74a8313d65
## What this PR does Previously a namespaced role was created per tenant and access level. Since these roles are all identical, it's sufficient to create a cluster role per access level and just create namespaced rolebindings to these cluster roles per tenant. This will enable aggregation rules. E.g. if a new API group is installed, such as backups.cozystack.io, a new clusterrole can be created for managing this API group with a label like rbac.cozystack.io/aggregate-to-admin. Smart use of aggregation rules will enable automatic granting of access rights not just to admin, but to super-admin too, and there will be no need to update every single tenant. ### Release note ```release-note [tenant,rbac] Use ClusterRoles with aggregationRules instead of roles per every tenant. ``` Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
39 lines
1.1 KiB
Bash
39 lines
1.1 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
@test "Create DB MongoDB" {
|
|
name='test'
|
|
kubectl apply -f - <<EOF
|
|
apiVersion: apps.cozystack.io/v1alpha1
|
|
kind: MongoDB
|
|
metadata:
|
|
name: $name
|
|
namespace: tenant-test
|
|
spec:
|
|
external: false
|
|
size: 10Gi
|
|
replicas: 1
|
|
storageClass: ""
|
|
resourcesPreset: "small"
|
|
users:
|
|
testuser:
|
|
password: xai7Wepo
|
|
databases:
|
|
testdb:
|
|
roles:
|
|
admin:
|
|
- testuser
|
|
backup:
|
|
enabled: false
|
|
EOF
|
|
sleep 5
|
|
# Wait for HelmRelease
|
|
kubectl -n tenant-test wait hr mongodb-$name --timeout=60s --for=condition=ready
|
|
# Wait for MongoDB service (port 27017)
|
|
timeout 120 sh -ec "until kubectl -n tenant-test get svc mongodb-$name-rs0 -o jsonpath='{.spec.ports[0].port}' | grep -q '27017'; do sleep 10; done"
|
|
# Wait for endpoints
|
|
timeout 180 sh -ec "until kubectl -n tenant-test get endpoints mongodb-$name-rs0 -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done"
|
|
# Wait for StatefulSet replicas
|
|
kubectl -n tenant-test wait statefulset.apps/mongodb-$name-rs0 --timeout=300s --for=jsonpath='{.status.replicas}'=1
|
|
# Cleanup
|
|
kubectl -n tenant-test delete mongodbs.apps.cozystack.io $name
|
|
}
|