Documentation
¶
Overview ¶
Package rbac names the controller's per-namespace write grant (ADR-092) and builds the RoleBinding that carries it.
The controller, nvcrectl and the chart all refer to the same role, binding and ServiceAccount. Keeping the names and the manifest here means the RoleBinding nvcrectl creates, the one `nvcrectl rbac print` writes, and the one the controller quotes when it is waiting for access cannot drift apart.
Index ¶
Constants ¶
const ( // RunRoleName is the ClusterRole holding every write the controller makes // to a namespaced resource outside NVCRE's API group. The chart installs it // but binds it cluster-wide only under rbac.scope: cluster. RunRoleName = "nvcre-run-role" // RunBindingName is the RoleBinding that grants RunRoleName to the // controller in one run namespace. RunBindingName = "nvcre-manager-run" // ClusterModeRunBindingName is the ClusterRoleBinding the chart renders // under rbac.scope: cluster. Its presence means every namespace is already // granted, so nvcrectl creates no per-namespace binding. ClusterModeRunBindingName = "nvcre-run-rolebinding" // ManagerRoleBindingName is the chart's cluster-wide binding of // nvcre-manager-role. Its subject is the controller ServiceAccount, which // is how nvcrectl learns the ServiceAccount of a release it did not name. ManagerRoleBindingName = "nvcre-manager-rolebinding" // DefaultControllerNamespace and DefaultServiceAccountName identify the // controller as `nvcrectl setup init` installs it: release "nvcre" in // namespace "nvcre" with the chart's nameOverride. DefaultControllerNamespace = "nvcre" DefaultServiceAccountName = "nvcre-manager" // ManagedByLabel marks objects by the tool that created them. ManagedByLabel = "app.kubernetes.io/managed-by" )
Variables ¶
This section is empty.
Functions ¶
func GrantsRunRole ¶
func GrantsRunRole(binding *rbacv1.RoleBinding, sa ServiceAccount) bool
GrantsRunRole reports whether binding grants RunRoleName to sa. A binding with the right name but another role or subject is not a grant, and nvcrectl refuses to adopt it.
func NewCommand ¶
NewCommand returns the `nvcrectl rbac` command group.
func RunBinding ¶
func RunBinding(runNamespace string, sa ServiceAccount) *rbacv1.RoleBinding
RunBinding returns the RoleBinding that grants RunRoleName to sa in runNamespace.
func RunBindingYAML ¶
func RunBindingYAML(runNamespace string, sa ServiceAccount) (string, error)
RunBindingYAML renders RunBinding as a manifest a user can apply.
Types ¶
type ServiceAccount ¶
ServiceAccount identifies the controller's ServiceAccount.
func DefaultServiceAccount ¶
func DefaultServiceAccount() ServiceAccount
DefaultServiceAccount returns the ServiceAccount `nvcrectl setup init` installs.
func (ServiceAccount) String ¶
func (s ServiceAccount) String() string
String formats the ServiceAccount as namespace/name.
Source Files