feat: expose rbacMode from moduleConfig #1347

cmwylie19 · 2024-10-29T15:31:26Z

Description

Allows user to define rbacMode in module config enabling building from infra-as-code practices

End to End Test: ❌ (Journey✅)

Changes in this PR include:

config docs
extend validateClusterRoleYaml to optionally validate helm yaml too
patches moduleConfig in package.json to test the feature in journey test
adds base case to journey/resources/values.yaml for assertion
removes cli rbacMode default value as this is does not allow user to set this in configuration
determineRbacMode function that compares CLI and config to determine rbacMode. CLI always has priority

Related Issue

Fixes #1327

Relates to #

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Checklist before merging

Unit, Journey, E2E Tests, docs, adr added or updated as needed
Contributor Guide Steps followed

Signed-off-by: Case Wylie <[email protected]>

codecov · 2024-10-29T15:32:35Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.43%. Comparing base (58633b8) to head (abeb3ee).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1347      +/-   ##
==========================================
+ Coverage   79.36%   79.43%   +0.06%     
==========================================
  Files          38       39       +1     
  Lines        1793     1799       +6     
  Branches      363      391      +28     
==========================================
+ Hits         1423     1429       +6     
+ Misses        368      341      -27     
- Partials        2       29      +27

Files with missing lines	Coverage Δ
src/lib/cli-helpers/build.ts	`100.00% <100.00%> (ø)`

... and 7 files with indirect coverage changes

Signed-off-by: Case Wylie <[email protected]>

journey/pepr-build.ts

Signed-off-by: Case Wylie <[email protected]>

btlghrants

Back to you!

btlghrants · 2024-10-30T14:35:54Z

docs/030_user-guide/120_customization.md

@@ -127,6 +127,7 @@ Below are the available configurations through `package.json`.
 |------------------|----------------------------------------|---------------------------------|
 | `uuid`           | Unique identifier for the module       | `hub-operator`                  |
 | `onError`        | Behavior of the webhook failure policy | `reject`, `ignore`              |
+| `rbacMode`       | Configures module to build binding RBAC with principal of least privilege | `scoped`, `admin` |


I'd suggest this move down in the table to live right next to the rbac key. It feels kind of lonely all by itself up here.

It'd also be useful if the description for this mentioned (however you like) that rbacMode: scoped would pull in the rbac block of config... or maybe the reverse (the rbac description including that it's only invoked when rbackMode: scoped is set)... or maybe both!

Doesn't scoped mode do more than just pull in the rbac block of config?

Okay, im moving it down.

To try and tie in your comments, scoped only builds the cluster role with the principal of least priv and is decoupled whether there is an rbac block or not.

RBAC block however does nothing unless you are in scoped mode. I think i addressed this in the update that I am about to push. LMK

btlghrants · 2024-10-30T14:44:40Z

journey/pepr-build-wasm.ts

What is the relationship between rbacMode and pepr-build-wasm.ts..? I would have never thought to look for our RBAC mode tests in a -wasm file. 🤔 Are they bound together in some way?

Can't (apparently) comment on lines of code that weren't changed, but... just saw that line 15 says "dst folder" -- should probably say something like "/dist folder" instead (since that's what'll actually be there).

For some reason the rbac tests were in the -wasm file when I started working on the rbac mode stuff. I have no idea why they were put there.

line 15 only makes a folder. This probably should be live in an it() block. I will move this below the where the module is being built.

rbacMode is being set through the CLI in pepr-build.ts, we need a module to build so this is the other option.

btlghrants · 2024-10-30T14:53:34Z

journey/pepr-build-wasm.ts

-    execSync(`npx pepr build -r gchr.io/defenseunicorns --rbac-mode scoped -o ${outputDir}`, {
+  it("should successfully build the Pepr project with arguments and rbacMode scoped", async () => {
+    // Set rbacMode in the Pepr Module Config of the package.json.
+    await addScopedRbacMode();


I'm sort of ambivalent about this await addScopedRbacMode(); line living here -- it's changes the state of the entire Pepr module (in that it changes the source of what get's built / asserted on) and yet it's kind of hidden down here inside just-another-test-case.

Doesn't seem like it's hurting anything right now -- at least not as the tests are currently laid out -- but would suggest moving any global state change stuff like this up into a beforeAll() block (or something) to both 1) call more attention to it, and 2) future-proof the test file against the case that more assertions get added and/or someone tries to "reorder" the it() blocks.

btlghrants · 2024-10-30T15:13:49Z

src/lib/helpers.ts

@@ -394,3 +394,19 @@ export function replaceString(str: string, stringA: string, stringB: string) {
  const regExp = new RegExp(escapedStringA, "g");
  return str.replace(regExp, stringB);
 }
+
+// determineRbacMode determines the RBAC mode to use based on the cli and the module's config
+export function determineRbacMode(opts: { rbacMode?: string }, cfg: { pepr: { rbacMode?: string } }): string {


This doesn't seem like a function that's generalized enough to need to live in a helpers collection. It also only appears to be used in one place (the build.ts file).

Would there be anything stopping you from moving this helper back into build.ts and just using it directly? Much more cohesive over there & would help prevent the helpers.ts file from becoming a junk drawer for single-use funcs.

It first lived there but I realized that we cannot unit test it there. Would the unit test still live in helpers?

After ruminating on this issue, considering many alternatives I came to the conclusion to create a folder cli-helpers/build.ts.

Adding a coverageIgnorePath in the jest config had adverse affects. Babel warnings occurred in the console and the coverage dropped by ~15%, more strictly defined paths would have been necessary as well as an adjustment of other configs to suppress the babel warning or increase a threshold.

[BABEL] Note: The code generator has deoptimised the styling of /Users/cmwylie19/not-pepr/pepr/node_modules/@kubernetes/client-node/dist/gen/types/ObjectParamAPI.js as it exceeds the max of 500KB. [BABEL] Note: The code generator has deoptimised the styling of /Users/cmwylie19/not-pepr/pepr/node_modules/@kubernetes/client-node/dist/gen/types/ObservableAPI.js as it exceeds the max of 500KB. [BABEL] Note: The code generator has deoptimised the styling of /Users/cmwylie19/not-pepr/pepr/node_modules/@kubernetes/client-node/dist/gen/apis/AppsV1Api.js as it exceeds the max of 500KB.

Separate jest configs caused validation warnings

● Validation Warning: Unknown option "collectCoverage" with value true was found. This is probably a typing mistake. Fixing it will remove this message. Configuration Documentation: https://jestjs.io/docs/configuration

We would have needed to run jest from node through node_modules and add an --experimental-vm-modules from our test.

This approach seems to satisfy the requirement and and provide us room to grow in the future.

Signed-off-by: Case Wylie <[email protected]>

jest.config.json

Signed-off-by: Case Wylie <[email protected]>

cmwylie19 added 2 commits October 28, 2024 18:33

wip

10dad51

Signed-off-by: Case Wylie <[email protected]>

chore: rbacMode from moduleConfig

43b22e3

Signed-off-by: Case Wylie <[email protected]>

cmwylie19 requested a review from a team as a code owner October 29, 2024 15:31

Merge branch 'main' into 1327

66f7348

cmwylie19 added 4 commits October 29, 2024 11:50

update signature

23ad524

Signed-off-by: Case Wylie <[email protected]>

chore: push all code

37dba68

Signed-off-by: Case Wylie <[email protected]>

chore: testing ci

dfee133

Signed-off-by: Case Wylie <[email protected]>

chore: separate files

767c876

Signed-off-by: Case Wylie <[email protected]>

cmwylie19 commented Oct 29, 2024

View reviewed changes

journey/pepr-build.ts Outdated Show resolved Hide resolved

cmwylie19 and others added 4 commits October 29, 2024 13:21

Update journey/pepr-build.ts

25de45d

chore: separate files

5fe4605

Signed-off-by: Case Wylie <[email protected]>

chore: fix journey test

c23f54b

Signed-off-by: Case Wylie <[email protected]>

Merge branch 'main' into 1327

902c10d

btlghrants requested changes Oct 30, 2024

View reviewed changes

chore: address pr comments

8e1a81e

Signed-off-by: Case Wylie <[email protected]>

cmwylie19 commented Oct 30, 2024

View reviewed changes

jest.config.json Outdated Show resolved Hide resolved

Update jest.config.json

3f083ab

cmwylie19 requested a review from btlghrants October 30, 2024 17:50

chore: find working dir for test

abeb3ee

Signed-off-by: Case Wylie <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: expose rbacMode from moduleConfig #1347

feat: expose rbacMode from moduleConfig #1347

cmwylie19 commented Oct 29, 2024 •

edited

Loading

codecov bot commented Oct 29, 2024 •

edited

Loading

btlghrants left a comment

btlghrants Oct 30, 2024

schaeferka Oct 30, 2024

cmwylie19 Oct 30, 2024

btlghrants Oct 30, 2024

btlghrants Oct 30, 2024

schaeferka Oct 30, 2024

cmwylie19 Oct 30, 2024

btlghrants Oct 30, 2024

btlghrants Oct 30, 2024

cmwylie19 Oct 30, 2024

cmwylie19 Oct 30, 2024

feat: expose rbacMode from moduleConfig #1347

Are you sure you want to change the base?

feat: expose rbacMode from moduleConfig #1347

Conversation

cmwylie19 commented Oct 29, 2024 • edited Loading

Description

Related Issue

Type of change

Checklist before merging

codecov bot commented Oct 29, 2024 • edited Loading

Codecov Report

btlghrants left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmwylie19 commented Oct 29, 2024 •

edited

Loading

codecov bot commented Oct 29, 2024 •

edited

Loading