Rbac generate

pkg/agent/config.go

@@ -30,7 +30,7 @@ type Config struct {
 	OrganizationID string `yaml:"organization_id"`
 	// ClusterID is the cluster that the agent is scanning.
 	ClusterID     string         `yaml:"cluster_id"`
-	DataGatherers []dataGatherer `yaml:"data-gatherers"`
+	DataGatherers []DataGatherer `yaml:"data-gatherers"`
 	// InputPath replaces DataGatherers with input data file
 	InputPath string `yaml:"input-path"`
 	// OutputPath replaces Server with output data file
@@ -43,7 +43,7 @@ type Endpoint struct {
 	Path     string `yaml:"path"`
 }
 
-type dataGatherer struct {
+type DataGatherer struct {
 	Kind     string
 	Name     string
 	DataPath string
@@ -65,7 +65,7 @@ func reMarshal(rawConfig interface{}, config datagatherer.Config) error {
 }
 
 // UnmarshalYAML unmarshals a dataGatherer resolving the type according to Kind.
-func (dg *dataGatherer) UnmarshalYAML(unmarshal func(interface{}) error) error {
+func (dg *DataGatherer) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	aux := struct {
 		Kind      string      `yaml:"kind"`
 		Name      string      `yaml:"name"`

pkg/agent/config_test.go

@@ -35,7 +35,7 @@ func TestValidConfigLoad(t *testing.T) {
 		Period:         time.Hour,
 		OrganizationID: "example",
 		ClusterID:      "example-cluster",
-		DataGatherers: []dataGatherer{
+		DataGatherers: []DataGatherer{
 			{
 				Name: "d1",
 				Kind: "dummy",
@@ -82,8 +82,8 @@ func TestValidConfigWithEndpointLoad(t *testing.T) {
 		Schedule:       "* * * * *",
 		OrganizationID: "example",
 		ClusterID:      "example-cluster",
-		DataGatherers: []dataGatherer{
-			dataGatherer{
+		DataGatherers: []DataGatherer{
+			{
 				Name: "d1",
 				Kind: "dummy",
 				Config: &dummyConfig{
@@ -103,7 +103,7 @@ func TestInvalidConfigError(t *testing.T) {
 
 	_, parseError := ParseConfig([]byte(configFileContents))
 
-	expectedError := fmt.Errorf("yaml: unmarshal errors:\n  line 1: cannot unmarshal !!str `things` into []agent.dataGatherer")
+	expectedError := fmt.Errorf("yaml: unmarshal errors:\n  line 1: cannot unmarshal !!str `things` into []agent.DataGatherer")
 
 	if parseError.Error() != expectedError.Error() {
 		t.Fatalf("got != want;\ngot=%s,\nwant=%s", parseError, expectedError)

pkg/permissions/generate.go

@@ -0,0 +1,39 @@
+package permissions
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/jetstack/preflight/pkg/agent"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8s"
+)
+
+func Generate(dataGatherers []agent.DataGatherer) string {
+	var accumulator string = ""
+
+	for _, g := range dataGatherers {
+		if g.Kind != "k8s-dynamic" {
+			continue
+		}
+
+		genericConfig := g.Config
+		dyConfig := genericConfig.(*k8s.ConfigDynamic)
+
+		metaName := fmt.Sprint(dyConfig.GroupVersionResource.Resource)
+
+		accumulator = fmt.Sprintf(`%s
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: jetstack-secure-agent-%s-reader
+rules:
+- apiGroups: ["%s"]
+  resources: ["%s"]
+  verbs: ["get", "list", "watch"]
+---`, accumulator, metaName, dyConfig.GroupVersionResource.Group, dyConfig.GroupVersionResource.Resource)
+	}
+
+	s := strings.TrimPrefix(accumulator, "\n")
+	ss := strings.TrimSuffix(s, "---")
+	return strings.TrimSuffix(ss, "\n")
+}

pkg/permissions/generate_test.go

@@ -0,0 +1,57 @@
+package permissions
+
+import (
+	"testing"
+
+	"github.com/jetstack/preflight/pkg/agent"
+	"github.com/jetstack/preflight/pkg/datagatherer/k8s"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestGenerate(t *testing.T) {
+	inputDatagatherers := []agent.DataGatherer{
+		{
+			Name: "k8s/pods",
+			Kind: "k8s-dynamic",
+			Config: &k8s.ConfigDynamic{
+				GroupVersionResource: schema.GroupVersionResource{
+					Version:  "v1",
+					Resource: "pods",
+				},
+			},
+		},
+		{
+			Name: "k8s/secrets",
+			Kind: "k8s-dynamic",
+			Config: &k8s.ConfigDynamic{
+				GroupVersionResource: schema.GroupVersionResource{
+					Version:  "v1",
+					Resource: "secrets",
+				},
+			},
+		},
+	}
+
+	expectedOutput := `apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: jetstack-secure-agent-pods-reader
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: jetstack-secure-agent-secrets-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]`
+
+	if output := Generate(inputDatagatherers); output != expectedOutput {
+		t.Fatalf("unexpected output \n%s \n expected: \n%s", output, expectedOutput)
+	}
+
+}