search

janus-idp / backstage-plugins

Plugins for Backstage
https://janus-idp.io
Apache License 2.0
125 stars 127 forks source link

feat(quay): add permissions support for quay plugin #1851

Open karthikjeeyar opened 5 days ago

karthikjeeyar commented 5 days ago

Fixes:

https://issues.redhat.com/browse/RHIDP-1532

Description:

This PR adds support for RBAC permission in quay plugin. quay.view.read Permission allows the user view the quay plugin components.

Screenshots:

Without Permission:

No_permission_alert

With permission:

Quay_tag_details

Quay_repository

How to test:

  1. Configure the Quay plugin and add Github integration.

  2. Create a policy file rbac.csv for the permission policies

    
g, user:default/<YOUR_USERNAME>, role:default/quay-viewer

p, role:default/quay-viewer, quay.view.read, read, allow

p, role:default/quay-viewer, catalog-entity.read, read, allow
p, role:default/quay-viewer, catalog-entity.create, create, allow

3. Configure the RBAC Backend plugin to include the quay permission.

  ```permission:
    enabled: true
    rbac:
      policies-csv-file: ../<PATH>/<TO>/<CSV>/rbac-policy.csv
      policyFileReload: true
  1. Annotate the catalog component to include quay image registry
    'quay.io/repository-slug': quayadmin/my-quarkus-app
  1. Register the component and view the image registry (quay) tab to see the image tags working.
  2. Now deny the quay.view.read permission from the rbac.csv file and wait for the application to auto-reload. you should see the Permission required alert.

Unit tests:

 PASS  src/components/QuayTagPage/QuayTagPage.test.tsx
  QuayTagPage
    ✓ should render permission alert when user does not have view permission (46 ms)
 PASS  src/components/QuayRepository/QuayRepository.test.tsx
  QuayRepository
    ✓ should render permission alert when user does not have view permission (59 ms)

cc: @kim-tsao @rohitkrai03 @nickboldt @invincibleJai

openshift-ci[bot] commented 5 days ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign kadel for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/janus-idp/backstage-plugins/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment