-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add policy file generation and CI pipeline setup
- Loading branch information
1 parent
e639f9b
commit 9db6ea8
Showing
6 changed files
with
276 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: ci-policies | ||
| on: | ||
| workflow_call: | ||
| env: | ||
| GO_VERSION: '1.22' | ||
|
|
||
| jobs: | ||
| cerbosCheck: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: checkout | ||
| uses: actions/checkout@v3 | ||
| - name: set up | ||
| uses: actions/setup-go@v4 | ||
| with: | ||
| go-version: ${{ env.GO_VERSION }} | ||
| cache: false | ||
| - name: Generate policies | ||
| run: make generate-policies | ||
| working-directory: api | ||
| - name: Setup Cerbos | ||
| uses: cerbos/cerbos-setup-action@v1 | ||
| with: | ||
| version: latest | ||
| - name: Compile and test policies | ||
| uses: cerbos/cerbos-compile-action@v1 | ||
| with: | ||
| policyDir: api/policies |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| name: update-policies | ||
| on: | ||
| workflow_call: | ||
| env: | ||
| GO_VERSION: '1.22' | ||
| GCS_BUCKET_PATH: gs://cerbos-oss-policyfile-bucket | ||
|
|
||
| jobs: | ||
| update-policies: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: checkout | ||
| uses: actions/checkout@v3 | ||
| - name: set up | ||
| uses: actions/setup-go@v4 | ||
| with: | ||
| go-version: ${{ env.GO_VERSION }} | ||
| cache: false | ||
| - name: Generate policies | ||
| run: make generate-policies | ||
| working-directory: api | ||
| - name: Authenticate to Google Cloud | ||
| uses: google-github-actions/auth@v1 | ||
| with: | ||
| credentials_json: ${{ secrets.GCP_SA_KEY }} | ||
| - name: Set up Cloud SDK | ||
| uses: google-github-actions/setup-gcloud@v1 | ||
| - name: Sync policies with Cloud Storage | ||
| run: | | ||
| echo "All files in bucket (before sync):" | ||
| gsutil ls $GCS_BUCKET_PATH/ || true | ||
| echo "Current flow files in bucket:" | ||
| bucket_files=$(gsutil ls $GCS_BUCKET_PATH/flow_*.yaml || true) | ||
| echo "$bucket_files" | ||
| echo "Local policy files:" | ||
| local_files=$(ls api/policies/flow_*.yaml || true) | ||
| echo "$local_files" | ||
| for file in api/policies/flow_*.yaml; do | ||
| if [ -f "$file" ]; then | ||
| file_name=$(basename "$file") | ||
| echo "Uploading/Updating: $file_name" | ||
| gsutil cp "$file" "$GCS_BUCKET_PATH/$file_name" | ||
| fi | ||
| done | ||
| for bucket_file in $GCS_BUCKET_PATH/flow_*.yaml; do | ||
| file_name=$(basename "$bucket_file") | ||
| if [ ! -f "api/policies/$file_name" ] && [[ "$file_name" == flow_* ]]; then | ||
| echo "Deleting: $file_name" | ||
| gsutil rm "$bucket_file" | ||
| fi | ||
| done | ||
| echo "Sync completed. All files in bucket:" | ||
| gsutil ls $GCS_BUCKET_PATH/ || true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| // cmd/policy-generator/main.go | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
| "strings" | ||
|
|
||
| "github.com/reearth/reearth-flow/api/internal/rbac" | ||
| "gopkg.in/yaml.v2" | ||
| ) | ||
|
|
||
| type CerbosPolicy struct { | ||
| APIVersion string `yaml:"apiVersion"` | ||
| ResourcePolicy ResourcePolicy `yaml:"resourcePolicy"` | ||
| } | ||
|
|
||
| type ResourcePolicy struct { | ||
| Version string `yaml:"version"` | ||
| Resource string `yaml:"resource"` | ||
| Rules []Rule `yaml:"rules"` | ||
| } | ||
|
|
||
| type Rule struct { | ||
| Actions []string `yaml:"actions"` | ||
| Effect string `yaml:"effect"` | ||
| Roles []string `yaml:"roles"` | ||
| } | ||
|
|
||
| func main() { | ||
| resources := rbac.DefineResources() | ||
|
|
||
| for _, resource := range resources { | ||
| policy := CerbosPolicy{ | ||
| APIVersion: "api.cerbos.dev/v1", | ||
| ResourcePolicy: ResourcePolicy{ | ||
| Version: "default", | ||
| Resource: resource.Resource, | ||
| Rules: make([]Rule, 0, len(resource.Actions)), | ||
| }, | ||
| } | ||
|
|
||
| for _, action := range resource.Actions { | ||
| roles := make([]string, 0, len(action.Roles)) | ||
| for _, role := range action.Roles { | ||
| roles = append(roles, string(role)) | ||
| } | ||
|
|
||
| rule := Rule{ | ||
| Actions: []string{string(action.Action)}, | ||
| Effect: "EFFECT_ALLOW", | ||
| Roles: roles, | ||
| } | ||
| policy.ResourcePolicy.Rules = append(policy.ResourcePolicy.Rules, rule) | ||
| } | ||
|
|
||
| // ポリシーファイルの出力 | ||
| filename := strings.ReplaceAll(resource.Resource, ":", "_") | ||
| outputPath := filepath.Join("policies", fmt.Sprintf("%s.yaml", filename)) | ||
| data, err := yaml.Marshal(policy) | ||
| if err != nil { | ||
| fmt.Printf("Error marshaling policy: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| if err := os.MkdirAll("policies", 0755); err != nil { | ||
| fmt.Printf("Error creating directory: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| if err := os.WriteFile(outputPath, data, 0644); err != nil { | ||
| fmt.Printf("Error writing file: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| package rbac | ||
|
|
||
| const ( | ||
| serviceName = "flow" | ||
| ) | ||
|
|
||
| type resourceType string | ||
|
|
||
| const ( | ||
| resourceProject resourceType = "project" | ||
| resourceWorkflow resourceType = "workflow" | ||
| ) | ||
|
|
||
| type actionType string | ||
|
|
||
| const ( | ||
| actionRead actionType = "read" | ||
| actionEdit actionType = "edit" | ||
| ) | ||
|
|
||
| type roleType string | ||
|
|
||
| const ( | ||
| roleOwner roleType = "owner" | ||
| roleMaintainer roleType = "maintainer" | ||
| roleWriter roleType = "writer" | ||
| roleReader roleType = "reader" | ||
| ) | ||
|
|
||
| type resourceDefinition struct { | ||
| resource string | ||
| actions []actionDefinition | ||
| } | ||
|
|
||
| type actionDefinition struct { | ||
| action actionType | ||
| roles []roleType | ||
| } | ||
|
|
||
| func makeResourceName(resource resourceType) string { | ||
| return serviceName + ":" + string(resource) | ||
| } | ||
|
|
||
| func DefineResources() []resourceDefinition { | ||
| return []resourceDefinition{ | ||
| { | ||
| resource: makeResourceName(resourceProject), | ||
| actions: []actionDefinition{ | ||
| { | ||
| action: actionRead, | ||
| roles: []roleType{roleOwner, roleMaintainer, roleWriter, roleReader}, | ||
| }, | ||
| { | ||
| action: actionEdit, | ||
| roles: []roleType{roleOwner, roleMaintainer, roleWriter}, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| resource: makeResourceName(resourceWorkflow), | ||
| actions: []actionDefinition{ | ||
| { | ||
| action: actionRead, | ||
| roles: []roleType{roleOwner, roleMaintainer, roleWriter, roleReader}, | ||
| }, | ||
| { | ||
| action: actionEdit, | ||
| roles: []roleType{roleOwner, roleMaintainer, roleWriter}, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| } |