Skip to content

Commit 8ad689a

Browse files
ahmadhamzhahmadhamzh
committed
update policy binding endpoints
1 parent 7300136 commit 8ad689a

33 files changed

Lines changed: 3501 additions & 374 deletions

‎modules/api/cmd/kubermatic-api/main.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -415,6 +415,8 @@ func createInitProviders(ctx context.Context, options serverRunOptions, masterCf
415415
backupStorageProvider := backupStorageProviderFactory(defaultImpersonationClient.CreateImpersonatedClient, client)
416416

417417
policyTemplateProvider := policyTemplateProviderFactory(defaultImpersonationClient.CreateImpersonatedClient, client)
418+
419+
policyBindingProvider := policyBindingProviderFactory(defaultImpersonationClient.CreateImpersonatedClient, client)
418420
return providers{
419421
sshKey: sshKeyProvider,
420422
privilegedSSHKeyProvider: privilegedSSHKeyProvider,
@@ -459,6 +461,7 @@ func createInitProviders(ctx context.Context, options serverRunOptions, masterCf
459461
etcdRestoreProjectProviderGetter: etcdRestoreProjectProviderGetter,
460462
backupStorageProvider: backupStorageProvider,
461463
policyTemplateProvider: policyTemplateProvider,
464+
policyBindingProvider: policyBindingProvider,
462465
backupCredentialsProviderGetter: backupCredentialsProviderGetter,
463466
privilegedMLAAdminSettingProviderGetter: privilegedMLAAdminSettingProviderGetter,
464467
seedProvider: seedProvider,
@@ -584,6 +587,7 @@ func createAPIHandler(
584587
EtcdRestoreProjectProviderGetter: prov.etcdRestoreProjectProviderGetter,
585588
BackupStorageProvider: prov.backupStorageProvider,
586589
PolicyTemplateProvider: prov.policyTemplateProvider,
590+
PolicyBindingProvider: prov.policyBindingProvider,
587591
BackupCredentialsProviderGetter: prov.backupCredentialsProviderGetter,
588592
PrivilegedMLAAdminSettingProviderGetter: prov.privilegedMLAAdminSettingProviderGetter,
589593
SeedProvider: prov.seedProvider,

‎modules/api/cmd/kubermatic-api/options.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ type providers struct {
214214
privilegedOperatingSystemProfileProviderGetter provider.PrivilegedOperatingSystemProfileProviderGetter
215215
oidcIssuerVerifierProviderGetter provider.OIDCIssuerVerifierGetter
216216
policyTemplateProvider provider.PolicyTemplateProvider
217+
policyBindingProvider provider.PolicyBindingProvider
217218
}
218219

219220
func loadKubermaticConfiguration(filename string) (*kubermaticv1.KubermaticConfiguration, error) {

‎modules/api/cmd/kubermatic-api/swagger.json‎

Lines changed: 214 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7215,9 +7215,207 @@
72157215
}
72167216
}
72177217
},
7218+
"/api/v2/policybinding": {
7219+
"get": {
7220+
"description": "List all policy bindings. Only available in Kubermatic Enterprise Edition",
7221+
"produces": [
7222+
"application/json"
7223+
],
7224+
"tags": [
7225+
"admin"
7226+
],
7227+
"operationId": "listPolicyBinding",
7228+
"responses": {
7229+
"200": {
7230+
"description": "PolicyBinding",
7231+
"schema": {
7232+
"type": "array",
7233+
"items": {
7234+
"$ref": "#/definitions/PolicyBinding"
7235+
}
7236+
}
7237+
},
7238+
"401": {
7239+
"$ref": "#/responses/empty"
7240+
},
7241+
"403": {
7242+
"$ref": "#/responses/empty"
7243+
},
7244+
"default": {
7245+
"description": "errorResponse",
7246+
"schema": {
7247+
"$ref": "#/definitions/errorResponse"
7248+
}
7249+
}
7250+
}
7251+
},
7252+
"post": {
7253+
"description": "Create policy binding. Only available in Kubermatic Enterprise Edition",
7254+
"consumes": [
7255+
"application/json"
7256+
],
7257+
"produces": [
7258+
"application/json"
7259+
],
7260+
"tags": [
7261+
"admin"
7262+
],
7263+
"operationId": "createPolicyBinding",
7264+
"parameters": [
7265+
{
7266+
"type": "string",
7267+
"x-go-name": "Name",
7268+
"name": "name",
7269+
"in": "query"
7270+
}
7271+
],
7272+
"responses": {
7273+
"200": {
7274+
"description": "PolicyBinding",
7275+
"schema": {
7276+
"$ref": "#/definitions/PolicyBinding"
7277+
}
7278+
},
7279+
"401": {
7280+
"$ref": "#/responses/empty"
7281+
},
7282+
"403": {
7283+
"$ref": "#/responses/empty"
7284+
},
7285+
"default": {
7286+
"description": "errorResponse",
7287+
"schema": {
7288+
"$ref": "#/definitions/errorResponse"
7289+
}
7290+
}
7291+
}
7292+
}
7293+
},
7294+
"/api/v2/policybinding/{binding_name}": {
7295+
"get": {
7296+
"description": "Get policy binding. Only available in Kubermatic Enterprise Edition",
7297+
"produces": [
7298+
"application/json"
7299+
],
7300+
"tags": [
7301+
"admin"
7302+
],
7303+
"operationId": "getPolicyBinding",
7304+
"parameters": [
7305+
{
7306+
"type": "string",
7307+
"x-go-name": "PolicyBindingName",
7308+
"name": "binding_name",
7309+
"in": "path",
7310+
"required": true
7311+
}
7312+
],
7313+
"responses": {
7314+
"200": {
7315+
"description": "PolicyBinding",
7316+
"schema": {
7317+
"$ref": "#/definitions/PolicyBinding"
7318+
}
7319+
},
7320+
"401": {
7321+
"$ref": "#/responses/empty"
7322+
},
7323+
"403": {
7324+
"$ref": "#/responses/empty"
7325+
},
7326+
"default": {
7327+
"description": "errorResponse",
7328+
"schema": {
7329+
"$ref": "#/definitions/errorResponse"
7330+
}
7331+
}
7332+
}
7333+
},
7334+
"delete": {
7335+
"description": "Delete policy binding. Only available in Kubermatic Enterprise Edition",
7336+
"tags": [
7337+
"admin"
7338+
],
7339+
"operationId": "deletePolicyBinding",
7340+
"parameters": [
7341+
{
7342+
"type": "string",
7343+
"x-go-name": "PolicyBindingName",
7344+
"name": "binding_name",
7345+
"in": "path",
7346+
"required": true
7347+
}
7348+
],
7349+
"responses": {
7350+
"200": {
7351+
"$ref": "#/responses/empty"
7352+
},
7353+
"401": {
7354+
"$ref": "#/responses/empty"
7355+
},
7356+
"403": {
7357+
"$ref": "#/responses/empty"
7358+
},
7359+
"default": {
7360+
"description": "errorResponse",
7361+
"schema": {
7362+
"$ref": "#/definitions/errorResponse"
7363+
}
7364+
}
7365+
}
7366+
},
7367+
"patch": {
7368+
"description": "Patch policy binding. Only available in Kubermatic Enterprise Edition",
7369+
"consumes": [
7370+
"application/json"
7371+
],
7372+
"produces": [
7373+
"application/json"
7374+
],
7375+
"tags": [
7376+
"admin"
7377+
],
7378+
"operationId": "patchPolicyBinding",
7379+
"parameters": [
7380+
{
7381+
"type": "string",
7382+
"x-go-name": "Name",
7383+
"name": "name",
7384+
"in": "query"
7385+
},
7386+
{
7387+
"type": "string",
7388+
"x-go-name": "PolicyBindingName",
7389+
"name": "binding_name",
7390+
"in": "path",
7391+
"required": true
7392+
}
7393+
],
7394+
"responses": {
7395+
"200": {
7396+
"description": "PolicyBinding",
7397+
"schema": {
7398+
"$ref": "#/definitions/PolicyBinding"
7399+
}
7400+
},
7401+
"401": {
7402+
"$ref": "#/responses/empty"
7403+
},
7404+
"403": {
7405+
"$ref": "#/responses/empty"
7406+
},
7407+
"default": {
7408+
"description": "errorResponse",
7409+
"schema": {
7410+
"$ref": "#/definitions/errorResponse"
7411+
}
7412+
}
7413+
}
7414+
}
7415+
},
72187416
"/api/v2/policytemplate": {
72197417
"get": {
7220-
"description": "List all Policy Templates. Only available in Kubermatic Enterprise Edition",
7418+
"description": "List all policy templates. Only available in Kubermatic Enterprise Edition",
72217419
"produces": [
72227420
"application/json"
72237421
],
@@ -7250,7 +7448,7 @@
72507448
}
72517449
},
72527450
"post": {
7253-
"description": "Create Policy Template. Only available in Kubermatic Enterprise Edition",
7451+
"description": "Create policy template. Only available in Kubermatic Enterprise Edition",
72547452
"consumes": [
72557453
"application/json"
72567454
],
@@ -7293,7 +7491,7 @@
72937491
},
72947492
"/api/v2/policytemplate/{template_name}": {
72957493
"get": {
7296-
"description": "Get Policy Template. Only available in Kubermatic Enterprise Edition",
7494+
"description": "Get policy template. Only available in Kubermatic Enterprise Edition",
72977495
"produces": [
72987496
"application/json"
72997497
],
@@ -7332,7 +7530,7 @@
73327530
}
73337531
},
73347532
"delete": {
7335-
"description": "Delete Policy Template. Only available in Kubermatic Enterprise Edition",
7533+
"description": "Delete policy template. Only available in Kubermatic Enterprise Edition",
73367534
"produces": [
73377535
"application/json"
73387536
],
@@ -7368,7 +7566,7 @@
73687566
}
73697567
},
73707568
"patch": {
7371-
"description": "Patch Policy Template. Only available in Kubermatic Enterprise Edition",
7569+
"description": "Patch policy template. Only available in Kubermatic Enterprise Edition",
73727570
"consumes": [
73737571
"application/json"
73747572
],
@@ -37779,6 +37977,17 @@
3777937977
},
3778037978
"x-go-package": "k8s.io/api/core/v1"
3778137979
},
37980+
"PolicyBinding": {
37981+
"description": "PolicyBinding binds a PolicyTemplate to specific clusters/projects and\noptionally enables or disables it (if the template is not enforced).",
37982+
"type": "object",
37983+
"properties": {
37984+
"name": {
37985+
"type": "string",
37986+
"x-go-name": "Name"
37987+
}
37988+
},
37989+
"x-go-package": "k8c.io/dashboard/v2/pkg/api/v2"
37990+
},
3778237991
"PolicyRule": {
3778337992
"description": "PolicyRule holds information that describes a policy rule, but does not contain information\nabout who the rule applies to or which namespace the rule applies to.",
3778437993
"type": "object",

‎modules/api/cmd/kubermatic-api/wrappers_ce.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,7 @@ func backupStorageProviderFactory(_ kubernetes.ImpersonationClient, _ ctrlruntim
5555
func policyTemplateProviderFactory(_ kubernetes.ImpersonationClient, _ ctrlruntimeclient.Client) provider.PolicyTemplateProvider {
5656
return nil
5757
}
58+
59+
func policyBindingProviderFactory(_ kubernetes.ImpersonationClient, _ ctrlruntimeclient.Client) provider.PolicyBindingProvider {
60+
return nil
61+
}

‎modules/api/cmd/kubermatic-api/wrappers_ee.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,7 @@ func backupStorageProviderFactory(createMasterImpersonatedClient kubernetes.Impe
5656
func policyTemplateProviderFactory(createMasterImpersonatedClient kubernetes.ImpersonationClient, privilegedClient ctrlruntimeclient.Client) provider.PolicyTemplateProvider {
5757
return eeapi.PolicyTemplateProviderFactory(createMasterImpersonatedClient, privilegedClient)
5858
}
59+
60+
func policyBindingProviderFactory(createMasterImpersonatedClient kubernetes.ImpersonationClient, privilegedClient ctrlruntimeclient.Client) provider.PolicyBindingProvider {
61+
return eeapi.PolicyBindingProviderFactory(createMasterImpersonatedClient, privilegedClient)
62+
}

‎modules/api/pkg/api/v2/types.go‎

Lines changed: 9 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2300,31 +2300,13 @@ type PolicyTemplate struct {
23002300
Spec kubermaticv1.PolicyTemplateSpec `json:"spec,omitempty"`
23012301
}
23022302

2303-
// PolicyInstanceSpec describes how and where to apply the referenced PolicyTemplate.
2304-
type PolicyInstance struct {
2305-
Name string `json:"name,omitempty"`
2306-
Spec PolicyInstanceSpec `json:"spec,omitempty"`
2307-
}
2308-
2309-
// PolicyInstanceSpec describes how and where to apply the referenced PolicyTemplate.
2310-
type PolicyInstanceSpec struct {
2311-
// PolicyTemplateName is the name of the policy template.
2312-
PolicyTemplateName string `json:"policyTemplateName"`
2313-
// Scope specifies the Kyverno Policy to be created.
2314-
// The scope can be "cluster" or "namespaced", by default it is "cluster"
2315-
Scope string `json:"scope,omitempty"`
2316-
// Target specifies which clusters/projects to apply the policy to
2317-
Target PolicyTargetSpec `json:"target,omitempty"`
2318-
}
2319-
2320-
// PolicyTargetSpec indicates how to select projects/clusters in Kubermatic.
2321-
type PolicyTargetSpec struct {
2322-
// AllProjects indicates that the policy applies to all projects
2323-
AllProjects bool `json:"allProjects,omitempty"`
2324-
// ProjectSelector restricts the policy to projects matching these labels
2325-
ProjectSelector *metav1.LabelSelector `json:"projectSelector,omitempty"`
2326-
// AllClusters indicates that the policy applies to all clusters
2327-
AllClusters bool `json:"allClusters,omitempty"`
2328-
// ClusterSelector restricts the policy to clusters matching these labels
2329-
ClusterSelector *metav1.LabelSelector `json:"clusterSelector,omitempty"`
2303+
// PolicyBinding binds a PolicyTemplate to specific clusters/projects and
2304+
// optionally enables or disables it (if the template is not enforced).
2305+
// swagger:model PolicyBinding
2306+
type PolicyBinding struct {
2307+
Name string `json:"name,omitempty"`
2308+
// swagger:ignore
2309+
Spec kubermaticv1.PolicyBindingSpec `json:"spec,omitempty"`
2310+
// swagger:ignore
2311+
Status kubermaticv1.PolicyBindingStatus `json:"status,omitempty"`
23302312
}

‎modules/api/pkg/ee/cmd/kubermatic-api/wrappers.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929

3030
backupstorage "k8c.io/dashboard/v2/pkg/ee/clusterbackup/storage-location"
3131
groupprojectbinding "k8c.io/dashboard/v2/pkg/ee/group-project-binding/provider"
32+
policybinding "k8c.io/dashboard/v2/pkg/ee/kyverno/policy-binding"
3233
policytemplate "k8c.io/dashboard/v2/pkg/ee/kyverno/policy-template"
3334
eeprovider "k8c.io/dashboard/v2/pkg/ee/provider"
3435
resourcequotas "k8c.io/dashboard/v2/pkg/ee/resource-quota"
@@ -61,3 +62,7 @@ func BackupStorageProviderFactory(createMasterImpersonatedClient kubernetes.Impe
6162
func PolicyTemplateProviderFactory(createMasterImpersonatedClient kubernetes.ImpersonationClient, privilegedClient ctrlruntimeclient.Client) provider.PolicyTemplateProvider {
6263
return policytemplate.NewPolicyTemplateProvider(createMasterImpersonatedClient, privilegedClient)
6364
}
65+
66+
func PolicyBindingProviderFactory(createMasterImpersonatedClient kubernetes.ImpersonationClient, privilegedClient ctrlruntimeclient.Client) provider.PolicyBindingProvider {
67+
return policybinding.NewPolicyBindingProvider(createMasterImpersonatedClient, privilegedClient)
68+
}

0 commit comments

Comments
 (0)