Target namespace (#104)

* support target namespace
Peripli · Jul 28, 2020 · fc34959 · fc34959
1 parent 3e76180
commit fc34959
Show file tree

Hide file tree

Showing 9 changed files with 1,470 additions and 368 deletions.
diff --git a/charts/service-broker-proxy-k8s/templates/deployment.yaml b/charts/service-broker-proxy-k8s/templates/deployment.yaml
@@ -45,6 +45,8 @@ spec:
           value: {{ template "service-broker-proxy.fullname" . }}-regsecret
         - name: K8S_SECRET_NAMESPACE
           value: {{ .Release.Namespace }}
+        - name: K8S_TARGET_NAMESPACE
+          value: {{ .Values.targetNamespace }}
         - name: SM_USER
           valueFrom:
             secretKeyRef:

diff --git a/charts/service-broker-proxy-k8s/templates/rbac.yaml b/charts/service-broker-proxy-k8s/templates/rbac.yaml
@@ -10,7 +10,11 @@ metadata:
 rules:
 - apiGroups: ["servicecatalog.k8s.io"]
   resources:
+  {{- if .Values.targetNamespace }}
+  - servicebrokers
+  {{- else}}
   - clusterservicebrokers
+  {{- end}}
   verbs:
   - "*"
 
@@ -71,3 +75,47 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "service-broker-proxy.fullname" . }}
   namespace: {{ .Release.Namespace }}
+
+{{- if .Values.targetNamespace }}
+{{- if ne .Values.targetNamespace .Release.Namespace }}
+
+---
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  namespace: {{ .Values.targetNamespace }}
+  name: {{ template "service-broker-proxy.fullname" . }}-regsecretviewer
+  labels:
+    app: {{ template "service-broker-proxy.name" . }}
+    chart: {{ template "service-broker-proxy.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "delete", "update", "patch"]
+
+---
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "service-broker-proxy.fullname" . }}
+  namespace: {{ .Values.targetNamespace }}
+  labels:
+    app: {{ template "service-broker-proxy.name" . }}
+    chart: {{ template "service-broker-proxy.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  kind: Role
+  name: {{ template "service-broker-proxy.fullname" . }}-regsecretviewer
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "service-broker-proxy.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+
+{{- end}}
+{{- end}}
diff --git a/charts/service-broker-proxy-k8s/values.yaml b/charts/service-broker-proxy-k8s/values.yaml
@@ -23,6 +23,9 @@ sm:
   user: admin
   password: admin
 
+# targetNamespace is the namespace in which service brokers will be registered, if not set service brokers will be registered in cluster scope
+targetNamespace:
+
 ##
 # Security context
 securityContext: {}

diff --git a/pkg/k8s/api/api.go b/pkg/k8s/api/api.go
@@ -21,8 +21,22 @@ type KubernetesAPI interface {
 	UpdateClusterServiceBroker(broker *v1beta1.ClusterServiceBroker) (*v1beta1.ClusterServiceBroker, error)
 	// SyncClusterServiceBroker synchronize a cluster-wide visible service broker
 	SyncClusterServiceBroker(name string, retries int) error
-	// UpdateClusterServiceBrokerCredentials updates broker's credentials secret
-	UpdateClusterServiceBrokerCredentials(secret *v1core.Secret) (*v1core.Secret, error)
+
+	// CreateNamespaceServiceBroker creates namespace service broker
+	CreateNamespaceServiceBroker(broker *v1beta1.ServiceBroker, namespace string) (*v1beta1.ServiceBroker, error)
+	// DeleteNamespaceServiceBroker deletes a service broker in a namespace
+	DeleteNamespaceServiceBroker(name string, namespace string, options *v1.DeleteOptions) error
+	// RetrieveNamespaceServiceBrokers gets all service brokers in a namespace
+	RetrieveNamespaceServiceBrokers(namespace string) (*v1beta1.ServiceBrokerList, error)
+	// RetrieveNamespaceServiceBrokerByName gets a service broker in a namespace
+	RetrieveNamespaceServiceBrokerByName(name, namespace string) (*v1beta1.ServiceBroker, error)
+	// UpdateNamespaceServiceBroker updates a service broker in a namespace
+	UpdateNamespaceServiceBroker(broker *v1beta1.ServiceBroker, namespace string) (*v1beta1.ServiceBroker, error)
+	// SyncNamespaceServiceBroker synchronize a service broker in a namespace
+	SyncNamespaceServiceBroker(name, namespace string, retries int) error
+
+	// UpdateServiceBrokerCredentials updates broker's credentials secret
+	UpdateServiceBrokerCredentials(secret *v1core.Secret) (*v1core.Secret, error)
 	// CreateSecret creates a secret for broker's credentials
 	CreateSecret(secret *v1core.Secret) (*v1core.Secret, error)
 	// DeleteSecret deletes broker credentials secret