feat(controller,api): Implement break-the-glass functionality#1959
Open
bakito wants to merge 6 commits into
Open
feat(controller,api): Implement break-the-glass functionality#1959bakito wants to merge 6 commits into
bakito wants to merge 6 commits into
Conversation
bakito
force-pushed
the
break-the-glass
branch
10 times, most recently
from
June 9, 2026 18:07
6043d3a to
95e6c74
Compare
bakito
changed the title
bakito
force-pushed
the
break-the-glass
branch
2 times, most recently
from
June 9, 2026 18:13
2932d10 to
9306b18
Compare
bakito
force-pushed
the
break-the-glass
branch
12 times, most recently
from
June 12, 2026 11:16
19cb9c9 to
49f0f89
Compare
bakito
force-pushed
the
break-the-glass
branch
4 times, most recently
from
June 28, 2026 11:40
4a6e154 to
538c2c6
Compare
Comment on lines
+415
to
+419
| // Apply the object to the cluster | ||
| _, err = controllerutil.CreateOrUpdate(ctx, r.Client, obj, func() error { | ||
| // CreateOrUpdate re-fetches the live object before running this function, so any | ||
| // metadata that must be enforced needs to be applied here as well. | ||
| if !br.Status.Active.ActiveUntil.IsZero() { |
Comment on lines
+309
to
+311
| if br.Status.KeepUntil.Time.IsZero() || time.Until(br.Status.KeepUntil.Time) <= 0 { | ||
| return nil | ||
| } |
Comment on lines
+53
to
+60
| switch { | ||
| case app.Duration != nil && app.Duration.Duration != 0: | ||
| effectiveDurationStr = app.Duration.Duration.String() | ||
| case br.Spec.Duration != nil && br.Spec.Duration.Duration != 0: | ||
| effectiveDurationStr = br.Spec.Duration.Duration.String() | ||
| case br.Status.Template != nil && br.Status.Template.DefaultDuration != nil && br.Status.Template.DefaultDuration.Duration != 0: | ||
| effectiveDurationStr = br.Status.Template.DefaultDuration.Duration.String() | ||
| } |
Comment on lines
+43
to
+45
| Items: breaktheglass.TemplateItems{ | ||
| "cm": {ManifestTemplate: runtime.RawExtension{Object: &corev1.ConfigMap{}}}, | ||
| }, |
Comment on lines
+8
to
+11
| package breaktheglass | ||
|
|
||
| import () | ||
|
|
Comment on lines
+53
to
+60
| switch { | ||
| case app.Duration != nil && app.Duration.Duration != 0: | ||
| effectiveDurationStr = app.Duration.Duration.String() | ||
| case br.Spec.Duration != nil && br.Spec.Duration.Duration != 0: | ||
| effectiveDurationStr = br.Spec.Duration.Duration.String() | ||
| case br.Status.Template != nil && br.Status.Template.DefaultDuration != nil && br.Status.Template.DefaultDuration.Duration != 0: | ||
| effectiveDurationStr = br.Status.Template.DefaultDuration.Duration.String() | ||
| } |
Comment on lines
+69
to
+72
| ) (err error) { | ||
| if reason == "" { | ||
| reason = "Access request approved" | ||
| } |
Signed-off-by: bakito <github@bakito.ch>
Comment on lines
+124
to
+128
| func (br *BreakRequest) ActiveRequest(entity *breaktheglass.AccessEntity) (err error) { | ||
| now := metav1.Now() | ||
|
|
||
| if err := br.transitionRequestPhase( | ||
| RequestPhaseActive, |
Comment on lines
+294
to
+299
| // Prevent duplicate condition entries of the same type | ||
| for _, cond := range br.Status.Conditions { | ||
| if RequestPhase(cond.Type) == newPhase { | ||
| return nil | ||
| } | ||
| } |
Comment on lines
66
to
+67
| # Create a KinD cluster if not already created | ||
| $ make dev-cluster | ||
| $ make dev-build dev-install-deps |
Signed-off-by: bakito <github@bakito.ch>
Comment on lines
+75
to
+79
| mocks: func(cl *mc.MockClient, scl *mc.MockSubResourceWriter) { | ||
| cl.EXPECT().Get(gm.Any(), gm.Any(), matchBr).Return(nil) | ||
| cl.EXPECT().Get(gm.Any(), gm.Any(), matchBrt).Return(nil) | ||
| scl.EXPECT().Update(gm.Any(), matchBr, gm.Any()).Return(nil) | ||
| }, |
Comment on lines
+111
to
+114
| mocks: func(cl *mc.MockClient, scl *mc.MockSubResourceWriter) { | ||
| cl.EXPECT().Get(gm.Any(), gm.Any(), matchBr).Return(nil) | ||
| scl.EXPECT().Update(gm.Any(), matchBr, gm.Any()).Return(nil) | ||
| }, |
Comment on lines
+162
to
+167
| mocks: func(cl *mc.MockClient, scl *mc.MockSubResourceWriter) { | ||
| cl.EXPECT().Get(gm.Any(), gm.Any(), matchBr).Return(nil) | ||
| cl.EXPECT().Get(gm.Any(), gm.Any(), matchUs).Return(nil) | ||
| cl.EXPECT().Update(gm.Any(), matchUs, gm.Any()).Return(nil) | ||
| scl.EXPECT().Update(gm.Any(), matchBr, gm.Any()).Return(nil) | ||
| }, |
Comment on lines
+37
to
+40
| Example: ` | ||
| # interactive review | ||
| capsule review grant-admin --namespace default | ||
|
|
Comment on lines
+40
to
+44
|
|
||
| # non-interactive approve/deny | ||
| capsule review grant-admin --namespace default --approve | ||
| capsule review grant-admin --namespace default --deny | ||
| `, |
Comment on lines
+17
to
+20
| Example: ` | ||
| # activate an existing BreakRequest | ||
| capsule activate grant-admin --namespace default | ||
| `, |
Comment on lines
+17
to
+20
| Example: ` | ||
| # expire an existing BreakRequest | ||
| capsule expire grant-admin --namespace default | ||
| `, |
Signed-off-by: bakito <github@bakito.ch>
Comment on lines
+416
to
+420
| _, err = controllerutil.CreateOrUpdate(ctx, r.Client, obj, func() error { | ||
| // CreateOrUpdate re-fetches the live object before running this function, so any | ||
| // metadata that must be enforced needs to be applied here as well. | ||
| if !br.Status.Active.ActiveUntil.IsZero() { | ||
| ann := obj.GetAnnotations() |
Comment on lines
+128
to
+145
| if err := br.transitionRequestPhase( | ||
| RequestPhaseActive, | ||
| "Access request activated", | ||
| "ActivatedBySystem", | ||
| now, | ||
| entity, | ||
| ); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if br.Status.Active == nil { | ||
| br.Status.Active = &ActivePeriod{} | ||
| } | ||
|
|
||
| tpl := br.Status.Template | ||
| if tpl == nil { | ||
| return fmt.Errorf("template not set") | ||
| } |
Comment on lines
+37
to
+44
| Example: ` | ||
| # interactive review | ||
| capsule review grant-admin --namespace default | ||
|
|
||
| # non-interactive approve/deny | ||
| capsule review grant-admin --namespace default --approve | ||
| capsule review grant-admin --namespace default --deny | ||
| `, |
Comment on lines
+88
to
+98
| // For OAS 3.1: https://json-schema.org/draft/2020-12/schema | ||
| meta := "https://json-schema.org/draft/2020-12/schema" | ||
|
|
||
| c := jsonschema.NewCompiler() | ||
| if err := c.AddResource( | ||
| "meta.json", | ||
| bytes.NewReader([]byte(`{"$ref":"`+meta+`"}`)), | ||
| ); err != nil { | ||
| return err | ||
| } | ||
| // Compile the candidate schema using the chosen meta-schema |
Comment on lines
+93
to
+104
| func y2j(in string) []byte { | ||
| m := make(map[string]any) | ||
| err := yaml.Unmarshal([]byte(in), &m) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| b, err := json.Marshal(m) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| return b | ||
| } |
Comment on lines
+125
to
+146
| func (br *BreakRequest) ActiveRequest(entity *breaktheglass.AccessEntity) (err error) { | ||
| now := metav1.Now() | ||
|
|
||
| if err := br.transitionRequestPhase( | ||
| RequestPhaseActive, | ||
| "Access request activated", | ||
| "ActivatedBySystem", | ||
| now, | ||
| entity, | ||
| ); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if br.Status.Active == nil { | ||
| br.Status.Active = &ActivePeriod{} | ||
| } | ||
|
|
||
| tpl := br.Status.Template | ||
| if tpl == nil { | ||
| return fmt.Errorf("template not set") | ||
| } | ||
|
|
Comment on lines
+37
to
+44
| Example: ` | ||
| # interactive review | ||
| capsule review grant-admin --namespace default | ||
|
|
||
| # non-interactive approve/deny | ||
| capsule review grant-admin --namespace default --approve | ||
| capsule review grant-admin --namespace default --deny | ||
| `, |
Comment on lines
+17
to
+20
| Example: ` | ||
| # activate an existing BreakRequest | ||
| capsule activate grant-admin --namespace default | ||
| `, |
Comment on lines
+17
to
+20
| Example: ` | ||
| # expire an existing BreakRequest | ||
| capsule expire grant-admin --namespace default | ||
| `, |
Signed-off-by: bakito <github@bakito.ch>
Comment on lines
+21
to
+29
| // InitializeFromTemplate Copies all relevant values from the Template. | ||
| func (br *BreakRequest) InitializeFromTemplate(brt *BreakRequestTemplate) { | ||
| br.Status.Template = &TemplateProperties{ | ||
| Templates: brt.Spec.Templates, | ||
| DefaultDuration: brt.Spec.DefaultDuration, | ||
| MaxDuration: brt.Spec.MaxDuration, | ||
| KeepFor: brt.Spec.KeepFor, | ||
| } | ||
| } |
Comment on lines
+24
to
+28
| for i, tpl := range tis { | ||
| if _, err := validateTemplate(tpl.Raw); err != nil { | ||
| return fmt.Errorf("template %d is invalid: %w", i, err) | ||
| } | ||
| } |
Comment on lines
+37
to
+44
| Example: ` | ||
| # interactive review | ||
| capsule break-the-glass review grant-admin --namespace default | ||
|
|
||
| # non-interactive approve/deny | ||
| capsule review grant-admin --namespace default --approve | ||
| capsule review grant-admin --namespace default --deny | ||
| `, |
Comment on lines
+124
to
+145
| // ActiveRequest Activates the BreakRequest, allowing the subject to access the requested resources. | ||
| func (br *BreakRequest) ActiveRequest(entity *breaktheglass.AccessEntity) (err error) { | ||
| now := metav1.Now() | ||
|
|
||
| if err := br.transitionRequestPhase( | ||
| RequestPhaseActive, | ||
| "Access request activated", | ||
| "ActivatedBySystem", | ||
| now, | ||
| entity, | ||
| ); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if br.Status.Active == nil { | ||
| br.Status.Active = &ActivePeriod{} | ||
| } | ||
|
|
||
| tpl := br.Status.Template | ||
| if tpl == nil { | ||
| return fmt.Errorf("template not set") | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Open points to discuss: