manage_hwtier_rbac.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "2e4a00b4-1909-443d-80c9-6e240efc1205",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Requirement already satisfied: pyyaml in /opt/conda/lib/python3.8/site-packages (6.0)\n"
     ]
    }
   ],
   "source": [
    "#Install Dependencies\n",
    "!pip install pyyaml\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "94315776-1ead-4df3-88b5-b473efa57db4",
   "metadata": {},
   "outputs": [],
   "source": [
    "import client.domino_utils as domino_utils"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "6b112185-75d8-4086-a01a-ddeb9b6c8cbc",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['integration-test', 'wadkars', 'hw-tier-1', 'test-user-1', 'test-org', 'elaine', 'ahmet']\n"
     ]
    }
   ],
   "source": [
    "#Domino users list\n",
    "user_list = domino_utils.get_user_names_list()\n",
    "print(user_list)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8374593c-0c87-4b0b-ac78-4141884762fa",
   "metadata": {},
   "outputs": [],
   "source": [
    "#Domino projects list\n",
    "projects_list = domino_utils.get_all_project_names()\n",
    "print(projects_list)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fec90b15-90ca-419d-9ce7-1022b27ac654",
   "metadata": {},
   "source": [
    "Manage you HW Tiers using the JSON below\n",
    "\n",
    "First note the `rules` section-\n",
    "\n",
    "- `description` - This is the error message that is applied to the workspace logs when the workspace launch fails if a not permitted user attempts to launch a workspace in using the hwtier described in the `hwtier_id`.\n",
    "\n",
    "- `projects` - The projects inside which the `hwtier_id` can be used to launch a workspace. If empty, it implies that the use of the `hwtier_id` is permitted in all projects for the permitted `users`.\n",
    "\n",
    "- `users` - The users who are permitted to launch a worksapce  in the permitted `projects`. If empty, all users are permitted to launch a workspace using the `hwtier_id` in the permitted projects.\n",
    "\n",
    "Next let us review the outer section of this JSON\n",
    "\n",
    "- `replacement_hw_tier` - Use the smallest HWTier here. The intent is that this mutation fails the workspace after it launches for large HWTiers. This attribute changes the POD definition to use the smallest possible HWTier to launch the workspace to prevent cost implications starting a workspace on a large hwtier only to fail the workspace. The intent of this mutation is to only use these HWTiers in exceptional circumstances. Hence it is possible that new nodes will spin to meet the capacity requirements of this HWTier. This results in unncessary costs.\n",
    "- `busybox_image` - The busybox image path to use\n",
    "- `command` - The path to the shell. The default values are good enough\n",
    "- `message_prefix` - The error message in the `description` is prefixed with this string. The intent is to help support to identify the root cause of why thie workspace launch failed so they can tell the customer that the mutation caused it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "d6383638-6216-4926-b253-b628e9393055",
   "metadata": {},
   "outputs": [],
   "source": [
    "##Update your policies here\n",
    "hwtier_policies={\n",
    "  \"replacement_hw_tier\": \"small-k8s\",\n",
    "  \"busybox_image\": \"busybox\",\n",
    "  \"command\" : [ \"/bin/sh\",\"-c\" ],\n",
    "  \"message_prefix\" : \"HWTIER-ACCESS-POLICY\",\n",
    "  \"rules\":[\n",
    "    {\n",
    "      \"description\": \"HWTier cannot be used by this user for this project\",\n",
    "      \"hwtier_id\": \"extra-large-k8s\",\n",
    "      \"projects\": [\"basavpr/quick-start\",\"test-user-2/quickstart\"],\n",
    "      \"users\": [\"basavpr2\",\"test-user-1\",\"test-user-3\"]\n",
    "    }\n",
    "  ]\n",
    "}\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "cee2935b-a77b-4424-a547-701cd0644ac0",
   "metadata": {},
   "outputs": [],
   "source": [
    "import json\n",
    "import sys\n",
    "import client.domsed_client as dc\n",
    "import client.domino_utils as domino_utils\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "b00ca42f-79f0-4841-b868-8d002443b94a",
   "metadata": {},
   "outputs": [],
   "source": [
    "##Templates- DO NOT MODIFY\n",
    "mutation = {\n",
    "  \"apiVersion\": \"apps.dominodatalab.com/v1alpha1\",\n",
    "  \"kind\": \"Mutation\",\n",
    "  \"metadata\": {\n",
    "    \"name\": \"restrict-hw-tier\"\n",
    "  },\n",
    "  \"rules\": []\n",
    "}\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "c7cc83e8-e4d6-4f37-85e1-8ba1773ae239",
   "metadata": {},
   "outputs": [],
   "source": [
    "mutation_rules_template={\n",
    "   \"containerImageRewriteRule\" : {\n",
    "         \"containerImageRewrite\":{\n",
    "            \"args\":[\n",
    "               \"echo HWTier-Restrict-Mutation- Use of this hardware tier is not permitted &2; exit 1;\"\n",
    "            ],\n",
    "            \"command\":[\n",
    "               \"/bin/sh\",\n",
    "               \"-c\"\n",
    "            ],\n",
    "            \"name\":\"run\",\n",
    "            \"newImage\":\"\",\n",
    "            \"originalImage\":\"\"\n",
    "         },\n",
    "         \"hardwareTierIdSelector\":[\n",
    "         ],         \n",
    "         \"matchBuilds\":False,\n",
    "      },\n",
    "      \"modifyHWTierRule\" : {\n",
    "         \"modifyHWTier\":{\n",
    "            \"hwtier_id\":\"\"\n",
    "         },\n",
    "         \"hardwareTierIdSelector\":[\n",
    "         ],\n",
    "         \"matchBuilds\":False,\n",
    "      }\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "78becc2e-b14d-4f18-87b8-1821eafcddb8",
   "metadata": {},
   "outputs": [],
   "source": [
    "replacement_tier = hwtier_policies['replacement_hw_tier']\n",
    "busybox_image = hwtier_policies['busybox_image']\n",
    "command = hwtier_policies['command']\n",
    "message_prefix = hwtier_policies['message_prefix']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "e2683cb3-89d5-4528-a6c7-5ebd63c0a358",
   "metadata": {},
   "outputs": [],
   "source": [
    "def resetSelectors(rule):\n",
    "    rule['notProjectSelector'] = []\n",
    "    rule['notUsernameSelector'] = []\n",
    "    rule['projectSelector'] = []\n",
    "    rule['usernameSelector'] = []\n",
    "    return rule"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "87c5344c-334f-4ba7-8316-59642ec9261e",
   "metadata": {},
   "outputs": [],
   "source": [
    "mutation_rules=[]\n",
    "\n",
    "for r in hwtier_policies[\"rules\"]:\n",
    "    container_image_rewrite_rule = mutation_rules_template['containerImageRewriteRule']\n",
    "    description = r['description']\n",
    "    container_image_rewrite_rule['containerImageRewrite']['command'] =hwtier_policies['command']\n",
    "    container_image_rewrite_rule['containerImageRewrite']['args']= [f\"echo {message_prefix}-{description} >&2; exit 1;\"]\n",
    "    container_image_rewrite_rule['containerImageRewrite']['newImage'] = busybox_image\n",
    "    container_image_rewrite_rule['hardwareTierIdSelector']=[r['hwtier_id']]\n",
    "    \n",
    "    \n",
    "    rule = container_image_rewrite_rule.copy()\n",
    "    rule['notProjectSelector'] = r['projects']\n",
    "    rule['notUsernameSelector'] = r['users']    \n",
    "    mutation_rules.append(rule)\n",
    "    \n",
    "    rule = container_image_rewrite_rule.copy()\n",
    "    rule['projectSelector'] = r['projects']\n",
    "    rule['notUsernameSelector'] = r['users']    \n",
    "    mutation_rules.append(rule)\n",
    "    \n",
    "    rule = container_image_rewrite_rule.copy()\n",
    "    rule['notProjectSelector'] = r['projects']\n",
    "    rule['usernameSelector'] = r['users']    \n",
    "    mutation_rules.append(rule)\n",
    "    \n",
    "    if('users' in r and len(r['users'])>0):        \n",
    "        modifyhwtier_rule = mutation_rules_template['modifyHWTierRule']\n",
    "        modifyhwtier_rule['modifyHWTier']['hwtier_id']=replacement_tier\n",
    "        modifyhwtier_rule['hardwareTierIdSelector']=[r['hwtier_id']]\n",
    "        \n",
    "        rule = modifyhwtier_rule.copy()\n",
    "        \n",
    "        rule['notProjectSelector'] = r['projects']\n",
    "        rule['notUsernameSelector'] = r['users']        \n",
    "        mutation_rules.append(rule)\n",
    "        \n",
    "        rule = modifyhwtier_rule.copy()\n",
    "        rule['projectSelector'] = r['projects']\n",
    "        rule['notUsernameSelector'] = r['users']    \n",
    "        mutation_rules.append(rule)\n",
    "        \n",
    "        rule = modifyhwtier_rule.copy()\n",
    "        rule['notProjectSelector'] = r['projects']\n",
    "        rule['usernameSelector'] = r['users']    \n",
    "        mutation_rules.append(rule)\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "6c2291b5-f58e-494a-a1c4-6e42ca4ac0b3",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "  \"apiVersion\": \"apps.dominodatalab.com/v1alpha1\",\n",
      "  \"kind\": \"Mutation\",\n",
      "  \"metadata\": {\n",
      "    \"name\": \"restrict-hw-tier\"\n",
      "  },\n",
      "  \"rules\": [\n",
      "    {\n",
      "      \"containerImageRewrite\": {\n",
      "        \"args\": [\n",
      "          \"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"\n",
      "        ],\n",
      "        \"command\": [\n",
      "          \"/bin/sh\",\n",
      "          \"-c\"\n",
      "        ],\n",
      "        \"name\": \"run\",\n",
      "        \"newImage\": \"busybox\",\n",
      "        \"originalImage\": \"\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"notProjectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"notUsernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"containerImageRewrite\": {\n",
      "        \"args\": [\n",
      "          \"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"\n",
      "        ],\n",
      "        \"command\": [\n",
      "          \"/bin/sh\",\n",
      "          \"-c\"\n",
      "        ],\n",
      "        \"name\": \"run\",\n",
      "        \"newImage\": \"busybox\",\n",
      "        \"originalImage\": \"\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"projectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"notUsernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"containerImageRewrite\": {\n",
      "        \"args\": [\n",
      "          \"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"\n",
      "        ],\n",
      "        \"command\": [\n",
      "          \"/bin/sh\",\n",
      "          \"-c\"\n",
      "        ],\n",
      "        \"name\": \"run\",\n",
      "        \"newImage\": \"busybox\",\n",
      "        \"originalImage\": \"\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"notProjectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"usernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"modifyHWTier\": {\n",
      "        \"hwtier_id\": \"small-k8s\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"notProjectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"notUsernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"modifyHWTier\": {\n",
      "        \"hwtier_id\": \"small-k8s\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"projectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"notUsernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"modifyHWTier\": {\n",
      "        \"hwtier_id\": \"small-k8s\"\n",
      "      },\n",
      "      \"hardwareTierIdSelector\": [\n",
      "        \"extra-large-k8s\"\n",
      "      ],\n",
      "      \"matchBuilds\": false,\n",
      "      \"notProjectSelector\": [\n",
      "        \"basavpr/quick-start\",\n",
      "        \"test-user-2/quickstart\"\n",
      "      ],\n",
      "      \"usernameSelector\": [\n",
      "        \"basavpr2\",\n",
      "        \"test-user-1\",\n",
      "        \"test-user-3\"\n",
      "      ]\n",
      "    }\n",
      "  ]\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "mutation[\"rules\"] = mutation_rules\n",
    "json_formatted_str = json.dumps(mutation, indent=2)\n",
    "print(json_formatted_str)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "c75430d7-6136-40ed-b5ad-da9adea2f0c3",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "2022-08-05 20:24:24,237 - domsed_client - WARNING - Publishing Mutation To Domsed\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Applied Mutation\n",
      "{\"apiVersion\":\"apps.dominodatalab.com/v1alpha1\",\"kind\":\"Mutation\",\"metadata\":{\"creationTimestamp\":\"2022-08-05T20:24:24Z\",\"generation\":1,\"managedFields\":[{\"apiVersion\":\"apps.dominodatalab.com/v1alpha1\",\"fieldsType\":\"FieldsV1\",\"fieldsV1\":{\"f:rules\":{}},\"manager\":\"OpenAPI-Generator\",\"operation\":\"Update\",\"time\":\"2022-08-05T20:24:24Z\"}],\"name\":\"restrict-hw-tier\",\"namespace\":\"domino-platform\",\"resourceVersion\":\"19193978\",\"uid\":\"2e03bafb-0e5a-43c5-be91-996995fbf3b7\"},\"rules\":[{\"containerImageRewrite\":{\"args\":[\"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"],\"command\":[\"/bin/sh\",\"-c\"],\"name\":\"run\",\"newImage\":\"busybox\",\"originalImage\":\"\"},\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"notProjectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"],\"notUsernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"]},{\"containerImageRewrite\":{\"args\":[\"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"],\"command\":[\"/bin/sh\",\"-c\"],\"name\":\"run\",\"newImage\":\"busybox\",\"originalImage\":\"\"},\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"notUsernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"],\"projectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"]},{\"containerImageRewrite\":{\"args\":[\"echo HWTIER-ACCESS-POLICY-HWTier cannot be used by this user for this project >&2; exit 1;\"],\"command\":[\"/bin/sh\",\"-c\"],\"name\":\"run\",\"newImage\":\"busybox\",\"originalImage\":\"\"},\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"notProjectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"],\"usernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"]},{\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"modifyHWTier\":{\"hwtier_id\":\"small-k8s\"},\"notProjectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"],\"notUsernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"]},{\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"modifyHWTier\":{\"hwtier_id\":\"small-k8s\"},\"notUsernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"],\"projectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"]},{\"hardwareTierIdSelector\":[\"extra-large-k8s\"],\"matchBuilds\":false,\"modifyHWTier\":{\"hwtier_id\":\"small-k8s\"},\"notProjectSelector\":[\"basavpr/quick-start\",\"test-user-2/quickstart\"],\"usernameSelector\":[\"basavpr2\",\"test-user-1\",\"test-user-3\"]}]}\n",
      "\n"
     ]
    }
   ],
   "source": [
    "dc.apply(mutation)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0223bf14-0924-4802-93b2-f754689da54d",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5fb53cf3-c772-4fb8-8137-457418cf3fcb",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}