680b7b9bf8
We do not want to pass the admin kubeconfig to the customers. It's extremely hard to revoke the access of an admin kubeconfig and we would need to rotate the cluster's CA to do that. But with RBAC tokens, we can easily reovke accesss by deleting the secret or SA. So for now we will create a SA, ClusterRolebinding and secret for creating a RBAC token and then passing the customers a kubeconfig with that. We will use the cluster-admin ClusterRole to give enough access to the customer to do whatever they want.
42 lines
1.0 KiB
Ruby
42 lines
1.0 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class Clover
|
|
hash_branch(:project_location_prefix, "kubernetes-cluster") do |r|
|
|
r.web do
|
|
r.on NAME_OR_UBID do |kc_name, kc_ubid|
|
|
filter = if kc_name
|
|
{Sequel[:kubernetes_cluster][:name] => kc_name}
|
|
else
|
|
{Sequel[:kubernetes_cluster][:id] => UBID.to_uuid(kc_ubid)}
|
|
end
|
|
|
|
filter[:location] = @location
|
|
kc = @project.kubernetes_clusters_dataset.first(filter)
|
|
|
|
next 404 unless kc
|
|
|
|
r.get true do
|
|
authorize("KubernetesCluster:view", kc.id)
|
|
|
|
@kc = kc
|
|
view "kubernetes-cluster/show"
|
|
end
|
|
|
|
r.delete true do
|
|
authorize("KubernetesCluster:delete", kc.id)
|
|
kc.incr_destroy
|
|
204
|
|
end
|
|
|
|
r.get "kubeconfig" do
|
|
authorize("KubernetesCluster:edit", kc.id)
|
|
|
|
response["Content-Type"] = "text/plain"
|
|
response["Content-Disposition"] = "attachment; filename=\"#{kc.name}-kubeconfig.yaml\""
|
|
kc.kubeconfig
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|