Skip to content

Add revoke action and YAML support for permission updates #1461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anniegracehu wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Add revoke action and YAML support for permission updates #1461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
6e0c42b
Add revoke action and YAML/JSON permission parsing.
anniegracehu Mar 30, 2026
4719e7c
Keep legacy update parser as runtime source of truth.
anniegracehu Mar 30, 2026
49356a3
Minimize update parser parity diff.
anniegracehu Mar 30, 2026
3405b38
Shrink update path; fix revoke no-op; align parser with legacy.
anniegracehu Mar 30, 2026
32ebc09
Restore update parser parity checks.
anniegracehu Mar 30, 2026
28d25b5
Use single _parse_permission_rules for update and revoke.
anniegracehu Mar 30, 2026
146a8e4
Add manual YAML fixture for update/revoke e2e checks.
anniegracehu Apr 7, 2026
15ee238
Add JSON/YAML permission fixtures for manual update/revoke checks.
anniegracehu Apr 7, 2026
b2cf020
Add test coverage for permission fixture files.
anniegracehu Apr 7, 2026
eeff860
Remove obsolete manual update/revoke permission fixture.
anniegracehu Apr 7, 2026
ff11a68
Add integration test for JSON/YAML auth can-i equivalence.
anniegracehu Apr 7, 2026
3afe4df
Normalize empty-string YAML keys in permission fixtures.
anniegracehu Apr 14, 2026
5bfb1e1
Fallback revoke to base role when update role missing.
anniegracehu Apr 14, 2026
731a6bc
Normalize empty-string key style in YAML permission fixtures.
anniegracehu Apr 14, 2026
9ffb0d8
Harden revoke path and test semantics.
anniegracehu Apr 14, 2026
a3b8fc3
Harden revoke matching, metadata handling, and tests.
anniegracehu Apr 14, 2026
4b43ea7
Fix round-3 revoke correctness regressions.
anniegracehu Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
267 changes: 210 additions & 57 deletions provider-kubeconfig.py
View file
Open in desktop

Large diffs are not rendered by default.

70 changes: 70 additions & 0 deletions tests/permission_files/permissions-example1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
{
"perms": {
"*": [
{
"*": [
"*",
"delete",
"get",
"patch"
]
}
],
"non-apigroup": [
{
"nonResourceURL::*": [
"*"
]
}
],
"": [
{
"pods/log": [
"get"
]
}
],
"argoproj.io": [
{
"applicationset": [
"get",
"list",
"watch"
]
},
{
"applications": [
"create",
"get",
"list",
"watch",
"update",
"patch",
"delete"
]
},
{
"applicationsets": [
"create",
"get",
"list",
"watch",
"update",
"delete",
"patch"
]
},
{
"appprojects": [
"create",
"get",
"list",
"watch",
"update",
"patch",
"delete"
]
}
]
}
}
42 changes: 42 additions & 0 deletions tests/permission_files/permissions-example1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
perms:
'*':
- '*':
- '*'
- delete
- get
- patch
non-apigroup:
- nonResourceURL::*:
- '*'
'':
- pods/log:
- get
argoproj.io:
- applicationset:
- get
- list
- watch
- applications:
- create
- get
- list
- watch
- update
- patch
- delete
- applicationsets:
- create
- get
- list
- watch
- update
- delete
- patch
- appprojects:
- create
- get
- list
- watch
- update
- patch
- delete
268 changes: 268 additions & 0 deletions tests/permission_files/permissions-example2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,268 @@
{
"perms": {
"cert-manager.io": [
{
"issuers/status": [
"update"
]
},
{
"clusterissuers/status": [
"update"
]
},
{
"certificates/status": [
"update"
]
},
{
"certificaterequests/status": [
"update"
]
},
{
"certificates/finalizers": [
"update"
]
},
{
"certificaterequests/finalizers": [
"update"
]
},
{
"clusterissuers": [
"update",
"get",
"list",
"watch"
]
},
{
"certificates": [
"get",
"list",
"watch",
"update",
"create",
"delete",
"deletecollection",
"patch"
]
},
{
"certificaterequests": [
"update",
"get",
"list",
"watch",
"create",
"delete",
"deletecollection",
"patch"
]
},
{
"issuers": [
"update",
"get",
"list",
"watch",
"create",
"delete",
"deletecollection",
"patch"
]
},
{
"signers/resourceName::issuers.cert-manager.io/*": [
"approve"
]
},
{
"signers/resourceName::clusterissuers.cert-manager.io/*": [
"approve"
]
},
{
"signers/resourceName::issuers.cert-manager.io/*": [
"approve"
]
},
{
"signers/resourceName::clusterissuers.cert-manager.io/*": [
"approve"
]
}
],
"": [
{
"configmaps/resourceName::cert-manager-cainjector-leader-election": [
"get",
"update",
"patch"
]
},
{
"configmaps/resourceName::cert-manager-cainjector-leader-election-core": [
"get",
"update",
"patch"
]
},
{
"configmaps/resourceName::cert-manager-cainjector-leader-election": [
"get",
"update",
"patch"
]
},
{
"configmaps/resourceName::cert-manager-cainjector-leader-election-core": [
"get",
"update",
"patch"
]
},
{
"configmaps/resourceName::cert-manager-controller": [
"create",
"get",
"update",
"patch"
]
},
{
"secrets/resourceName::kptc-cert-manager-webhook-ca": [
"get",
"list",
"watch",
"create",
"update",
"patch",
"delete"
]
}
],
"admissionregistration.k8s.io": [
{
"validatingwebhookconfigurations": [
"get",
"list",
"watch",
"update"
]
}
],
"apiregistration.k8s.io": [
{
"apiservices": [
"get",
"list",
"watch",
"update"
]
}
],
"auditregistration.k8s.io": [
{
"auditsinks": [
"get",
"list",
"watch",
"update"
]
}
],
"acme.cert-manager.io": [
{
"orders/status": [
"update"
]
},
{
"orders/finalizers": [
"update"
]
},
{
"challenges/status": [
"update"
]
},
{
"challenges/finalizers": [
"update"
]
},
{
"challenges": [
"get",
"list",
"watch",
"create",
"delete",
"update",
"deletecollection",
"patch"
]
},
{
"orders": [
"create",
"delete",
"get",
"list",
"watch",
"update",
"deletecollection",
"patch"
]
}
],
"networking.k8s.io": [
{
"ingresses/finalizers": [
"update"
]
}
],
"route.openshift.io": [
{
"routes/custom-host": [
"create"
]
}
],
"authorization.k8s.io": [
{
"subjectaccessreviews": [
"create"
]
}
],
"coordination.k8s.io": [
{
"leases/resourceName::cert-manager-controller": [
"get",
"update",
"patch"
]
},
{
"leases/resourceName::cert-manager-controller": [
"create",
"get",
"update",
"patch"
]
},
{
"leases": [
"create"
]
}
]
}
}
Loading
Loading
⚡