prod{access,vider}: implement
Prodaccess/Prodvider allow issuing short-lived certificates for all SSO
users to access the kubernetes cluster.
Currently, all users get a personal-$username namespace in which they
have adminitrative rights. Otherwise, they get no access.
In addition, we define a static CRB to allow some admins access to
everything. In the future, this will be more granular.
We also update relevant documentation.
Change-Id: Ia18594eea8a9e5efbb3e9a25a04a28bbd6a42153
diff --git a/cluster/prodaccess/BUILD.bazel b/cluster/prodaccess/BUILD.bazel
new file mode 100644
index 0000000..5124ffc
--- /dev/null
+++ b/cluster/prodaccess/BUILD.bazel
@@ -0,0 +1,25 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go_default_library",
+ srcs = [
+ "kubernetes.go",
+ "prodaccess.go",
+ ],
+ importpath = "code.hackerspace.pl/hscloud/cluster/prodaccess",
+ visibility = ["//visibility:private"],
+ deps = [
+ "//cluster/certs:go_default_library",
+ "//cluster/prodvider/proto:go_default_library",
+ "@com_github_golang_glog//:go_default_library",
+ "@org_golang_google_grpc//:go_default_library",
+ "@org_golang_google_grpc//credentials:go_default_library",
+ "@org_golang_x_crypto//ssh/terminal:go_default_library",
+ ],
+)
+
+go_binary(
+ name = "prodaccess",
+ embed = [":go_default_library"],
+ visibility = ["//visibility:public"],
+)