public_git
/
postgres-operator
mirror of https://github.com/zalando/postgres-operator.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

superusers instead of admin

This commit is contained in:
Felix Kunde 2020-10-15 13:40:41 +02:00
parent 0f86eff13e
commit 4cd82220d2
6 changed files with 39 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
manifests/postgresteam.crd.yaml
View File

@ -34,7 +34,7 @@ spec:
spec: spec:
type: object type: object
properties: properties:
additionalAdminTeams: additionalSuperuserTeams:
type: object type: object
description: "Map for teamId and associted additional admin teams" description: "Map for teamId and associted additional admin teams"
additionalProperties: additionalProperties:

6
pkg/apis/acid.zalan.do/v1/postgres_team_type.go
View File

@ -17,9 +17,9 @@ type PostgresTeam struct {
// PostgresTeamSpec defines the specification for the PostgresTeam TPR. // PostgresTeamSpec defines the specification for the PostgresTeam TPR.
type PostgresTeamSpec struct { type PostgresTeamSpec struct {
AdditionalAdminTeams map[string][]string `json:"additionalAdminTeams,omitempty"` AdditionalSuperuserTeams map[string][]string `json:"additionalSuperuserTeams,omitempty"`
AdditionalTeams map[string][]string `json:"additionalTeams,omitempty"` AdditionalTeams map[string][]string `json:"additionalTeams,omitempty"`
AdditionalMembers map[string][]string `json:"additionalMembers,omitempty"` AdditionalMembers map[string][]string `json:"additionalMembers,omitempty"`
} }
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

4
pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go
View File

@ -774,8 +774,8 @@ func (in *PostgresTeamList) DeepCopyObject() runtime.Object {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *PostgresTeamSpec) DeepCopyInto(out *PostgresTeamSpec) { func (in *PostgresTeamSpec) DeepCopyInto(out *PostgresTeamSpec) {
*out = *in *out = *in
if in.AdditionalAdminTeams != nil { if in.AdditionalSuperuserTeams != nil {
in, out := &in.AdditionalAdminTeams, &out.AdditionalAdminTeams in, out := &in.AdditionalSuperuserTeams, &out.AdditionalSuperuserTeams
*out = make(map[string][]string, len(*in)) *out = make(map[string][]string, len(*in))
for key, val := range *in { for key, val := range *in {
var outVal []string var outVal []string

23
pkg/cluster/cluster.go
View File

@ -1130,27 +1130,24 @@ func (c *Cluster) initTeamMembers(teamID string, isPostgresSuperuserTeam bool) e
func (c *Cluster) initHumanUsers() error { func (c *Cluster) initHumanUsers() error {
adminTeams := c.PgTeamMap.GetAdditionalTeams(c.Spec.TeamID, true) superuserTeams := c.PgTeamMap.GetAdditionalSuperuserTeams(c.Spec.TeamID, true)
var clusterIsOwnedBySuperuserTeam bool var clusterIsOwnedBySuperuserTeam bool
for _, postgresSuperuserTeam := range c.OpConfig.PostgresSuperuserTeams { for _, postgresSuperuserTeam := range c.OpConfig.PostgresSuperuserTeams {
isAdditionalAdminTeam := false isAdditionalSuperuserTeam := false
for _, adminTeam := range adminTeams { for _, superuserTeam := range superuserTeams {
if postgresSuperuserTeam == adminTeam { if postgresSuperuserTeam == superuserTeam {
isAdditionalAdminTeam = true isAdditionalSuperuserTeam = true
} }
} }
if !(isAdditionalAdminTeam) {
adminTeams = append(adminTeams, postgresSuperuserTeam)
}
if postgresSuperuserTeam == c.Spec.TeamID {
clusterIsOwnedBySuperuserTeam = true
}
} }
for _, adminTeam := range adminTeams { for _, superuserTeam := range superuserTeams {
err := c.initTeamMembers(adminTeam, true) err := c.initTeamMembers(adminTeam, true)
if err != nil { if err != nil {
return fmt.Errorf("Cannot create team %q of Postgres superusers: %v", adminTeam, err) return fmt.Errorf("Cannot create team %q of Postgres superusers: %v", superuserTeam, err)
}
if superuserTeam == c.Spec.TeamID {
clusterIsOwnedBySuperuserTeam = true
} }
} }

40
pkg/teams/postgres_team.go
View File

@ -8,9 +8,9 @@ import (
type PostgresTeamMap map[string]postgresTeamMembership type PostgresTeamMap map[string]postgresTeamMembership
type postgresTeamMembership struct { type postgresTeamMembership struct {
AdditionalAdminTeams []string AdditionalSuperuserTeams []string
AdditionalTeams []string AdditionalTeams []string
AdditionalMembers []string AdditionalMembers []string
} }
type teamHashSet map[string]map[string]struct{} type teamHashSet map[string]map[string]struct{}
@ -55,26 +55,18 @@ func fetchTeams(teamset *map[string]struct{}, set teamHashSet) {
} }
} }
func (ptm *PostgresTeamMap) fetchAdditionalTeams(team string, adminTeams bool, transitive bool, exclude *[]string) []string { func (ptm *PostgresTeamMap) fetchAdditionalTeams(team string, superuserTeams bool, transitive bool, exclude *[]string) []string {
var teams, allTeams []string var teams []string
if adminTeams { if superuserTeams {
teams = (*ptm)[team].AdditionalAdminTeams teams = (*ptm)[team].AdditionalSuperuserTeams
allTeams = teams
for _, otherPrivilegedTeam := range (*ptm)[team].AdditionalTeams {
allTeams = append(allTeams, otherPrivilegedTeam)
}
} else { } else {
teams = (*ptm)[team].AdditionalTeams teams = (*ptm)[team].AdditionalTeams
allTeams = teams
for _, otherPrivilegedTeam := range (*ptm)[team].AdditionalAdminTeams {
allTeams = append(allTeams, otherPrivilegedTeam)
}
} }
if transitive { if transitive {
*exclude = append(*exclude, team) *exclude = append(*exclude, team)
for _, additionalTeam := range allTeams { for _, additionalTeam := range teams {
getTransitiveTeams := true getTransitiveTeams := true
for _, excludedTeam := range *exclude { for _, excludedTeam := range *exclude {
if additionalTeam == excludedTeam { if additionalTeam == excludedTeam {
@ -82,7 +74,7 @@ func (ptm *PostgresTeamMap) fetchAdditionalTeams(team string, adminTeams bool, t
} }
} }
if getTransitiveTeams { if getTransitiveTeams {
transitiveTeams := (*ptm).fetchAdditionalTeams(additionalTeam, adminTeams, transitive, exclude) transitiveTeams := (*ptm).fetchAdditionalTeams(additionalTeam, superuserTeams, transitive, exclude)
if len(transitiveTeams) > 0 { if len(transitiveTeams) > 0 {
for _, transitiveTeam := range transitiveTeams { for _, transitiveTeam := range transitiveTeams {
@ -102,31 +94,31 @@ func (ptm *PostgresTeamMap) GetAdditionalTeams(team string, transitive bool) []s
} }
// GetAdditionalTeams function to retrieve list of additional teams // GetAdditionalTeams function to retrieve list of additional teams
func (ptm *PostgresTeamMap) GetAdditionalAdminTeams(team string, transitive bool) []string { func (ptm *PostgresTeamMap) GetAdditionalSuperuserTeams(team string, transitive bool) []string {
return ptm.fetchAdditionalTeams(team, true, transitive, &[]string{}) return ptm.fetchAdditionalTeams(team, true, transitive, &[]string{})
} }
// Load function to import data from PostgresTeam CRD // Load function to import data from PostgresTeam CRD
func (ptm *PostgresTeamMap) Load(pgTeams *acidv1.PostgresTeamList) { func (ptm *PostgresTeamMap) Load(pgTeams *acidv1.PostgresTeamList) {
adminTeamSet := teamHashSet{} superuserTeamSet := teamHashSet{}
teamSet := teamHashSet{} teamSet := teamHashSet{}
teamMemberSet := teamHashSet{} teamMemberSet := teamHashSet{}
teamIDs := make(map[string]struct{}) teamIDs := make(map[string]struct{})
for _, pgTeam := range pgTeams.Items { for _, pgTeam := range pgTeams.Items {
adminTeamSet.mergeCrdMap(pgTeam.Spec.AdditionalAdminTeams) superuserTeamSet.mergeCrdMap(pgTeam.Spec.AdditionalSuperuserTeams)
teamSet.mergeCrdMap(pgTeam.Spec.AdditionalTeams) teamSet.mergeCrdMap(pgTeam.Spec.AdditionalTeams)
teamMemberSet.mergeCrdMap(pgTeam.Spec.AdditionalMembers) teamMemberSet.mergeCrdMap(pgTeam.Spec.AdditionalMembers)
} }
fetchTeams(&teamIDs, adminTeamSet) fetchTeams(&teamIDs, superuserTeamSet)
fetchTeams(&teamIDs, teamSet) fetchTeams(&teamIDs, teamSet)
fetchTeams(&teamIDs, teamMemberSet) fetchTeams(&teamIDs, teamMemberSet)
for teamID := range teamIDs { for teamID := range teamIDs {
(*ptm)[teamID] = postgresTeamMembership{ (*ptm)[teamID] = postgresTeamMembership{
AdditionalAdminTeams: adminTeamSet.toMap()[teamID], AdditionalSuperuserTeams: superuserTeamSet.toMap()[teamID],
AdditionalTeams: teamSet.toMap()[teamID], AdditionalTeams: teamSet.toMap()[teamID],
AdditionalMembers: teamMemberSet.toMap()[teamID], AdditionalMembers: teamMemberSet.toMap()[teamID],
} }
} }
} }

14
pkg/teams/postgres_team_test.go
View File

@ -38,7 +38,7 @@ func TestLoadingPostgresTeamCRD(t *testing.T) {
Name: "teamAB", Name: "teamAB",
}, },
Spec: acidv1.PostgresTeamSpec{ Spec: acidv1.PostgresTeamSpec{
AdditionalAdminTeams: map[string][]string{"teamA": []string{"teamB", "team24/7"}, "teamB": []string{"teamA", "team24/7"}}, AdditionalSuperuserTeams: map[string][]string{"teamA": []string{"teamB", "team24/7"}, "teamB": []string{"teamA", "team24/7"}},
AdditionalTeams: map[string][]string{"teamA": []string{"teamC"}, "teamB": []string{}}, AdditionalTeams: map[string][]string{"teamA": []string{"teamC"}, "teamB": []string{}},
AdditionalMembers: map[string][]string{"team24/7": []string{"optimusprime"}, "teamB": []string{"drno"}}, AdditionalMembers: map[string][]string{"team24/7": []string{"optimusprime"}, "teamB": []string{"drno"}},
}, },
@ -51,7 +51,7 @@ func TestLoadingPostgresTeamCRD(t *testing.T) {
Name: "teamC", Name: "teamC",
}, },
Spec: acidv1.PostgresTeamSpec{ Spec: acidv1.PostgresTeamSpec{
AdditionalAdminTeams: map[string][]string{"teamC": []string{"team24/7"}}, AdditionalSuperuserTeams: map[string][]string{"teamC": []string{"team24/7"}},
AdditionalTeams: map[string][]string{"teamA": []string{"teamC"}, "teamC": []string{"teamA", "teamB"}}, AdditionalTeams: map[string][]string{"teamA": []string{"teamC"}, "teamC": []string{"teamA", "teamB"}},
AdditionalMembers: map[string][]string{"acid": []string{"batman"}}, AdditionalMembers: map[string][]string{"acid": []string{"batman"}},
}, },
@ -60,27 +60,27 @@ func TestLoadingPostgresTeamCRD(t *testing.T) {
}, },
PostgresTeamMap{ PostgresTeamMap{
"teamA": { "teamA": {
AdditionalAdminTeams: []string{"teamB", "team24/7"}, AdditionalSuperuserTeams: []string{"teamB", "team24/7"},
AdditionalTeams: []string{"teamC"}, AdditionalTeams: []string{"teamC"},
AdditionalMembers: nil, AdditionalMembers: nil,
}, },
"teamB": { "teamB": {
AdditionalAdminTeams: []string{"teamA", "team24/7"}, AdditionalSuperuserTeams: []string{"teamA", "team24/7"},
AdditionalTeams: []string{}, AdditionalTeams: []string{},
AdditionalMembers: []string{"drno"}, AdditionalMembers: []string{"drno"},
}, },
"teamC": { "teamC": {
AdditionalAdminTeams: []string{"team24/7"}, AdditionalSuperuserTeams: []string{"team24/7"},
AdditionalTeams: []string{"teamA", "teamB"}, AdditionalTeams: []string{"teamA", "teamB"},
AdditionalMembers: nil, AdditionalMembers: nil,
}, },
"team24/7": { "team24/7": {
AdditionalAdminTeams: nil, AdditionalSuperuserTeams: nil,
AdditionalTeams: nil, AdditionalTeams: nil,
AdditionalMembers: []string{"optimusprime"}, AdditionalMembers: []string{"optimusprime"},
}, },
"acid": { "acid": {
AdditionalAdminTeams: nil, AdditionalSuperuserTeams: nil,
AdditionalTeams: nil, AdditionalTeams: nil,
AdditionalMembers: []string{"batman"}, AdditionalMembers: []string{"batman"},
}, },