2247d8c3a2
* + endpoint and namespace level authorizations + user namespace authorization API + k8s client setup service account with k8s roles and policies by portainer role * User authorization changes refresh token cache * rbac authorizes k8s requests * CE to EE migrator to include new authorizations * code clean up * comments * * merge in the RestrictDefaultNamespace changes * - remove unnecessary check for default namespace * + updates namespace access policies when generating token * * updates namespace access policies when querying the user namespace endpoint * + k8s rule in rbac.go for endpoint access test + missing k8s cluster rules for different roles * feat(rbac): update kube rbac * feat(rbac): use the authorization directive * feat(rbac): Update namespace access policies when user/team is deleted * refactor(app): use new angular-multi-select capabilities * feat(rbac): fix authorizations * feat(rbac): fix userAccessPolicies update bug * feat(rbac): add W applications authorizations * feat(rbac): add application details W authorizations * feat(rbac): add configurations W autohorizations * feat(rbac): add configuration details W authorizations * feat(rbac): add volumes W authorizations * feat(rbac): add volume details W authorizations * feat(rbac): add componentstatus to portainer-view role and add cluster/node authorizations * fix(rbac): disable application note for non authorized user * fix(rbac): add endpoints list and components status to portainer-basic * fix(rbac): allow user to access default namespace when restrict default namespace isn't activated * fix(rbac): remove default namespace from useraccesspolicies when restrict default namespace isn't activated * fix(rbac): change some things * fix(rbac): allow standard user to access container console * - removed unused parameter * fix(rbac): fix team authorizations Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com> Co-authored-by: xAt0mZ <baron_l@epitech.eu>
107 lines
3.4 KiB
JavaScript
107 lines
3.4 KiB
JavaScript
import _ from 'lodash-es';
|
|
|
|
import angular from 'angular';
|
|
import PortainerError from 'Portainer/error';
|
|
import { KubernetesCommonParams } from 'Kubernetes/models/common/params';
|
|
import KubernetesNamespaceConverter from 'Kubernetes/converters/namespace';
|
|
import $allSettled from 'Portainer/services/allSettled';
|
|
|
|
class KubernetesNamespaceService {
|
|
/* @ngInject */
|
|
constructor($async, KubernetesNamespaces, Authentication, KubernetesNamespaceHelper) {
|
|
this.$async = $async;
|
|
this.KubernetesNamespaces = KubernetesNamespaces;
|
|
this.Authentication = Authentication;
|
|
this.KubernetesNamespaceHelper = KubernetesNamespaceHelper;
|
|
|
|
this.getAsync = this.getAsync.bind(this);
|
|
this.getAllAsync = this.getAllAsync.bind(this);
|
|
this.createAsync = this.createAsync.bind(this);
|
|
this.deleteAsync = this.deleteAsync.bind(this);
|
|
}
|
|
|
|
/**
|
|
* GET
|
|
*/
|
|
async getAsync(name) {
|
|
try {
|
|
const params = new KubernetesCommonParams();
|
|
params.id = name;
|
|
await this.KubernetesNamespaces().status(params).$promise;
|
|
const [raw, yaml] = await Promise.all([this.KubernetesNamespaces().get(params).$promise, this.KubernetesNamespaces().getYaml(params).$promise]);
|
|
return KubernetesNamespaceConverter.apiToNamespace(raw, yaml);
|
|
} catch (err) {
|
|
throw new PortainerError('Unable to retrieve namespace', err);
|
|
}
|
|
}
|
|
|
|
async getAllAsync() {
|
|
try {
|
|
const data = await this.KubernetesNamespaces().get().$promise;
|
|
const promises = _.map(data.items, (item) => this.KubernetesNamespaces().status({ id: item.metadata.name }).$promise);
|
|
const namespaces = await $allSettled(promises);
|
|
const hasK8sAccessSystemNamespaces = this.Authentication.hasAuthorizations(['K8sAccessSystemNamespaces']);
|
|
const visibleNamespaces = _.map(namespaces.fulfilled, (item) => {
|
|
if (item.status.phase !== 'Terminating') {
|
|
const namespace = KubernetesNamespaceConverter.apiToNamespace(item);
|
|
if (this.KubernetesNamespaceHelper.isSystemNamespace(namespace.Name)) {
|
|
if (hasK8sAccessSystemNamespaces) {
|
|
return namespace;
|
|
}
|
|
} else {
|
|
return namespace;
|
|
}
|
|
}
|
|
});
|
|
return _.without(visibleNamespaces, undefined);
|
|
} catch (err) {
|
|
throw new PortainerError('Unable to retrieve namespaces', err);
|
|
}
|
|
}
|
|
|
|
get(name) {
|
|
if (name) {
|
|
return this.$async(this.getAsync, name);
|
|
}
|
|
return this.$async(this.getAllAsync);
|
|
}
|
|
|
|
/**
|
|
* CREATE
|
|
*/
|
|
async createAsync(namespace) {
|
|
try {
|
|
const payload = KubernetesNamespaceConverter.createPayload(namespace);
|
|
const params = {};
|
|
const data = await this.KubernetesNamespaces().create(params, payload).$promise;
|
|
return data;
|
|
} catch (err) {
|
|
throw new PortainerError('Unable to create namespace', err);
|
|
}
|
|
}
|
|
|
|
create(namespace) {
|
|
return this.$async(this.createAsync, namespace);
|
|
}
|
|
|
|
/**
|
|
* DELETE
|
|
*/
|
|
async deleteAsync(namespace) {
|
|
try {
|
|
const params = new KubernetesCommonParams();
|
|
params.id = namespace.Name;
|
|
await this.KubernetesNamespaces().delete(params).$promise;
|
|
} catch (err) {
|
|
throw new PortainerError('Unable to delete namespace', err);
|
|
}
|
|
}
|
|
|
|
delete(namespace) {
|
|
return this.$async(this.deleteAsync, namespace);
|
|
}
|
|
}
|
|
|
|
export default KubernetesNamespaceService;
|
|
angular.module('portainer.kubernetes').service('KubernetesNamespaceService', KubernetesNamespaceService);
|