Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

teams rewrite secret/env functionality #3799

Open
wants to merge 6 commits into
base: develop
Choose a base branch
from
Open

teams rewrite secret/env functionality #3799

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1bf17a2
teams rewrite secret/env functionality
kaelanspatel Dec 17, 2024
4b98aea
Add configmap mounting for RBAC teams
Sean-Holcomb Jan 7, 2025
71deaf4
Unify variables and redefine values structure
Sean-Holcomb Jan 8, 2025
10145e1
Merge pull request #3803 from kubecost/sth/ENG-3182/config-map
Sean-Holcomb Jan 8, 2025
f51b0e6
Update values file w/ new changes + an example team
kaelanspatel Jan 9, 2025
e85b0e6
Fix indent
kaelanspatel Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions cost-analyzer/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,15 @@ will result in failure. Users are asked to select one of the two presently-avail
{{- end -}}
{{- end -}}

{{/*
RBAC exclusivity check: make sure either RBAC or RBAC Teams is enabled, not both
*/}}
{{- define "rbacCheck" -}}
{{- if or (and ((.Values.saml).rbac).teamsEnabled ((.Values.saml).rbac).enabled) (and ((.Values.oidc).rbac).teamsEnabled ((.Values.oidc).rbac).enabled) -}}
{{- fail "\nSimple RBAC and RBAC Teams are mutually exclusive. Please specify only one." -}}
{{- end -}}
{{- end -}}

{{/*
Federated Storage source contents check. Either the Secret must be specified or the JSON, not both.
*/}}
Expand Down Expand Up @@ -1005,6 +1014,10 @@ Begin Kubecost 2.0 templates
{{- end }}
{{- end }}
{{- end }}
{{- if or .Values.oidc.rbac.teamsEnabled .Values.saml.rbac.teamsEnabled }}
- name: kubecost-rbac-secret
mountPath: /var/configs/kubecost-rbac-secret
{{- end }}
{{- if .Values.global.integrations.postgres.enabled }}
- name: postgres-creds
mountPath: /var/configs/integrations/postgres-creds
Expand Down Expand Up @@ -1153,6 +1166,10 @@ Begin Kubecost 2.0 templates
value: "true"
- name: OIDC_SKIP_ONLINE_VALIDATION
value: {{ (quote .Values.oidc.skipOnlineTokenValidation) | default (quote false) }}
{{- if .Values.oidc.rbac.teamsEnabled }}
- name: OIDC_RBAC_TEAMS_ENABLED
value: "true"
{{- end }}
{{- end}}
{{- if .Values.kubecostAggregator }}
{{- if .Values.kubecostAggregator.collections }}
Expand Down Expand Up @@ -1198,6 +1215,10 @@ Begin Kubecost 2.0 templates
- name: SAML_RBAC_ENABLED
value: "true"
{{- end }}
{{- if .Values.saml.rbac.teamsEnabled }}
- name: SAML_RBAC_TEAMS_ENABLED
value: "true"
{{- end }}
{{- if and .Values.saml.encryptionCertSecret .Values.saml.decryptionKeySecret }}
- name: SAML_RESPONSE_ENCRYPTED
value: "true"
Expand Down
10 changes: 10 additions & 0 deletions cost-analyzer/templates/aggregator-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,11 @@ spec:
configMap:
name: {{ template "cost-analyzer.fullname" . }}-saml
{{- end }}
{{- if .Values.saml.rbac.teamsEnabled }}
kaelanspatel marked this conversation as resolved.
Show resolved Hide resolved
- name: kubecost-rbac-secret
secret:
secretName: kubecost-rbac-secret
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.oidc }}
Expand All @@ -162,6 +167,11 @@ spec:
secret:
secretName: {{ .Values.oidc.existingCustomSecret.name }}
{{- end }}
{{- if .Values.oidc.rbac.teamsEnabled }}
- name: kubecost-rbac-secret
secret:
secretName: kubecost-rbac-secret
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.global.integrations.postgres.enabled }}
Expand Down
26 changes: 24 additions & 2 deletions cost-analyzer/templates/cost-analyzer-deployment-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,11 @@ spec:
configMap:
name: {{ template "cost-analyzer.fullname" . }}-saml
{{- end }}
{{- if .Values.saml.rbac.teamsEnabled }}
kaelanspatel marked this conversation as resolved.
Show resolved Hide resolved
- name: kubecost-rbac-secret
secret:
secretName: kubecost-rbac-secret
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.oidc }}
Expand All @@ -265,6 +270,11 @@ spec:
secret:
secretName: {{ .Values.oidc.existingCustomSecret.name }}
{{- end }}
{{- if .Values.oidc.rbac.teamsEnabled }}
- name: kubecost-rbac-secret
secret:
secretName: kubecost-rbac-secret
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.extraVolumes }}
Expand Down Expand Up @@ -689,6 +699,10 @@ spec:
{{- end }}
{{- end }}
{{- end }}
{{- if or .Values.oidc.rbac.teamsEnabled .Values.saml.rbac.teamsEnabled }}
- name: kubecost-rbac-secret
mountPath: /var/configs/kubecost-rbac-secret
{{- end }}
env:
- name: CONTAINER_IMAGE_TAG
value: {{ include "cost-model.imagetag" . }}
Expand Down Expand Up @@ -954,7 +968,7 @@ spec:
{{- else}}
- name: ADVANCED_NETWORK_STATS
value: "false"
{{- end}}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
Expand All @@ -963,7 +977,11 @@ spec:
value: "true"
- name: OIDC_SKIP_ONLINE_VALIDATION
value: {{ (quote .Values.oidc.skipOnlineTokenValidation) | default (quote false) }}
{{- end}}
{{- if .Values.oidc.rbac.teamsEnabled }}
- name: OIDC_RBAC_TEAMS_ENABLED
value: "true"
{{- end }}
{{- end }}
{{- if .Values.saml }}
{{- if .Values.saml.enabled }}
- name: SAML_ENABLED
Expand Down Expand Up @@ -1000,6 +1018,10 @@ spec:
- name: SAML_RESPONSE_ENCRYPTED
value: "true"
{{- end}}
{{- if .Values.saml.rbac.teamsEnabled }}
- name: SAML_RBAC_TEAMS_ENABLED
value: "true"
{{- end }}
{{- end }}
{{- end }}
{{- if and (.Values.prometheus.server.global.external_labels.cluster_id) (not .Values.prometheus.server.clusterIDConfigmap) }}
Expand Down
48 changes: 48 additions & 0 deletions cost-analyzer/templates/cost-analyzer-frontend-config-map-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -986,6 +986,54 @@ data:
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/teams {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/teams;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/team {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/team;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/roles {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/roles;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/role {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/role;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/currentTeams {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/currentTeams;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/rbac/currentPermissions {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/rbac/currentPermissions;
proxy_redirect off;
proxy_set_header Connection "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location = /model/debug/orchestrator {
proxy_read_timeout {{ .Values.kubecostFrontend.timeoutSeconds | default 300 }};
proxy_pass http://aggregator/debug/orchestrator;
Expand Down
22 changes: 22 additions & 0 deletions cost-analyzer/templates/kubecost-rbac-secret-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
{{- if or .Values.oidc.enabled .Values.saml.enabled }}
{{- if and (not .Values.oidc.rbac.enabled) (not .Values.saml.rbac.enabled) }}
{{- if or .Values.oidc.rbac.teamsEnabled .Values.saml.rbac.teamsEnabled }}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: kubecost-rbac-secret
namespace: {{ .Release.Namespace }}
labels:
{{- include "cost-analyzer.commonLabels" . | nindent 4 }}
stringData:
key:
{{- if .Values.oidc.enabled }}
{{ .Values.oidc.authSecret | default (randAlphaNum 32 | quote) }}
{{- end }}
{{- if .Values.saml.enabled }}
{{ .Values.saml.authSecret | default (randAlphaNum 32 | quote) }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
2 changes: 2 additions & 0 deletions cost-analyzer/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,6 +351,7 @@ saml:
# authSecretName: "" # Name of K8s secret where the authSecret will be stored. Defaults to "kubecost-saml-secret" if not provided.
rbac:
enabled: false
teamsEnabled: false
# groups:
# - name: admin
# enabled: false # If admin is disabled, all SAML users will be able to make configuration changes to the Kubecost frontend
Expand Down Expand Up @@ -387,6 +388,7 @@ oidc:
hostedDomain: "" # Optional, blocks access to the auth domain specified in the hd claim of the provider ID token
rbac:
enabled: false
teamsEnabled: false
# groups:
# - name: admin # Admins have permissions to edit Kubecost settings and save reports
# enabled: false
Expand Down
Loading