@rancher/shell 0.1.0

package/config/roles.ts

@@ -0,0 +1,365 @@
+export const SCOPED_RESOURCES = {
+  // With this hardcoded list, it will be easier to curate a more useful
+  // and human-understandable list of resources to choose from
+  // when creating a role. The list is not meant to be a
+  // comprehensive list, but a helpful guide.
+
+  // Cluster scoped roles and project scoped roles
+  // are intended to restrict users, so the resource list
+  // in the global role creation form includes the largest resource
+  // list.
+
+  // The cluster role creation form includes a subset of
+  // the global scoped list, and the project role creation form includes a
+  // subset of the cluster scoped list.
+
+  globalScopedApiGroups: {
+    // Global scoped resources are resources for
+    // Rancher's global apps, mainly Cluster
+    // Management and Continuous Delivery.
+    // A global role can include everything at the global
+    // scope, plus everything in the cluster and project scope.
+    'catalog.cattle.io': {
+      resources: [
+        'Apps',
+        'ClusterRepos',
+        'Operations',
+      ]
+    },
+    'cluster.x-k8s.io': {
+      resources: [
+        'Clusters'
+      ]
+    },
+    'fleet.cattle.io': {
+      resources: [
+        'Bundles',
+        'BundleDeployments',
+        'BundleNamespaceMappings',
+        'Clusters',
+        'ClusterGroups',
+        'ClusterRegistrations',
+        'ClusterRegistrationTokens',
+        'Contents',
+        'GitRepos',
+        'GitRepoRestrictions',
+      ],
+    },
+    'gitjob.cattle.io': {
+      resources: [
+        'GitJobs',
+      ]
+    },
+    'harvesterhci.io.management': {
+      resources: [
+        'Clusters'
+      ]
+    },
+    'management.cattle.io': {
+      // Resources provided by the Norman API.
+      resources: [
+        'APIServices',
+        'AuthConfigs',
+        'Catalogs',
+        'CatalogTemplates',
+        'CatalogTemplateVersions',
+        'CisBenchmarkVersions',
+        'CisConfigs',
+        'ClusterCatalogs',
+        'ClusterRegistrationTokens',
+        'ClusterRoleTemplateBindings',
+        'Clusters',
+        'ClusterScans',
+        'ClusterTemplates',
+        'ClusterTemplateRevisions',
+        'ComposeConfigs',
+        'DynamicSchemas',
+        'EtcdBackups',
+        'Features',
+        'FleetWorkspaces',
+        'GlobalRoles',
+        'GlobalRoleBindings',
+        'Groups',
+        'GroupMembers',
+        'KontainerDrivers',
+        'RkeK8sSystemImages',
+        'MonitorMetrics',
+        'Nodes',
+        'NodeDrivers',
+        'NodePools',
+        'NodeTemplates',
+        'PodSecurityPolicyTemplates',
+        'PodSecurityPolicyTemplateProjectBindings',
+        'Preferences',
+        'Projects',
+        'ProjectCatalogs',
+        'ProjectLoggings',
+        'ProjectMonitorGraphs',
+        'ProjectNetworkPolicies',
+        'ProjectRoleTemplateBindings',
+        'RkeAddons',
+        'RkeK8sServiceOptions',
+        'RoleTemplates',
+        'RoleTemplateBindings',
+        'SamlTokens',
+        'Settings',
+        'Templates',
+        'TemplateContents',
+        'TemplateVersions',
+        'Tokens',
+        'Users',
+        'UserAttributes',
+      ],
+      deprecatedResources: [
+        'ClusterAlerts', // Replaced by monitoring V2
+        'ClusterAlertGroups', // Replaced by monitoring V2
+        'ClusterAlertRules', // Replaced by monitoring V2
+        'ClusterLoggings', // Replaced by logging V2
+        'ClusterMonitorGraphs', // Replaced by monitoring V2
+        'GlobalDnses', // Deprecated along with legacy catalogs
+        'GlobalDnsProviders', // Deprecated along with legacy catalogs
+        'MultiClusterApps', // Replaced by Fleet
+        'MultiClusterAppRevisions', // Replaced by Fleet
+        'Notifiers', // Replaced by monitoring V2
+        'ProjectAlerts', // Replaced by monitoring V2
+        'ProjectAlertGroups', // Replaced by monitoring V2
+        'ProjectAlertRules', // Replaced by monitoring V2
+      ]
+    },
+    'provisioning.cattle.io': {
+      resources: [
+        'Clusters'
+      ]
+    }
+  },
+  clusterScopedApiGroups: {
+    // Cluster scoped resources are for non-namespaced
+    // resources at the cluster level, for example,
+    // storage resources.
+    // A cluster role can include everything at the cluster
+    // scope, plus everything in the project scope.
+    coreKubernetesApi: {
+      resources: [
+        // Core K8s API - Non-namespaced resources.
+        // These resources do not have an API group.
+        'APIGroups',
+        'Node',
+        'PersistentVolumes',
+        'ResourceQuotas',
+      ],
+      deprecatedResources: [
+        'ComponentStatuses', // A deprecated API that provided status of etcd, kube-scheduler, and kube-controller-manager components
+      ]
+    },
+    'admissionregistration.k8s.io': {
+      resources: [
+        'MutatingWebhookConfigurations',
+        'ValidatingWebhookConfigurations',
+      ],
+    },
+    'apiextensions.k8s.io': {
+      resources: [
+        'CustomResourceDefinitions',
+      ]
+    },
+    'apiregistration.k8s.io': {
+      resources: [
+        'APIServices'
+      ]
+    },
+    'certificates.k8s.io': {
+      resources: [
+        'CertificateSigningRequests'
+      ]
+    },
+    'rbac.authorization.k8s.io': {
+      resources: [
+        'ClusterRoles',
+        'ClusterRoleBindings',
+        'Roles',
+        'RoleBindings',
+      ]
+    },
+    'config.gatekeeper.sh': {
+      resources: [
+        'Configs'
+      ]
+    },
+    'scheduling.k8s.io': {
+      resources: [
+        'PriorityClasses',
+      ],
+    },
+    'storage.k8s.io': {
+      resources: [
+        'CSIDrivers',
+        'CSINodes',
+        'CSIStorageCapacitys',
+        'StorageClasses',
+        'VolumeAttachments',
+      ]
+    }
+  },
+  projectScopedApiGroups: {
+    // Project scoped resources include all other namespaced
+    // resources.
+    coreKubernetesApi: {
+      resources: [
+        // Core K8s API - Namespaced resources
+        // that are not in an API group.
+        'ConfigMaps',
+        'LimitRanges', // enumerates compute resource constraints in a project at the pod, container, image, image stream, and persistent volume claim level
+        'Namespaces',
+        'PersistentVolumeClaims',
+        'Pods',
+        'PodTemplates',
+        'ReplicationControllers',
+        'Secrets',
+        'Services',
+        'ServiceAccounts',
+      ],
+    },
+    apps: {
+      resources: [
+        'ControllerRevisions',
+        'DaemonSets',
+        'Deployments',
+        'ReplicaSets',
+        'StatefulSets',
+      ]
+    },
+    autoscaling: {
+      resources: [
+        'HorizontalPodAutoscalers',
+      ]
+    },
+    batch: {
+      resources: [
+        'CronJobs',
+        'Jobs',
+      ]
+    },
+    'cis.cattle.io': {
+      resources: [
+        'ClusterScans'
+      ]
+    },
+    'constraints.gatekeeper.sh': {
+      resources: [
+        'K8sAllowedRepos',
+        'K8sRequiredLabels',
+        'Constraints',
+      ]
+    },
+    'templates.gatekeeper.sh': {
+      resources: [
+        'ConstraintTemplates'
+      ]
+    },
+    'coordination.k8s.io': {
+      resources: [
+        'Leases',
+      ]
+    },
+    'events.k8s.io': {
+      resources: [
+        'Events',
+      ]
+    },
+    'monitoring.coreos.com': {
+      resources: [
+        'Alertmanagers',
+        'AlertmanagerConfigs',
+        'PodMonitors',
+        'Probes',
+        'Prometheuses',
+        'PrometheusRules',
+        'Routes',
+        'Receivers',
+        'ServiceMonitors',
+        'ThanosRulers'
+      ]
+    },
+    'networking.k8s.io': {
+      resources: [
+        'Ingresses',
+        'IngressClasses',
+        'NetworkPolicies',
+      ]
+    },
+    'io.k8s.api.discovery': {
+      resources: [
+        'Endpoints'
+      ]
+    },
+    'discovery.k8s.io': {
+      resources: [
+        'EndpointSlices',
+      ]
+    },
+    'node.k8s.io': {
+      resources: [
+        'RuntimeClasses',
+      ]
+    },
+    policy: {
+      resources: [
+        'PodDisruptionBudgets',
+        'PodSecurityPolicies',
+      ]
+    },
+    'project.cattle.io': {
+      resources: [
+        'Apps',
+        'AppRevisions'
+      ],
+      deprecatedResources: [
+        'Pipelines', // Replaced by Fleet
+        'PipelineExecutions', // Replaced by Fleet
+        'PipelineSettings', // Replaced by Fleet
+        'SourceCodeCredentials', // Replaced by Fleet
+        'SourceCodeProviderConfigs', // Replaced by Fleet
+        'SourceCodeRepositories', // Replaced by Fleet
+      ]
+    },
+    'logging.banzaicloud.io': {
+      resources: [
+        'ClusterFlows',
+        'ClusterOutputs',
+        'Flows',
+        'Loggings',
+        'Outputs',
+      ]
+    },
+    'install.istio.io': {
+      resources: [
+        'IstioOperators',
+      ]
+    },
+    'security.istio.io': {
+      resources: [
+        'AuthorizationPolicies',
+        'RequestAuthentications',
+        'PeerAuthentications',
+      ]
+    },
+    'status.gatekeeper.sh': {
+      resources: [
+        'ConstraintPodStatuses',
+        'ConstraintTemplatePodStatuses',
+      ]
+    },
+    'networking.istio.io': {
+      resources: [
+        'DestinationRules',
+        'EnvoyFilters',
+        'Gateways',
+        'ServiceEntries',
+        'Sidecars',
+        'VirtualServices',
+        'WorkloadEntries',
+        'WorkloadGroups'
+      ]
+    }
+  }
+};

package/config/schema.js

@@ -0,0 +1,32 @@
+import { SCHEMA } from '@shell/config/types';
+
+export const COLLECTION_TYPES = {
+  array: 'array',
+  map:   'map',
+};
+
+export const PRIMITIVE_TYPES = {
+  string:    'string',
+  multiline: 'multiline',
+  masked:    'masked',
+  password:  'password',
+  float:     'float',
+  int:       'int',
+  date:      'date',
+  blob:      'blob',
+  boolean:   'boolean',
+  json:      'json',
+  version:   'version',
+};
+
+export const PROTOCOLS = ['http', 'https'];
+
+export const WORKLOAD_SCHEMA = {
+  id:         'workload',
+  type:       SCHEMA,
+  attributes: {
+    kind:       'Workload',
+    namespaced: true
+  },
+  metadata: { name: 'workload' },
+};

package/config/secret.js

@@ -0,0 +1,15 @@
+export const SECRET_TYPES = {
+  OPAQUE:           'Opaque',
+  SERVICE_ACCT:     'kubernetes.io/service-account-token',
+  DOCKER:           'kubernetes.io/dockercfg',
+  DOCKER_JSON:      'kubernetes.io/dockerconfigjson',
+  BASIC:            'kubernetes.io/basic-auth',
+  SSH:              'kubernetes.io/ssh-auth',
+  TLS:              'kubernetes.io/tls',
+  BOOTSTRAP:        'bootstrap.kubernetes.io/token',
+  ISTIO_TLS:        'istio.io/key-and-cert',
+  HELM_RELEASE:     'helm.sh/release.v1',
+  FLEET_CLUSTER:    'fleet.cattle.io/cluster-registration-values',
+  CLOUD_CREDENTIAL: 'provisioning.cattle.io/cloud-credential',
+  RKE_AUTH_CONFIG:  'rke.cattle.io/auth-config'
+};

package/config/settings.js

@@ -0,0 +1,194 @@
+// Settings
+import { MANAGEMENT } from './types';
+
+// Adapted from: https://github.com/rancher/ui/blob/08c379a9529f740666a704b52522a468986c3520/lib/shared/addon/utils/constants.js#L564
+
+// Setting IDs
+export const SETTING = {
+  VERSION_RANCHER:                  'server-version',
+  VERSION_CLI:                      'cli-version',
+  VERSION_MACHINE:                  'machine-version',
+  VERSION_HELM:                     'helm-version',
+
+  CLI_URL:                          {
+    DARWIN:                         'cli-url-darwin',
+    WINDOWS:                        'cli-url-windows',
+    LINUX:                          'cli-url-linux',
+  },
+
+  API_HOST:                         'api-host',
+  CA_CERTS:                         'cacerts',
+
+  // Allow the local cluste to be hidden
+  HIDE_LOCAL_CLUSTER:               'hide-local-cluster',
+  AUTH_TOKEN_MAX_TTL_MINUTES:       'auth-token-max-ttl-minutes',
+  KUBECONFIG_GENERATE_TOKEN:        'kubeconfig-generate-token',
+  KUBECONFIG_TOKEN_TTL_MINUTES:     'kubeconfig-token-ttl-minutes',
+  ENGINE_URL:                       'engine-install-url',
+  ENGINE_ISO_URL:                   'engine-iso-url',
+  FIRST_LOGIN:                      'first-login',
+  INGRESS_IP_DOMAIN:                'ingress-ip-domain',
+  SERVER_URL:                       'server-url',
+  RKE_METADATA_CONFIG:              'rke-metadata-config',
+  TELEMETRY:                        'telemetry-opt',
+  EULA_AGREED:                      'eula-agreed',
+  AUTH_USER_INFO_MAX_AGE_SECONDS:   'auth-user-info-max-age-seconds',
+  AUTH_USER_SESSION_TTL_MINUTES:    'auth-user-session-ttl-minutes',
+  AUTH_USER_INFO_RESYNC_CRON:       'auth-user-info-resync-cron',
+  AUTH_LOCAL_VALIDATE_DESC:         'auth-password-requirements-description',
+  CLUSTER_TEMPLATE_ENFORCEMENT:     'cluster-template-enforcement',
+  UI_INDEX:                         'ui-index',
+  UI_DASHBOARD_INDEX:               'ui-dashboard-index',
+  UI_OFFLINE_PREFERRED:             'ui-offline-preferred',
+  SYSTEM_DEFAULT_REGISTRY:          'system-default-registry',
+  UI_ISSUES:                        'ui-issues',
+  PL:                               'ui-pl',
+  PL_RANCHER_VALUE:                 'rancher',
+  SUPPORTED:                        'has-support',
+  BANNERS:                          'ui-banners',
+  ISSUES:                           'ui-issues',
+  BRAND:                            'ui-brand',
+  LOGO_LIGHT:                       'ui-logo-light',
+  LOGO_DARK:                        'ui-logo-dark',
+  PRIMARY_COLOR:                    'ui-primary-color',
+  LINK_COLOR:                       'ui-link-color',
+  COMMUNITY_LINKS:                  'ui-community-links',
+  SYSTEM_NAMESPACES:                 'system-namespaces'
+};
+
+// These are the settings that are allowed to be edited via the UI
+export const ALLOWED_SETTINGS = {
+  [SETTING.CA_CERTS]:                       { kind: 'multiline', readOnly: true },
+  // [SETTING.CLUSTER_DEFAULTS]:            { kind: 'json' },
+  [SETTING.ENGINE_URL]:                     {},
+  [SETTING.ENGINE_ISO_URL]:                 {},
+  // [SETTING.PL]:                             {},
+  // [SETTING.ISSUES]:                         {},
+  [SETTING.INGRESS_IP_DOMAIN]:              {},
+  [SETTING.AUTH_USER_INFO_MAX_AGE_SECONDS]: {},
+  [SETTING.AUTH_USER_SESSION_TTL_MINUTES]:  {},
+  [SETTING.AUTH_TOKEN_MAX_TTL_MINUTES]:     {},
+  [SETTING.KUBECONFIG_GENERATE_TOKEN]:      { kind: 'boolean' },
+  [SETTING.KUBECONFIG_TOKEN_TTL_MINUTES]:   {},
+  [SETTING.AUTH_USER_INFO_RESYNC_CRON]:     {},
+  [SETTING.SERVER_URL]:                     { kind: 'url', canReset: true },
+  [SETTING.RKE_METADATA_CONFIG]:            { kind: 'json' },
+  // [SETTING.BANNERS]:                        { kind: 'json' },
+  [SETTING.SYSTEM_DEFAULT_REGISTRY]:        {},
+  [SETTING.UI_INDEX]:                       {},
+  [SETTING.UI_DASHBOARD_INDEX]:             {},
+  [SETTING.UI_OFFLINE_PREFERRED]:           {
+    kind:    'enum',
+    options: ['dynamic', 'true', 'false']
+  },
+  [SETTING.BRAND]:                          {},
+  [SETTING.CLUSTER_TEMPLATE_ENFORCEMENT]:   { kind: 'boolean' },
+
+  [SETTING.TELEMETRY]: {
+    kind:    'enum',
+    options: ['prompt', 'in', 'out']
+  },
+  [SETTING.HIDE_LOCAL_CLUSTER]: { kind: 'boolean' },
+};
+
+// harvester Settings ID
+export const HCI_SETTING = {
+  BACKUP_TARGET:                    'backup-target',
+  LOG_LEVEL:                        'log-level',
+  SERVER_VERSION:                   'server-version',
+  UI_INDEX:                         'ui-index',
+  UPGRADE_CHECKER_ENABLED:          'upgrade-checker-enabled',
+  UPGRADE_CHECKER_URL:              'upgrade-checker-url',
+  VLAN:                             'vlan',
+  UI_SOURCE:                        'ui-source',
+  HTTP_PROXY:                       'http-proxy',
+  ADDITIONAL_CA:                    'additional-ca',
+  OVERCOMMIT_CONFIG:                'overcommit-config',
+  CLUSTER_REGISTRATION_URL:         'cluster-registration-url',
+  DEFAULT_STORAGE_CLASS:            'default-storage-class',
+  VIP:                              'vip-pools',
+  SUPPORT_BUNDLE_TIMEOUT:           'support-bundle-timeout',
+  SUPPORT_BUNDLE_IMAGE:             'support-bundle-image',
+  VM_FORCE_RESET_POLICY:            'vm-force-reset-policy',
+  SSL_CERTIFICATES:                 'ssl-certificates',
+  SSL_PARAMETERS:                   'ssl-parameters',
+  SUPPORT_BUNDLE_NAMESPACES:        'support-bundle-namespaces',
+  AUTO_DISK_PROVISION_PATHS:        'auto-disk-provision-paths',
+  RANCHER_MONITORING:               'fleet-local/rancher-monitoring',
+  RELEASE_DOWNLOAD_URL:             'release-download-url'
+};
+
+export const HCI_ALLOWED_SETTINGS = {
+  [HCI_SETTING.BACKUP_TARGET]: { kind: 'json', from: 'import' },
+  [HCI_SETTING.LOG_LEVEL]:     {
+    kind:    'enum',
+    options: ['info', 'debug', 'trace']
+  },
+  [HCI_SETTING.VLAN]: {
+    kind: 'custom', from: 'import', alias: 'vlan'
+  },
+  [HCI_SETTING.SERVER_VERSION]:                   { readOnly: true },
+  [HCI_SETTING.UPGRADE_CHECKER_ENABLED]:          { kind: 'boolean' },
+  [HCI_SETTING.UPGRADE_CHECKER_URL]:              { kind: 'url' },
+  [HCI_SETTING.HTTP_PROXY]:                       { kind: 'json', from: 'import' },
+  [HCI_SETTING.ADDITIONAL_CA]:                    {
+    kind: 'multiline', canReset: true, from: 'import'
+  },
+  [HCI_SETTING.OVERCOMMIT_CONFIG]:                { kind: 'json', from: 'import' },
+  [HCI_SETTING.SUPPORT_BUNDLE_TIMEOUT]:           {},
+  [HCI_SETTING.SUPPORT_BUNDLE_IMAGE]:             { kind: 'json', from: 'import' },
+  [HCI_SETTING.VM_FORCE_RESET_POLICY]:            { kind: 'json', from: 'import' },
+  [HCI_SETTING.SSL_CERTIFICATES]:                 { kind: 'json', from: 'import' },
+  [HCI_SETTING.VIP]:                      {
+    kind: 'json', from: 'import', canReset: true
+  },
+  [HCI_SETTING.SSL_PARAMETERS]:                   {
+    kind: 'json', from: 'import', canReset: true
+  },
+  [HCI_SETTING.SUPPORT_BUNDLE_NAMESPACES]: { from: 'import', canReset: true },
+  [HCI_SETTING.AUTO_DISK_PROVISION_PATHS]: { canReset: true },
+  [HCI_SETTING.RANCHER_MONITORING]:                {
+    kind: 'custom', from: 'import', canReset: true, customFormatter: 'json', alias: 'harvester-monitoring'
+  },
+  [HCI_SETTING.RELEASE_DOWNLOAD_URL]: { kind: 'url' },
+};
+
+export const HCI_SINGLE_CLUSTER_ALLOWED_SETTING = {
+  [HCI_SETTING.UI_SOURCE]: {
+    kind:    'enum',
+    options: ['auto', 'external', 'bundled']
+  },
+  [HCI_SETTING.UI_INDEX]:                 { kind: 'url' },
+  [HCI_SETTING.CLUSTER_REGISTRATION_URL]: { kind: 'url' },
+};
+
+export const fetchOrCreateSetting = async(store, id, val, save = true) => {
+  let setting;
+
+  try {
+    setting = await store.dispatch('management/find', { type: MANAGEMENT.SETTING, id });
+  } catch {
+    const schema = store.getters['management/schemaFor'](MANAGEMENT.SETTING);
+    const url = schema.linkFor('collection');
+
+    setting = await store.dispatch('management/create', {
+      type: MANAGEMENT.SETTING, metadata: { name: id }, value: val, default: val || ''
+    });
+
+    if ( save ) {
+      await setting.save({ url });
+    }
+  }
+
+  return setting;
+};
+
+export const setSetting = async(store, id, val) => {
+  const setting = await fetchOrCreateSetting(store, id, val, false);
+
+  setting.value = val;
+
+  await setting.save();
+
+  return setting;
+};

package/config/system-namespaces.js

@@ -0,0 +1,15 @@
+// These are used to determine what is considered a User vs System namespace in the namespace picker,
+// along with the `isSystem` property of the project associated with the namespace, if in Rancher mode.
+export default [
+  'cattle-dashboards',
+  'cattle-global-data',
+  'cattle-system',
+  'gatekeeper-system',
+  'ingress-nginx',
+  'kube-node-lease',
+  'kube-public',
+  'kube-system',
+  'linkerd',
+  'security-scan',
+  'tekton-pipelines',
+];