect
Expand All @@ -55,10 +54,11 @@ require (
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.30.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/klog/v2 v2.100.1 // indirect
k8s.io/kube-openapi v0.0.0-20230515203736-54b630e78af5 // indirect
k8s.io/utils v0.0.0-20230505201702-9f6742963106 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
)
Loading