✨ Add interactive cmd prompt for permission claims #2309

varshaprasad96 · 2022-11-04T23:59:56Z

Summary

This PR introduces an interactive command prompt to edit the status of open claims for apibindings. The user can provide - Yes/No/Skip to accept/reject/skip any action on a permission claim respectively.

Use cases:

Edit permission claims related to a specific APIBinding:

➜  kcp git:(claims/edit) ./bin/kubectl-kcp claims edit apibinding cert-manager
Running interactive prompt. Enter (Yes/No/Skip)
Accept permission claim for Resource: secrets (APIBinding: cert-manager) > yes

Edit permission claims related to all apibindings in a workspace:

➜  kcp git:(claims/edit) ✗ ./bin/kubectl-kcp claims edit apibinding
Running interactive prompt. Enter (Yes/No/Skip)
No open claims found for apibinding: "apiresource.kcp.dev-1wked"
Accept permission claim for Resource: secrets (APIBinding: cert-manager) > Yes
No open claims found for apibinding: "tenancy.kcp.dev-59phz"

Use the edit command, but there are no open permission claims:

➜  kcp git:(claims/edit) ✗ ./bin/kubectl-kcp claims edit apibinding
Running interactive prompt. Enter (Yes/No/Skip)
No open claims found for apibinding: "apiresource.kcp.dev-1wked"
No open claims found for apibinding: "cert-manager"

What happens after editing?

The APIBinding's spec.AcceptablePermssionClaim gets updated based on the user input. For example:

➜  kcp git:(claims/edit) ✗ k get apibinding cert-manager -o yaml
apiVersion: apis.kcp.dev/v1alpha1
kind: APIBinding
metadata:
  ...
spec:
  permissionClaims:
  - all: true
    resource: secrets
    state: Accepted
  reference:
    workspace:
      exportName: cert-manager-stable
      path: root:cert-manager-service
status:
  appliedPermissionClaims:
  - all: true
    resource: secrets
  boundResources:
  - group: cert-manager.io
    resource: certificaterequests
    schema:
...

PS: With the updates added to the permission claims spec (like sub-resources, verbs), the prompt's UI will need to change accordingly.

Design doc: https://docs.google.com/document/d/1J31wXY1-2aCyyGFjUlusKoHDzV-zktAmRdIMjMf4OR0/edit

Related issue(s)

Fixes #

openshift-ci · 2022-11-05T00:00:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ncdc for approval by writing /assign @ncdc in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

contrib/OWNERS
pkg/cliplugins/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

pkg/cliplugins/claims/cmd/cmd.go

stevekuznetsov · 2022-11-06T01:16:41Z

pkg/cliplugins/claims/cmd/cmd.go

+ %[1]s claims get apibinding cert-manager
+
+ # Edit the permission claims' status for all APIBindings in current workspace with an interactive prompt.
+ %[1]s claims get apibinding


Suggested change

%[1]s claims get apibinding

%[1]s claims edit apibinding

This reads weird - maybe require --all or something?

The idea was to just to list all the open claims for all bindings in case a specific binding wasn't given. It follows a similar format to the get command. If we add --all flag then we should probably do so for get too.

pkg/cliplugins/claims/cmd/cmd.go

pkg/cliplugins/claims/plugin/edit.go

pkg/cliplugins/claims/plugin/util.go

stevekuznetsov · 2022-11-06T01:26:10Z

pkg/cliplugins/claims/plugin/util.go

+ }
+}
+
+func readInput(reader *bufio.Reader) string {


How is this different from readLine()?

We could make both the methods into one. The reason for having it different was in future we can extend this to parse an array or process string with a different delimiter. Say,

func readArray(reader *bufio.Reader) []string { arr := make([]string, 0) text := readLine(reader) for _, words := range strings.Split(text, ",") { arr = append(arr, strings.TrimSpace(words)) } return arr }

This is just to make post processing of string separate for future use cases.

stevekuznetsov · 2022-11-06T01:26:30Z

pkg/cliplugins/claims/plugin/util.go

+ return strings.ToLower(strings.Trim(strings.TrimSpace(text), "`'\""))
+}
+
+func inferText(input string, wr io.Writer) (ClaimAction, error) {


Is there any library to do this for us? I imagine there are other permutations as well.

I tried digging into some available options like go-prompt and prompt-ui. These are shell libraries which have more advanced features like auto-complete/suggestions or selections . And for creating simple prompts as we have done, they follow a similar approach as here. And then also looked into some upstream repos, like kubectl (https://github.com/kubernetes/kubectl/blob/master/pkg/cmd/util/editor/editoptions.go#L889) and kubebuilder (https://pkg.go.dev/sigs.k8s.io/kubebuilder/v3/pkg/plugin/util#YesNo), which seemed to follow a similar approach. For (Y)es|(N)o|(S)kip case, the available possibilities are less (precisely 6 - given that we are converting all inputs into a single case for inferring it).

nrb · 2022-11-07T20:39:11Z

A question I don't see addressed in the design doc - will there be a way for users to programmatically accept permission claims? I know there's danger there and we might not want to make it too easy, but I'm anticipating someone asking.

varshaprasad96 · 2022-11-07T23:24:21Z

A question I don't see addressed in the design doc - will there be a way for users to programmatically accept permission claims? I know there's danger there and we might not want to make it too easy, but I'm anticipating someone asking.

Agreed, for now my understanding was anyone who can access the workspace where APIBinding was created can change the state of the claim. Or maybe the right wording is, any user who can edit the apibinding can accept/reject respective claim. Are we looking to add another layer of rbac, wherein a user can view the binding, edit the export reference but not permission claim? (more like claims can be modified only be admins?)

nrb · 2022-11-08T18:40:37Z

Agreed, for now my understanding was anyone who can access the workspace where APIBinding was created can change the state of the claim. Or maybe the right wording is, any user who can edit the apibinding can accept/reject respective claim.

That's probably sufficient; if someone wants to automate things, they can use Go or wrappers around kubectl to do it. This command can be purely interactive. 👍

openshift-merge-robot · 2022-11-22T08:59:59Z

@varshaprasad96: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ncdc · 2023-03-06T17:39:07Z

@varshaprasad96 so sorry for losing sight of this PR! Are you still available to work on it, or would you be interested in trying to find someone to take it over for you?

varshaprasad96 · 2023-03-07T02:03:56Z

@ncdc I can work on this sometime this week and rebase with the latest changes.

kcp-ci-bot · 2024-04-16T08:31:04Z

Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale

sttts · 2024-04-17T07:04:59Z

I still think we want this / something like this.

/remove-lifecycle stale

openshift-ci bot requested review from davidfestal and stevekuznetsov November 5, 2022 00:00

varshaprasad96 requested review from sttts and removed request for davidfestal and stevekuznetsov November 5, 2022 00:00

varshaprasad96 force-pushed the claims/edit branch 3 times, most recently from 552cc9d to 25c8ff6 Compare November 5, 2022 00:10

stevekuznetsov reviewed Nov 6, 2022

View reviewed changes

varshaprasad96 added 2 commits November 7, 2022 13:50

Add command to interact with permission claims

06aaaf5

Print promt for core types when group is not mentioned

ba3fc13

varshaprasad96 force-pushed the claims/edit branch from 25c8ff6 to 60fd0da Compare November 7, 2022 22:54

address review comments

1671008

varshaprasad96 force-pushed the claims/edit branch from 60fd0da to 1671008 Compare November 8, 2022 05:15

varshaprasad96 requested review from stevekuznetsov and nrb November 8, 2022 05:17

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 22, 2022

ncdc added the area/apiexports label Mar 14, 2023

mjudeikis mentioned this pull request Mar 25, 2024

feature: add kubectl ws -i #3098

Open

1 task

kcp-ci-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 16, 2024

kcp-ci-bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Add interactive cmd prompt for permission claims #2309

✨ Add interactive cmd prompt for permission claims #2309

varshaprasad96 commented Nov 4, 2022 •

edited

openshift-ci bot commented Nov 5, 2022

stevekuznetsov Nov 6, 2022

stevekuznetsov Nov 6, 2022

varshaprasad96 Nov 7, 2022

stevekuznetsov Nov 6, 2022

varshaprasad96 Nov 7, 2022

stevekuznetsov Nov 6, 2022

varshaprasad96 Nov 7, 2022

nrb commented Nov 7, 2022

varshaprasad96 commented Nov 7, 2022

nrb commented Nov 8, 2022

openshift-merge-robot commented Nov 22, 2022

ncdc commented Mar 6, 2023

varshaprasad96 commented Mar 7, 2023

kcp-ci-bot commented Apr 16, 2024

sttts commented Apr 17, 2024

✨ Add interactive cmd prompt for permission claims #2309

Are you sure you want to change the base?

✨ Add interactive cmd prompt for permission claims #2309

Conversation

varshaprasad96 commented Nov 4, 2022 • edited

Summary

Related issue(s)

openshift-ci bot commented Nov 5, 2022

stevekuznetsov Nov 6, 2022

Choose a reason for hiding this comment

stevekuznetsov Nov 6, 2022

Choose a reason for hiding this comment

varshaprasad96 Nov 7, 2022

Choose a reason for hiding this comment

stevekuznetsov Nov 6, 2022

Choose a reason for hiding this comment

varshaprasad96 Nov 7, 2022

Choose a reason for hiding this comment

stevekuznetsov Nov 6, 2022

Choose a reason for hiding this comment

varshaprasad96 Nov 7, 2022

Choose a reason for hiding this comment

nrb commented Nov 7, 2022

varshaprasad96 commented Nov 7, 2022

nrb commented Nov 8, 2022

openshift-merge-robot commented Nov 22, 2022

ncdc commented Mar 6, 2023

varshaprasad96 commented Mar 7, 2023

kcp-ci-bot commented Apr 16, 2024

sttts commented Apr 17, 2024

varshaprasad96 commented Nov 4, 2022 •

edited