Add namespaces permissions commands #71

zymap · 2019-09-23T03:23:39Z

Motivation

Add commands permissions
Add commands grant
Add commands revoke
Add commands grant-sub
Add commands revoke-sub

OUTPUT

permissions

USED FOR:
    This command is used for getting permissions configure data of a namespace.

REQUIRED PERMISSION:
    This command requires tenant admin permissions.

EXAMPLES:
    #Get permissions configure data of a namespace <tenant>/<namespace>
    pulsarctl namespaces permissions <tenant>/<namespace>

OUTPUT:
    #normal output
    {
      "<role>": [
        "<action>"
      ]
    }

    #the namespace name is not specified
    [✖]  only one argument is allowed to be used as a name

    #the namespace name is not in the format of <tenant>/<namespace>
    [✖]  The complete name of namespace is invalid. complete name : <namespace-complete-name>

    #the tenant name and(or) namespace name is empty
    [✖]  Invalid tenant or namespace. [<tenant>/<namespace>]

    #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%)  is allowed
    [✖]  Tenant name include unsupported special chars. tenant : [<namespace>]

    #the namespace name contains unsupported special chars. the  alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed
    [✖]  Namespace name include unsupported special chars. namespace : [<namespace>]

Usage: pulsarctl namespaces permissions [flags]

grant

USED FOR:
    This command is used for granting permissions to a client role on a namespace.

REQUIRED PERMISSION:
    This command requires tenant admin permissions.

EXAMPLES:
    #Grant permission <action> to the client role <role-name> on the namespace <namespace-name>
    pulsarctl namespaces grant --role <role-name> --actions <action> <namespace-name>

    #Grant permissions <actions> to the client role <role-name> on the namespace <namespace-name>
    pulsarctl namespaces grant --role <role-name> --actions <action-1> --actions <action-2> <namespace-name>

OUTPUT:
    #normal output
    Grant permissions <actions> to the client role <role-name> on the namespace <namespace-name> successfully

    #the namespace name is not specified
    [✖]  only one argument is allowed to be used as a name

    #the authorization is not enabled
    [✖]  code: 501 reason: Authorization is not enabled

    #the namespace name is not in the format of <tenant>/<namespace>
    [✖]  The complete name of namespace is invalid. complete name : <namespace-complete-name>

    #the tenant name and(or) namespace name is empty
    [✖]  Invalid tenant or namespace. [<tenant>/<namespace>]

    #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%)  is allowed
    [✖]  Tenant name include unsupported special chars. tenant : [<namespace>]

    #the namespace name contains unsupported special chars. the  alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed
    [✖]  Namespace name include unsupported special chars. namespace : [<namespace>]

Usage: pulsarctl namespaces grant [flags]

Grant Permissions flags:
      --role string       Client role to which grant permissions
      --actions strings   Actions to be granted (produce,consume,functions)

revoke

USED FOR:
    This command is used for revoking a client role permissions on a namespace.

REQUIRED PERMISSION:
    This command requires tenant admin permissions and broker has read-writer permissions on the zookeeper.

EXAMPLES:
    #Revoke the client role <role-name> on the namespace <namespace-name>
    pulsarctl namespaces revoke --role <role-name> <namespace-name>

OUTPUT:
    #normal output
    Revoke the client role <role-name> permissions on the namespace <namespace-name> successfully

    #the namespace name is not specified
    [✖]  only one argument is allowed to be used as a name

    #the namespace name is not in the format of <tenant>/<namespace>
    [✖]  The complete name of namespace is invalid. complete name : <namespace-complete-name>

    #the tenant name and(or) namespace name is empty
    [✖]  Invalid tenant or namespace. [<tenant>/<namespace>]

    #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%)  is allowed
    [✖]  Tenant name include unsupported special chars. tenant : [<namespace>]

    #the namespace name contains unsupported special chars. the  alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed
    [✖]  Namespace name include unsupported special chars. namespace : [<namespace>]

Usage: pulsarctl namespaces revoke [flags]

Revoke Permissions flags:
      --role string   Client role to which revoke permissions

grant-sub

USED FOR:
    This command is used for granting client roles to a subscription of a namespace.

REQUIRED PERMISSION:
    This command requires super-user permissions.

EXAMPLES:
    #Grant client roles <roles-name> to the subscription <subscription-name> of the namespace <namespace-name>
    pulsarctl namespaces grant-sub --role <role1-name> --role <role2-name> <namespace-name> <subscription-name>

OUTPUT:
    #normal output
    Grant client roles <role-name> to the subscription <subscription-name> of the namespace <namespace-name> successfully

    #the namespace name is not specified or the subscription name is not specified
    [✖]  need to specified namespace name and subscription name

    #the namespace name is not in the format of <tenant>/<namespace>
    [✖]  The complete name of namespace is invalid. complete name : <namespace-complete-name>

    #the tenant name and(or) namespace name is empty
    [✖]  Invalid tenant or namespace. [<tenant>/<namespace>]

    #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%)  is allowed
    [✖]  Tenant name include unsupported special chars. tenant : [<namespace>]

    #the namespace name contains unsupported special chars. the  alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed
    [✖]  Namespace name include unsupported special chars. namespace : [<namespace>]

Usage: pulsarctl namespaces grant-sub [flags]

Grant Subscription Permissions flags:
      --role strings   Client role to which grant permissions

revoke-sub

USED FOR:
    This command is used for revoking a client role permissions on a subscription of a namespace.

REQUIRED PERMISSION:
    This command requires tenant admin permissions and broker has read-writer permissions on the zookeeper.

EXAMPLES:
    #Revoke a client role <role-name> on the subscription <namespace-name> of the <namespace-name>
    pulsarctl namespaces revoke --role <role-name> <namespace-name> <subscription-name>

OUTPUT:
    #normal output
    Revoke the client role <role-name> permissions on the subscription <subscription-name> of the namespace <namespace-name> successfully

    #the namespace name is not specified or the subscription name is not specified
    [✖]  need to specified namespace name and subscription name

    #the namespace name is not in the format of <tenant>/<namespace>
    [✖]  The complete name of namespace is invalid. complete name : <namespace-complete-name>

    #the tenant name and(or) namespace name is empty
    [✖]  Invalid tenant or namespace. [<tenant>/<namespace>]

    #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%)  is allowed
    [✖]  Tenant name include unsupported special chars. tenant : [<namespace>]

    #the namespace name contains unsupported special chars. the  alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed
    [✖]  Namespace name include unsupported special chars. namespace : [<namespace>]

Usage: pulsarctl namespaces revoke-sub [flags]

Revoke Subscription Permissions flags:
      --role string   Client role to which revoke permissions

--- *Motivation* - Add commands `permissions` - Add commands `grant` - Add commands `revoke` - Add commands `grant-sub` - Add commands `revoke-sub`

sijie

Please go through all the output, examples to make sure they are fixed based on the new command group and the new comments.

pkg/ctl/namespace/grant_permission.go

sijie · 2019-09-24T06:21:44Z

pkg/ctl/namespace/grant_subscription_permission.go

+
+func GrantSubPermissionsCmd(vc *cmdutils.VerbCmd) {
+	var desc LongDescription
+	desc.CommandUsedFor = "This command is used for granting client roles to a subscription of a namespace."


Suggested change

desc.CommandUsedFor = "This command is used for granting client roles to a subscription of a namespace."

desc.CommandUsedFor = "This command is used for granting a client role to access subscriptions of a namespace."

Please fix all the examples and output

Because this command can grant some roles to a subscription. So update the description as granting client roles to access a subscription of a namespace is better?

pkg/ctl/namespace/grant_permission.go

pkg/ctl/namespace/grant_subscription_permission.go

sijie · 2019-10-03T04:35:44Z

please fix the CI

--- *Motivation* - Add commands `permissions` - Add commands `grant` - Add commands `revoke` - Add commands `grant-sub` - Add commands `revoke-sub` --- *OUTPUT* - permissions ``` USED FOR: This command is used for getting permissions configure data of a namespace. REQUIRED PERMISSION: This command requires tenant admin permissions. EXAMPLES: #Get permissions configure data of a namespace <tenant>/<namespace> pulsarctl namespaces permissions <tenant>/<namespace> OUTPUT: #normal output { "<role>": [ "<action>" ] } #the namespace name is not specified [✖] only one argument is allowed to be used as a name #the namespace name is not in the format of <tenant>/<namespace> [✖] The complete name of namespace is invalid. complete name : <namespace-complete-name> #the tenant name and(or) namespace name is empty [✖] Invalid tenant or namespace. [<tenant>/<namespace>] #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Tenant name include unsupported special chars. tenant : [<namespace>] #the namespace name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Namespace name include unsupported special chars. namespace : [<namespace>] Usage: pulsarctl namespaces permissions [flags] ``` - grant ``` USED FOR: This command is used for granting permissions to a client role on a namespace. REQUIRED PERMISSION: This command requires tenant admin permissions. EXAMPLES: #Grant permission <action> to the client role <role-name> on the namespace <namespace-name> pulsarctl namespaces grant --role <role-name> --actions <action> <namespace-name> #Grant permissions <actions> to the client role <role-name> on the namespace <namespace-name> pulsarctl namespaces grant --role <role-name> --actions <action-1> --actions <action-2> <namespace-name> OUTPUT: #normal output Grant permissions <actions> to the client role <role-name> on the namespace <namespace-name> successfully #the namespace name is not specified [✖] only one argument is allowed to be used as a name #the authorization is not enabled [✖] code: 501 reason: Authorization is not enabled #the namespace name is not in the format of <tenant>/<namespace> [✖] The complete name of namespace is invalid. complete name : <namespace-complete-name> #the tenant name and(or) namespace name is empty [✖] Invalid tenant or namespace. [<tenant>/<namespace>] #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Tenant name include unsupported special chars. tenant : [<namespace>] #the namespace name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Namespace name include unsupported special chars. namespace : [<namespace>] Usage: pulsarctl namespaces grant [flags] Grant Permissions flags: --role string Client role to which grant permissions --actions strings Actions to be granted (produce,consume,functions) ``` - revoke ``` USED FOR: This command is used for revoking a client role permissions on a namespace. REQUIRED PERMISSION: This command requires tenant admin permissions and broker has read-writer permissions on the zookeeper. EXAMPLES: #Revoke the client role <role-name> on the namespace <namespace-name> pulsarctl namespaces revoke --role <role-name> <namespace-name> OUTPUT: #normal output Revoke the client role <role-name> permissions on the namespace <namespace-name> successfully #the namespace name is not specified [✖] only one argument is allowed to be used as a name #the namespace name is not in the format of <tenant>/<namespace> [✖] The complete name of namespace is invalid. complete name : <namespace-complete-name> #the tenant name and(or) namespace name is empty [✖] Invalid tenant or namespace. [<tenant>/<namespace>] #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Tenant name include unsupported special chars. tenant : [<namespace>] #the namespace name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Namespace name include unsupported special chars. namespace : [<namespace>] Usage: pulsarctl namespaces revoke [flags] Revoke Permissions flags: --role string Client role to which revoke permissions ``` - grant-sub ``` USED FOR: This command is used for granting client roles to a subscription of a namespace. REQUIRED PERMISSION: This command requires super-user permissions. EXAMPLES: #Grant client roles <roles-name> to the subscription <subscription-name> of the namespace <namespace-name> pulsarctl namespaces grant-sub --role <role1-name> --role <role2-name> <namespace-name> <subscription-name> OUTPUT: #normal output Grant client roles <role-name> to the subscription <subscription-name> of the namespace <namespace-name> successfully #the namespace name is not specified or the subscription name is not specified [✖] need to specified namespace name and subscription name #the namespace name is not in the format of <tenant>/<namespace> [✖] The complete name of namespace is invalid. complete name : <namespace-complete-name> #the tenant name and(or) namespace name is empty [✖] Invalid tenant or namespace. [<tenant>/<namespace>] #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Tenant name include unsupported special chars. tenant : [<namespace>] #the namespace name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Namespace name include unsupported special chars. namespace : [<namespace>] Usage: pulsarctl namespaces grant-sub [flags] Grant Subscription Permissions flags: --role strings Client role to which grant permissions ``` - revoke-sub ``` USED FOR: This command is used for revoking a client role permissions on a subscription of a namespace. REQUIRED PERMISSION: This command requires tenant admin permissions and broker has read-writer permissions on the zookeeper. EXAMPLES: #Revoke a client role <role-name> on the subscription <namespace-name> of the <namespace-name> pulsarctl namespaces revoke --role <role-name> <namespace-name> <subscription-name> OUTPUT: #normal output Revoke the client role <role-name> permissions on the subscription <subscription-name> of the namespace <namespace-name> successfully #the namespace name is not specified or the subscription name is not specified [✖] need to specified namespace name and subscription name #the namespace name is not in the format of <tenant>/<namespace> [✖] The complete name of namespace is invalid. complete name : <namespace-complete-name> #the tenant name and(or) namespace name is empty [✖] Invalid tenant or namespace. [<tenant>/<namespace>] #the tenant name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Tenant name include unsupported special chars. tenant : [<namespace>] #the namespace name contains unsupported special chars. the alphanumeric (a-zA-Z0-9) and the special chars (-=:.%) is allowed [✖] Namespace name include unsupported special chars. namespace : [<namespace>] Usage: pulsarctl namespaces revoke-sub [flags] Revoke Subscription Permissions flags: --role string Client role to which revoke permissions ```

zymap added 2 commits September 23, 2019 11:16

Add namespaces permissions commands

a8fdd13

--- *Motivation* - Add commands `permissions` - Add commands `grant` - Add commands `revoke` - Add commands `grant-sub` - Add commands `revoke-sub`

Fix description

6773a77

zymap self-assigned this Sep 23, 2019

zymap requested a review from sijie September 23, 2019 08:05

zymap added the area/pulsar/namespaces label Sep 23, 2019

sijie requested changes Sep 24, 2019

View reviewed changes

zymap added 2 commits September 24, 2019 15:27

Address comments

9a141d3

Merge branch 'master' into namespace-permissions

916d037

zymap added 2 commits October 8, 2019 14:17

Merge branch 'master' into namespace-permissions

8116fca

Fix ci

ed7840b

sijie approved these changes Oct 10, 2019

View reviewed changes

sijie added this to the 0.0.1 milestone Oct 10, 2019

sijie merged commit 409736d into master Oct 10, 2019

sijie deleted the namespace-permissions branch October 10, 2019 10:41

sijie mentioned this pull request Oct 11, 2019

pulsarctl MVP #2

Closed

29 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add namespaces permissions commands #71

Add namespaces permissions commands #71

zymap commented Sep 23, 2019

sijie left a comment

sijie Sep 24, 2019

sijie Sep 24, 2019

zymap Sep 24, 2019

sijie commented Oct 3, 2019

	desc.CommandUsedFor = "This command is used for granting client roles to a subscription of a namespace."
	desc.CommandUsedFor = "This command is used for granting a client role to access subscriptions of a namespace."

Add namespaces permissions commands #71

Add namespaces permissions commands #71

Conversation

zymap commented Sep 23, 2019

sijie left a comment

Choose a reason for hiding this comment

sijie Sep 24, 2019

Choose a reason for hiding this comment

sijie Sep 24, 2019

Choose a reason for hiding this comment

zymap Sep 24, 2019

Choose a reason for hiding this comment

sijie commented Oct 3, 2019