Files
portainer/app/kubernetes/services/namespaceService.js
T
Yi Chen 2247d8c3a2 (feat)k8s/RBAC: Provide Portainer RBAC functionality for Kubernetes endpoints (#35)
* + endpoint and namespace level authorizations
+ user namespace authorization API
+ k8s client setup service account with k8s roles and policies by portainer role
* User authorization changes refresh token cache
* rbac authorizes k8s requests
* CE to EE migrator to include new authorizations

* code clean up
* comments

* * merge in the RestrictDefaultNamespace changes

* - remove unnecessary check for default namespace

* + updates namespace access policies when generating token

* * updates namespace access policies when querying the user namespace endpoint

* + k8s rule in rbac.go for endpoint access test
+ missing k8s cluster rules for different roles

* feat(rbac): update kube rbac

* feat(rbac): use the authorization directive

* feat(rbac): Update namespace access policies when user/team is deleted

* refactor(app): use new angular-multi-select capabilities

* feat(rbac): fix authorizations

* feat(rbac): fix userAccessPolicies update bug

* feat(rbac): add W applications authorizations

* feat(rbac): add application details W authorizations

* feat(rbac): add configurations W autohorizations

* feat(rbac): add configuration details W authorizations

* feat(rbac): add volumes W authorizations

* feat(rbac): add volume details W authorizations

* feat(rbac): add componentstatus to portainer-view role and add cluster/node authorizations

* fix(rbac): disable application note for non authorized user

* fix(rbac): add endpoints list and components status to portainer-basic

* fix(rbac): allow user to access default namespace when restrict default namespace isn't activated

* fix(rbac): remove default namespace from useraccesspolicies when restrict default namespace isn't activated

* fix(rbac): change some things

* fix(rbac): allow standard user to access container console

* - removed unused parameter

* fix(rbac): fix team authorizations

Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com>
Co-authored-by: xAt0mZ <baron_l@epitech.eu>
2020-11-03 22:08:09 +13:00

107 lines
3.4 KiB
JavaScript

import _ from 'lodash-es';
import angular from 'angular';
import PortainerError from 'Portainer/error';
import { KubernetesCommonParams } from 'Kubernetes/models/common/params';
import KubernetesNamespaceConverter from 'Kubernetes/converters/namespace';
import $allSettled from 'Portainer/services/allSettled';
class KubernetesNamespaceService {
/* @ngInject */
constructor($async, KubernetesNamespaces, Authentication, KubernetesNamespaceHelper) {
this.$async = $async;
this.KubernetesNamespaces = KubernetesNamespaces;
this.Authentication = Authentication;
this.KubernetesNamespaceHelper = KubernetesNamespaceHelper;
this.getAsync = this.getAsync.bind(this);
this.getAllAsync = this.getAllAsync.bind(this);
this.createAsync = this.createAsync.bind(this);
this.deleteAsync = this.deleteAsync.bind(this);
}
/**
* GET
*/
async getAsync(name) {
try {
const params = new KubernetesCommonParams();
params.id = name;
await this.KubernetesNamespaces().status(params).$promise;
const [raw, yaml] = await Promise.all([this.KubernetesNamespaces().get(params).$promise, this.KubernetesNamespaces().getYaml(params).$promise]);
return KubernetesNamespaceConverter.apiToNamespace(raw, yaml);
} catch (err) {
throw new PortainerError('Unable to retrieve namespace', err);
}
}
async getAllAsync() {
try {
const data = await this.KubernetesNamespaces().get().$promise;
const promises = _.map(data.items, (item) => this.KubernetesNamespaces().status({ id: item.metadata.name }).$promise);
const namespaces = await $allSettled(promises);
const hasK8sAccessSystemNamespaces = this.Authentication.hasAuthorizations(['K8sAccessSystemNamespaces']);
const visibleNamespaces = _.map(namespaces.fulfilled, (item) => {
if (item.status.phase !== 'Terminating') {
const namespace = KubernetesNamespaceConverter.apiToNamespace(item);
if (this.KubernetesNamespaceHelper.isSystemNamespace(namespace.Name)) {
if (hasK8sAccessSystemNamespaces) {
return namespace;
}
} else {
return namespace;
}
}
});
return _.without(visibleNamespaces, undefined);
} catch (err) {
throw new PortainerError('Unable to retrieve namespaces', err);
}
}
get(name) {
if (name) {
return this.$async(this.getAsync, name);
}
return this.$async(this.getAllAsync);
}
/**
* CREATE
*/
async createAsync(namespace) {
try {
const payload = KubernetesNamespaceConverter.createPayload(namespace);
const params = {};
const data = await this.KubernetesNamespaces().create(params, payload).$promise;
return data;
} catch (err) {
throw new PortainerError('Unable to create namespace', err);
}
}
create(namespace) {
return this.$async(this.createAsync, namespace);
}
/**
* DELETE
*/
async deleteAsync(namespace) {
try {
const params = new KubernetesCommonParams();
params.id = namespace.Name;
await this.KubernetesNamespaces().delete(params).$promise;
} catch (err) {
throw new PortainerError('Unable to delete namespace', err);
}
}
delete(namespace) {
return this.$async(this.deleteAsync, namespace);
}
}
export default KubernetesNamespaceService;
angular.module('portainer.kubernetes').service('KubernetesNamespaceService', KubernetesNamespaceService);