Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default not readonly & tolerate missing permissions when removing #1062

Merged
merged 2 commits into from
Apr 15, 2022
Merged

Default not readonly & tolerate missing permissions when removing #1062

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9b1a28d
Default to non-readonly roles for permission script 🔑
bobcatfish Apr 11, 2022
40eb2ae
Tolerate errors when removing permissions 👌
bobcatfish Apr 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions adjustpermissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@
(https://github.com/tektoncd/community/blob/main/governance.md#permissions-and-access)
to all GCP projects. It can also be used to remove permissions if needed.

The script can also be used to add "readonly" permission if the `--readonly` flag
is provided.

This script requires the `gcloud` command line tool and the python
`PyYaml` library.

Expand Down Expand Up @@ -57,9 +60,20 @@ def update_all_projects(users: List[str], projects: List[str], remove: bool, rea
for user in users:
for project in projects:
for role in roles:
subprocess.check_call(shlex.split(
"gcloud projects {} {} --member user:{} --role {}".format(command, project, user, role)
))
try:
subprocess.check_call(shlex.split(
"gcloud projects {} {} --member user:{} --role {}".format(command, project, user, role)
))
except subprocess.CalledProcessError as e:
# when removing permissions, if the permission doesn't exist an error will be returned - but that's okay
# since the goal is to remove it (and if the permissions list has new entries since the permissions
# were granted, this will be hit)
if remove:
print("unable to run {} for project {} user {} role {}: {}".format( command, project, user, role, e),
file=sys.stderr
)
else:
raise e


def parse_boskos_projects() -> List[str]:
Expand All @@ -77,7 +91,7 @@ def parse_boskos_projects() -> List[str]:
help="The names of the users' accounts, usually their email address, comma separated")
arg_parser.add_argument("--remove", action="store_true",
help="Use this flag to remove user access instead of adding it")
arg_parser.add_argument("--readonly", type=bool, default=True, help="Grant only read permissions")
arg_parser.add_argument("--readonly", type=bool, default=False, help="Grant only read permissions")
args = arg_parser.parse_args()

gcloud_required()
Expand Down