Merge pull request #3 from rstudio/add-rbac

Add rbac

.github/workflows/chart-example-rbac.yaml

@@ -0,0 +1,36 @@
+name: Compute example rbac files
+
+on:
+  push:
+    paths:
+      - 'charts/rstudio-launcher-rbac/**'
+      - '.github/workflows/chart-example-rbac.yaml'
+
+jobs:
+  document:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: v3.6.3
+
+      - name: Compute and update dependent files
+        run: |
+          set -xe
+          cd ./charts/rstudio-launcher-rbac && helm dependency build && cd -
+          helm template -n rstudio rstudio-launcher-rbac ./charts/rstudio-launcher-rbac --set removeNamespaceReferences=true > examples/rbac/rstudio-launcher-rbac.yaml
+          CHART_VERSION=$(helm show chart ./charts/rstudio-launcher-rbac | grep '^version' | cut -d ' ' -f 2)
+          cp examples/rbac/rstudio-launcher-rbac.yaml examples/rbac/rstudio-launcher-rbac-${CHART_VERSION}.yaml
+
+      - name: Commit results
+        run: |
+          set -xeo pipefail
+          git config --local user.email "[email protected]"
+          git config --local user.name "GitHub Actions"
+          git add examples/rbac/rstudio-launcher-rbac*.yaml || echo "No files to add"
+          git commit examples/rbac/rstudio-launcher-rbac*.yaml -m 'Update rbac yaml' || echo "No changes to commit"
+          git push origin || echo "No changes to commit"

charts/rstudio-launcher-rbac/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/rstudio-launcher-rbac/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: rstudio-library
+  repository: file://../rstudio-library
+  version: 0.1.13-rc01
+digest: sha256:a730e6eebdb0313c93ffbeabfcee19e785fca64482daf794345d8a59d9a38c67
+generated: "2021-08-04T10:17:36.461759-04:00"

charts/rstudio-launcher-rbac/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: rstudio-launcher-rbac
+description: RBAC definition for the RStudio Job Launcher
+type: application
+version: 0.2.0
+appVersion: 0.2.0
+icon: https://rstudio.com/wp-content/uploads/2018/10/RStudio-Logo-Flat.png
+maintainers:
+  - name: sol-eng
+    email: [email protected]
+    url: https://github.com/sol-eng
+dependencies:
+  - name: rstudio-library
+    version: 0.1.13-rc01
+    repository: file://../rstudio-library

charts/rstudio-launcher-rbac/LICENSE.md

@@ -0,0 +1,21 @@
+# MIT License
+
+Copyright (c) 2021 RStudio PBC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

charts/rstudio-launcher-rbac/NEWS.md

@@ -0,0 +1,12 @@
+# 0.1.2
+
+- Specify namespace in ClusterRoleBinding always (it is required)
+    - This is unfortunate, because it makes our output YAML examples less portable
+
+# 0.1.1
+
+- Add `services.delete` permissions, which are required for proper launcher functioning
+
+# 0.1.0
+
+- Initial release

charts/rstudio-launcher-rbac/README.md

@@ -0,0 +1,45 @@
+# rstudio-launcher-rbac
+
+RBAC definition for the RStudio Job Launcher
+
+![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.0](https://img.shields.io/badge/AppVersion-0.2.0-informational?style=flat-square)
+
+## Disclaimer
+
+> This chart is "alpha" or "beta" quality at best. It is used primarily internally, is under-tested, and will undergo
+> breaking changes without warning as it moves towards stability.
+
+As a result, please:
+- Ensure you "pin" the version of the helm chart that you are using. You can do
+this using the `helm dependency` command and the associated "Chart.lock" files
+or the `--version` flag. IMPORTANT: This protects you from breaking changes
+- Before upgrading, to avoid breaking changes, use `helm diff upgrade` to check
+for breaking changes
+- Pay close attention to [`NEWS.md`](./NEWS.md) for updates on breaking
+changes, as well as documentation below on how to use the chart
+
+## Installing the Chart
+
+To install the chart with the release name `my-release` at version 0.2.0:
+
+```bash
+helm repo add rstudio-beta https://cdn.rstudio.com/sol-eng/helm/
+helm install my-release rstudio-beta/rstudio-launcher-rbac --version=0.2.0
+```
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| fullnameOverride | string | `""` | The override for the "FullName" which defaults to "ReleaseName-ChartName" or "ReleaseName" (if "ReleaseName" contains "ChartName") |
+| includeReleaseNamespace | bool | `true` | Whether the helm release namespace should be a possible launcher target |
+| nameOverride | string | `""` | The override for "ChartName" in the "FullName" which defaults to "ReleaseName-ChartName" or "ReleaseName" (if "ReleaseName" contains "ChartName") |
+| removeNamespaceReferences | bool | `false` | remove explicit namespace references (problematic if targetNamespaces is defined) |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| targetNamespaces | list | `[]` | The targetNamespaces that the launcher will be able to launch sessions into |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
+

charts/rstudio-launcher-rbac/README.md.gotmpl

@@ -0,0 +1,12 @@
+{{ template "chart.header" . }}
+{{ template "chart.description" . }}
+
+{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
+
+{{ template "rstudio.disclaimer" . }}
+
+{{ template "rstudio.install" . }}
+
+{{ template "chart.valuesSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}

charts/rstudio-launcher-rbac/ci/all-values.yaml

@@ -0,0 +1,13 @@
+targetNamespaces:
+  - default
+includeReleaseNamespace: false
+removeNamespaceReferences: false
+nameOverride: "override"
+fullnameOverride: "alloverriding"
+
+serviceAccount:
+  create: true
+  annotations:
+    one: two
+    three: four
+  name: "my-service-account"

charts/rstudio-launcher-rbac/ci/just-yaml-values.yaml

@@ -0,0 +1 @@
+removeNamespaceReferences: false

charts/rstudio-launcher-rbac/ci/no-release-ns-values.yaml

@@ -0,0 +1,3 @@
+includeReleaseNamespace: false
+targetNamespaces:
+  - default

charts/rstudio-launcher-rbac/ci/no-sa-values.yaml

@@ -0,0 +1,3 @@
+serviceAccount:
+  create: false
+  name: "default"

charts/rstudio-launcher-rbac/ci/simple-values.yaml

@@ -0,0 +1,3 @@
+serviceAccount:
+  create: true
+  name: "my-service-account"

charts/rstudio-launcher-rbac/templates/NOTES.txt

@@ -0,0 +1,5 @@
+{{ include "rstudio-launcher-rbac.fullname" . }} successfully deployed to namespace {{ $.Release.Namespace }}
+
+{{- if .Values.serviceAccount.create }}
+Created service account {{ include "rstudio-launcher-rbac.serviceAccountName" . }}
+{{- end }}

charts/rstudio-launcher-rbac/templates/_helpers.tpl

@@ -0,0 +1,59 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "rstudio-launcher-rbac.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "rstudio-launcher-rbac.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rstudio-launcher-rbac.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "rstudio-launcher-rbac.labels" -}}
+helm.sh/chart: {{ include "rstudio-launcher-rbac.chart" . }}
+{{ include "rstudio-launcher-rbac.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "rstudio-launcher-rbac.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "rstudio-launcher-rbac.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "rstudio-launcher-rbac.serviceAccountName" -}}
+{{- default (include "rstudio-launcher-rbac.fullname" .) .Values.serviceAccount.name }}
+{{- end }}

charts/rstudio-launcher-rbac/templates/rbac.yaml

@@ -0,0 +1,35 @@
+{{- $namespace := $.Release.Namespace }}
+{{- $allNamespaces := .Values.targetNamespaces}}
+{{- if .Values.includeReleaseNamespace }}
+  {{- $allNamespaces = append $allNamespaces $namespace}}
+{{- end }}
+{{- /* Error if targetNamespaces has length greater than 1 */}}
+{{- if (rest $allNamespaces ) }}
+  {{- fail (print "\n\nERROR: this chart currently does not support multiple namespaces. Got '" (print .Values.targetNamespaces) "'. \n\nKeep in mind that `.Values.includeReleaseNamespace` will affect this list." ) }}
+{{- end }}
+{{- /* Error if targetNamespaces is empty */}}
+{{- if not $allNamespaces }}
+  {{- fail (print "\n\nERROR: no namespace provided. You must provide a namespace in `.Values.targetNamespaces` or set `.Values.includeReleaseNamespace=true`") }}
+{{- end }}
+{{- $targetNamespace := (first $allNamespaces ) }}
+
+{{- $serviceAccountName := include "rstudio-launcher-rbac.serviceAccountName" . }}
+{{- $roleName := include "rstudio-launcher-rbac.fullname" . }}
+{{- $serviceAccountCreate := .Values.serviceAccount.create }}
+{{- $serviceAccountAnnotations := .Values.serviceAccount.annotations }}
+
+{{- $rbacValues := dict
+  "namespace"                 ($namespace)
+  "serviceAccountName"        ($serviceAccountName)
+  "targetNamespace"           ($targetNamespace)
+  "serviceAccountCreate"      ($serviceAccountCreate)
+  "serviceAccountAnnotations" ($serviceAccountAnnotations)
+  "removeNamespaceReferences" (.Values.removeNamespaceReferences)
+  "roleName"                  ($roleName)
+}}
+{{/*
+  For code-sharing, we use a shared library chart called "rstudio-library" to generate
+  rbac.yaml. You can either use `helm template` to see what is generated or look at the
+  "rstudio-library" chart source code (`_rbac.tpl`)
+*/}}
+{{- include "rstudio-library.rbac" $rbacValues }}

charts/rstudio-launcher-rbac/values.yaml

@@ -0,0 +1,22 @@
+# -- The targetNamespaces that the launcher will be able to launch sessions into
+targetNamespaces: []
+
+# -- Whether the helm release namespace should be a possible launcher target
+includeReleaseNamespace: true
+
+# -- remove explicit namespace references (problematic if targetNamespaces is defined)
+removeNamespaceReferences: false
+
+# -- The override for "ChartName" in the "FullName" which defaults to "ReleaseName-ChartName" or "ReleaseName" (if "ReleaseName" contains "ChartName")
+nameOverride: ""
+# -- The override for the "FullName" which defaults to "ReleaseName-ChartName" or "ReleaseName" (if "ReleaseName" contains "ChartName")
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set, a name is generated using the fullname template
+  name: ""

examples/rbac/README.md

@@ -0,0 +1,22 @@
+# RBAC yaml examples
+
+The RBAC associated with the RStudio Job Launcher is maintained in the
+[rstudio-launcher-rbac](../../charts/rstudio-launcher-rbac) helm chart.
+
+However, it is also maintained here in this directory for ease of use. In order
+to generate these files yourselves from the chart, you can use:
+```
+helm repo add rstudio https://helm.rstudio.com
+helm template -n rstudio rstudio-launcher-rbac rstudio/rstudio-launcher-rbac
+```
+
+## Important Note
+
+The rbac currently contains a `ClusterRoleBinding`, which requires a namespace
+reference.
+
+As a result, even though we use `--removeNamespaceReferences=true`, the
+namespace persists on the `ClusterRoleBiding`. We use the `rstudio` namespace
+by default.
+
+Please modify the namespace as needed for your installation.