You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**CLOWarden** is a tool that manages the access to resources across multiple services with the initial focus on repositories in a GitHub organization.
4
-
CLOWarden allows you to grant access to an individual user or a defined team of users by submitting a PR to a file that defines access rules.
5
6
6
7
The CNCF initially used [Sheriff](https://github.com/cncf/sheriff) to manage access to resources. CLOWarden has replaced Sheriff with a system that suits better the needs of the CNCF.
7
8
8
-
CLOWarden supports a legacy configuration mode that allows using [a subset of the Sheriff's permissions configuration file](#configuration) and the [CNCF's people file](https://github.com/cncf/people/blob/main/people.json) to define users, teams and GitHub repositories (the same files currently used by CNCF at <https://github.com/cncf/people>).
9
-
10
9
## How it works
11
10
12
11
CLOWarden's main goal is to ensure that the resources' **desired state**, as defined in the configuration files, matches the **actual state** in the corresponding services. This is achieved by running *reconciliation* jobs, that can be triggered *on-demand* or *periodically*. These reconciliation jobs are in charge of applying the necessary changes to address the differences between the desired and actual state on each service, which is done by delegating some work on specialized *service handlers*.
@@ -31,9 +30,10 @@ Let's go through a full example to see how this would work in practice.
31
30
32
31
Our goal in this example will be to create a new team (named `team1`) with one maintainer and one member, as well as a new repository (named `repo1`). We want to give `team1` write permissions on `repo1`, and we'd also like to add a external collaborator, named `collaborator1`, with read permissions.
33
32
34
-
The first step will be to create a pull request to add the entries below to the configuration files
33
+
The first step will be to create a pull request to add the entries below to the configuration files:
35
34
36
-
(*This configuration intentionally introduces a typo so we can describe CLOWarden's PR validation checks -team1 is misspelled-*):
35
+
> [!WARNING]
36
+
> This configuration intentionally introduces a typo so we can describe CLOWarden's PR validation checks (team1 is misspelled).
37
37
38
38
```yaml
39
39
teams:
@@ -76,8 +76,6 @@ Now CLOWarden is happy with the changes proposed! This time, it also tried to he
76
76
77
77
Sometimes this may be easy to spot by just looking at a the diff on the PR. But on other occasions, depending on the changes applied, it can get trickier and be error prone, as just a single extra space or tabulation can have unintented consequences. So CLOWarden simplifies this by analyzing the changes itself and displaying them in an easy to read way as a comment on the PR.
78
78
79
-
Outside of the context of a PR it is possible to view an autdit log of the changes made see the [#Audit tool](Audit tool) below
Now that the changes are valid, the check has been updated to reflect the new status and the PR can be merged safely once the maintainers are ready. As soon as this happens, CLOWarden will create a reconciliation job and will apply the necessary changes so that the actual state in the services matches the new desired state defined in the configuration. Once the job is executed, a new comment will be posted on the PR with more details:
@@ -180,6 +178,8 @@ repositories:
180
178
visibility: public
181
179
```
182
180
181
+
### Some tips to avoid problems
182
+
183
183
It's important to keep in mind that..
184
184
185
185
- GitHub usernames are case sensitive
@@ -189,10 +189,53 @@ It's important to keep in mind that..
189
189
- It is possible to use the formation field in teams and at the same time explicitly define some team maintainers and members
190
190
- Teams formation is not recursive. If a subteam is also using formation, its subteams will be ignored
191
191
- GitHub repositories permissions granted using teams won't be effective until the team member has accepted the invitation to the organization
192
+
- Before renaming a GitHub username, make sure it's not used as a team maintainer in the configuration file
192
193
193
194
## Using CLOWarden in your organization
194
195
195
-
Although has been deployed for use in the CNCF GitHub org, CLOWarden is still in an experimental phase and breaking changes are expected, so we do not recommend its use in other production enviroments yet. Once it stabilizes, we'll publish some additional documentation to make it easier to run your own CLOWarden instance.
196
+
You can deploy your own CLOWarden instance by using [the Helm chart provided](https://artifacthub.io/packages/helm/clowarden/clowarden).
197
+
198
+
## CLI tool
199
+
200
+
CLOWarden includes a CLI tool that can be handy when adding new organizations to your CLOWarden deployment.
201
+
202
+
You can use it to:
203
+
204
+
- Validate the configuration in the repository provided
205
+
- Display changes between the actual state and the desired state
206
+
- Generate a configuration file from the actual state
207
+
208
+
> [!NOTE]
209
+
> This tool uses the GitHub API, which requires authentication. Please make sure you provide a GitHub token (with repo and read:org scopes) by setting the GITHUB_TOKEN environment variable.
210
+
211
+
### Building from source
212
+
213
+
You can build the CLOWarden CLI tool from the source by using [Cargo](https://rustup.rs), the Rust package manager.
[CLOWarden](https://clowarden.io) is a tool that automatically manages organizations users, teams and other resources across multiple services.
4
+
5
+
## Introduction
6
+
7
+
This chart bootstraps a CLOWarden deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
8
+
9
+
## Prerequisites
10
+
11
+
Before installing this chart, you need to [setup a GitHub application](https://docs.github.com/en/apps/creating-github-apps/creating-github-apps/creating-a-github-app). The application requires the following permissions [to be set](https://docs.github.com/en/apps/maintaining-github-apps/editing-a-github-apps-permissions):
12
+
13
+
Repository:
14
+
15
+
-**Administration**: *read/write*
16
+
-**Checks**: *read/write*
17
+
-**Contents**: *read*
18
+
-**Metadata**: *read*
19
+
-**Pull requests**: *read/write*
20
+
21
+
Organization:
22
+
23
+
-**Administration**: *read/write*
24
+
-**Members**: *read/write*
25
+
26
+
In addition to those permissions, it must also be subscribed to the following events:
27
+
28
+
-*Pull Request*
29
+
30
+
CLOWarden expects GitHub events to be sent to the `/webhook/github` endpoint. In the GitHub application, please enable `webhook` and set the target URL to your exposed endpoint (ie: <https://your-clowarden-deployment/webhook/github>). You will need to define a random secret for the webhook (you can use the following command to do it: `openssl rand -hex 32`). Please note your webhook secret, as well as the GitHub application ID and private key, as you'll need them in the next step when installing the chart.
31
+
32
+
Once your GitHub application is ready you can install it in the organizations you need.
33
+
34
+
## Installing the chart
35
+
36
+
Create a values file (`my-values.yaml`) that includes the configuration values required for your GitHub application:
37
+
38
+
```yaml
39
+
server:
40
+
githubApp:
41
+
# GitHub application ID
42
+
appId: 123456# Replace with your GitHub app ID
43
+
44
+
# GitHub application private key
45
+
privateKey: |-
46
+
-----BEGIN RSA PRIVATE KEY-----
47
+
...
48
+
YOUR_APP_PRIVATE_KEY
49
+
...
50
+
-----END RSA PRIVATE KEY-----
51
+
52
+
# GitHub application webhook secret
53
+
webhookSecret: "your-webhook-secret"
54
+
```
55
+
56
+
In addition to the GitHub application configuration, you can also add the organizations you'd like to use CLOWarden with at this point:
57
+
58
+
```yaml
59
+
organizations:
60
+
- # Name of the GitHub organization
61
+
name: org-name
62
+
63
+
# CLOWarden's GitHub application installation id
64
+
installationId: 12345678
65
+
66
+
# Repository where the configuration files are located
67
+
repository: .clowarden
68
+
69
+
# Branch to use in the configuration repository
70
+
branch: main
71
+
72
+
# Legacy mode configuration
73
+
legacy:
74
+
# Whether legacy mode is enabled or not (must be at the moment)
75
+
enabled: true
76
+
77
+
# Path of the Sheriff's permissions file
78
+
sheriffPermissionsPath: config.yaml
79
+
```
80
+
81
+
CLOWarden includes a CLI tool that can be handy when adding new organizations to your CLOWarden deployment. For more information please see the [repository's README file](https://github.com/cncf/clowarden?#cli-tool).
82
+
83
+
To install the chart with the release name `my-clowarden` run:
The command above deploys CLOWarden on the Kubernetes cluster using the default configuration values and the GitHub application configuration provided. Please see the [chart's default values file](https://github.com/cncf/clowarden/blob/main/charts/clowarden/values.yaml) for a list of all the configurable parameters of the chart and their default values.
91
+
92
+
## Uninstalling the chart
93
+
94
+
To uninstall the `my-clowarden` deployment run:
95
+
96
+
```bash
97
+
$ helm uninstall my-clowarden
98
+
```
99
+
100
+
This command removes all the Kubernetes components associated with the chart and deletes the release.
101
+
102
+
## How CLOWarden works
103
+
104
+
For more information about how CLOWarden works from a user's perspective please see the [repository's README file](https://github.com/cncf/clowarden#readme).
0 commit comments