mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-07-09 16:00:59 +00:00
052e344e1b
Closes the only API-coverage gap from the Docker / Kubernetes IA maturity review: Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings now flow from the Kubernetes agent through the canonical resource registry into the Kubernetes platform-page Configuration tab. Agent: pkg/agents/kubernetes/report.go gains four new report struct types that carry summary counts plus subject-kind sets; individual subject names and full PolicyRule contents are deliberately omitted so Pulse stays a "what permissions exist where" surface, not an RBAC enumeration tool. internal/kubernetesagent/agent.go gains four collectors that call rbacv1.RoleList/ClusterRoleList/etc. through the existing runKubernetesCallWithRetry wrapper, matching the ServiceAccount collector's RBAC-forbidden retry pattern. Canonical: internal/models mirrors with NormalizeCollections coverage; convert* funcs in internal/monitoring/kubernetes_agents.go translate agent report -> model; ResourceTypeK8sRole / K8sClusterRole / K8sRoleBinding / K8sClusterRoleBinding join the canonical type set; registry ingest* + adapter resourceFrom* functions emit one Resource per RBAC object with ruleCount / roleKind / roleName / subjectCount / subjectKinds / aggregationLabels on the K8s meta; search mapping in internal/api/resources.go and the privacy allow-list in internal/api/org_handlers.go pick up the four new type tokens; the K8s privacy category in unifiedresources/policy_metadata.go classifies them like the rest of K8s. Frontend: ResourceType union + ResourceKubernetesMeta carry the new kinds and RBAC summary fields; KubernetesPageSurface query asks for them; the page model buckets them into the Configuration group; KubernetesConfigTable renders Role / ClusterRole rule counts and the aggregated flag, plus RoleBinding / ClusterRoleBinding role refs and "N subjects · Kind1, Kind2 +overflow" subject summaries. Curated demo seeds per-namespace Roles + RoleBindings plus an aggregated ClusterRole + ClusterRoleBinding for pulse-demo-monitoring in each cluster so the Configuration tab renders 18 RBAC rows across the three demo clusters. Contracts updated for the canonical-shape guard: monitoring, api-contracts, unified-resources, frontend-primitives, organization-settings (canonical) plus agent-lifecycle and storage-recovery (dependent via Extension Points). Verification proofs extended: kubernetes_registry_test.go, kubernetes_agents_test.go, agent_inventory_test.go (new TestCollectRBACInventoryReportsSummaryCountsOnly that pins the subject-name-omission contract), demo_scenarios_test.go, adapter_coverage_test.go, contract_test.go, org_handlers_test.go, resourceIdentity.test.ts, reportingResourceTypes.test.ts, KubernetesConfigTable.test.tsx, and the subsystem_lookup_test.py line-anchor bumps that the contract edits shifted (api-contracts 246 -> 253, organization-settings 92 -> 93). Verified: - go build ./internal/... ./cmd/... clean - go test ./internal/unifiedresources/..., ./internal/mock/..., ./internal/kubernetesagent/..., ./internal/api/..., the K8s subset of ./internal/monitoring/... all clean (three pre-existing unrelated monitoring failures noted earlier remain unchanged by this commit) - npm run type-check, lint:eslint, lint:theme, lint:canonical-platforms clean - vitest: 70 K8s frontend tests pass including the new RBAC render coverage in KubernetesConfigTable.test.tsx - browser proof on /kubernetes/configuration: 36 config rows including 18 RBAC rows across three clusters; ClusterRole "pulse-demo-monitoring" shows "12 rules · Aggregated"; ClusterRoleBinding shows "3 subjects · Group, ServiceAccount +1" |
||
|---|---|---|
| .. | ||
| report.go | ||