Skip to content

v0.16.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Jun 02:09
v0.16.0
89263e6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Team member-role and group access rules (butleradm)

The butleradm team group gains four verbs, completing CLI parity with the console for Team access management. Previously the CLI could add and remove members but could not change a member's role or manage group access rules.

butleradm team update-member-role NAME --email E --role admin|operator|viewer
butleradm team add-group NAME --group G --role R [--identity-provider IDP]
butleradm team update-group-role NAME --group G --role R [--identity-provider IDP]
butleradm team remove-group NAME --group G [--identity-provider IDP]
Verb What it does
update-member-role Change an existing member's role
add-group Add a group-to-role access rule
update-group-role Change a group rule's role
remove-group Remove a group rule

CRD-direct, status-preserving

All four edit Team.spec.access directly, mirroring the existing add-member and remove-member: Get the Team, change the targeted entry in the users or groups list, and Update the same object. Because the Update carries the same fetched object, the controller-managed status and the resourceVersion are preserved without a separate merge step.

The user identifier in spec.access.users is the name field, which holds the email.

Group rules are identified by name plus optional identity provider

A group rule can be scoped to a single IdP with --identity-provider, or left unscoped to match a group name from any IdP. When more than one rule shares a name and no --identity-provider is given, update-group-role and remove-group error and ask which one to act on, rather than editing the wrong rule.

The referenced identity provider is not validated to exist when adding a rule (the apiserver does not require it); a convenience check may be added later.

Validation

The full lifecycle was exercised end to end against butler-beta: update-member-role (status conditions and resourceVersion preserved against the real apiserver), add-group, update-group-role, the multi-rule ambiguity guard (errored without mutating), remove-group, and cleanup to pre-state.

Assets 9
Loading