diff --git a/changelogs/unreleased/add-role-binding-to-kubeclient.yml b/changelogs/unreleased/add-role-binding-to-kubeclient.yml new file mode 100644 index 0000000000000000000000000000000000000000..bc343116eb4f0c0f7aefbbcf63f35b18f3bfce00 --- /dev/null +++ b/changelogs/unreleased/add-role-binding-to-kubeclient.yml @@ -0,0 +1,5 @@ +--- +title: Allow kubeclient to call RoleBinding methods +merge_request: 22524 +author: +type: other diff --git a/lib/gitlab/kubernetes/kube_client.rb b/lib/gitlab/kubernetes/kube_client.rb index 588238de6080ce26961acb5df4c2d7fc7dc323b7..e88a15b8acdf83aa4e46ebf2aaecfa2f48a12250 100644 --- a/lib/gitlab/kubernetes/kube_client.rb +++ b/lib/gitlab/kubernetes/kube_client.rb @@ -45,6 +45,13 @@ module Gitlab :update_cluster_role_binding, to: :rbac_client + # RBAC methods delegates to the apis/rbac.authorization.k8s.io api + # group client + delegate :create_role_binding, + :get_role_binding, + :update_role_binding, + to: :rbac_client + # Deployments resource is currently on the apis/extensions api group delegate :get_deployments, to: :extensions_client diff --git a/lib/gitlab/kubernetes/role_binding.rb b/lib/gitlab/kubernetes/role_binding.rb new file mode 100644 index 0000000000000000000000000000000000000000..4f3ee040bf284f2fdafd2aca91fce7ba6f10b0b2 --- /dev/null +++ b/lib/gitlab/kubernetes/role_binding.rb @@ -0,0 +1,47 @@ +# frozen_string_literal: true + +module Gitlab + module Kubernetes + class RoleBinding + attr_reader :role_name, :namespace, :service_account_name + + def initialize(role_name:, namespace:, service_account_name:) + @role_name = role_name + @namespace = namespace + @service_account_name = service_account_name + end + + def generate + ::Kubeclient::Resource.new.tap do |resource| + resource.metadata = metadata + resource.roleRef = role_ref + resource.subjects = subjects + end + end + + private + + def metadata + { name: "gitlab-#{namespace}", namespace: namespace } + end + + def role_ref + { + apiGroup: 'rbac.authorization.k8s.io', + kind: 'Role', + name: role_name + } + end + + def subjects + [ + { + kind: 'ServiceAccount', + name: service_account_name, + namespace: namespace + } + ] + end + end + end +end diff --git a/spec/lib/gitlab/kubernetes/role_binding_spec.rb b/spec/lib/gitlab/kubernetes/role_binding_spec.rb new file mode 100644 index 0000000000000000000000000000000000000000..da3f5d27b25ed0c802efca44397b09ff3abd5c76 --- /dev/null +++ b/spec/lib/gitlab/kubernetes/role_binding_spec.rb @@ -0,0 +1,47 @@ +# frozen_string_literal: true + +require 'spec_helper' + +describe Gitlab::Kubernetes::RoleBinding, '#generate' do + let(:role_name) { 'edit' } + let(:namespace) { 'my-namespace' } + let(:service_account_name) { 'my-service-account' } + + let(:subjects) do + [ + { + kind: 'ServiceAccount', + name: service_account_name, + namespace: namespace + } + ] + end + + let(:role_ref) do + { + apiGroup: 'rbac.authorization.k8s.io', + kind: 'Role', + name: role_name + } + end + + let(:resource) do + ::Kubeclient::Resource.new( + metadata: { name: "gitlab-#{namespace}", namespace: namespace }, + roleRef: role_ref, + subjects: subjects + ) + end + + subject do + described_class.new( + role_name: role_name, + namespace: namespace, + service_account_name: service_account_name + ).generate + end + + it 'should build a Kubeclient Resource' do + is_expected.to eq(resource) + end +end