Fixed RBAC permissions for CICD user

Fortify-Labs · Feb 5, 2021 · 3eabab7 · 3eabab7
1 parent 544e66f
commit 3eabab7
Show file tree

Hide file tree

Showing 4 changed files with 59 additions and 11 deletions.
diff --git a/devops/kubernetes/src/charts/cicd-user/cicdUser.ts b/devops/kubernetes/src/charts/cicd-user/cicdUser.ts
@@ -2,8 +2,8 @@ import { Chart, ChartProps } from "cdk8s";
 import { Construct } from "constructs";
 import {
 	KubeServiceAccount,
-	KubeRole,
 	KubeRoleBinding,
+	KubeClusterRole,
 } from "../../../imports/k8s";
 
 export class CICDUser extends Chart {
@@ -17,10 +17,9 @@ export class CICDUser extends Chart {
 			automountServiceAccountToken: false,
 		});
 
-		new KubeRole(this, "role", {
+		new KubeClusterRole(this, "role", {
 			metadata: {
 				name: "cicd-user-role",
-				namespace: "fortify",
 			},
 			rules: [
 				{
@@ -78,9 +77,9 @@ export class CICDUser extends Chart {
 			],
 		});
 
-		new KubeRoleBinding(this, "role-binding", {
+		new KubeRoleBinding(this, "role-binding-fortify", {
 			metadata: {
-				name: "cicd-user-global-rolebinding",
+				name: "cicd-user-fortify-rolebinding",
 				namespace: "fortify",
 			},
 			subjects: [
@@ -91,9 +90,28 @@ export class CICDUser extends Chart {
 				},
 			],
 			roleRef: {
-				kind: "Role",
+				apiGroup: "rbac.authorization.k8s.io",
+				kind: "ClusterRole",
 				name: "cicd-user-role",
+			},
+		});
+
+		new KubeRoleBinding(this, "role-binding-kube-system", {
+			metadata: {
+				name: "cicd-user-kube-system-rolebinding",
+				namespace: "kube-system",
+			},
+			subjects: [
+				{
+					kind: "ServiceAccount",
+					name: "cicd-user",
+					namespace: "fortify",
+				},
+			],
+			roleRef: {
 				apiGroup: "rbac.authorization.k8s.io",
+				kind: "ClusterRole",
+				name: "cicd-user-role",
 			},
 		});
 	}

diff --git a/services/historization/package-lock.json b/services/historization/package-lock.json
diff --git a/services/historization/package.json b/services/historization/package.json
@@ -1,6 +1,6 @@
 {
   "name": "historization",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "A historization service responsible for persisting info",
   "author": {
     "name": "Thomas Kosiewski"

diff --git a/services/historization/src/services/matchPersistor.ts b/services/historization/src/services/matchPersistor.ts
@@ -138,7 +138,17 @@ export class MatchPersistor {
 		for (const { id, level } of activeAlliances.sort(
 			(a, b) => a.id - b.id,
 		)) {
-			point = point.tag(`alliance-${id.toFixed(0)}`, level.toFixed(0));
+			if (
+				id !== null &&
+				id !== undefined &&
+				level !== null &&
+				level !== undefined
+			) {
+				point = point.tag(
+					`alliance-${id.toFixed(0)}`,
+					level.toFixed(0),
+				);
+			}
 		}
 
 		for (const item of equippedItems.sort()) {
@@ -180,7 +190,17 @@ export class MatchPersistor {
 		for (const { id, level } of activeAlliances.sort(
 			(a, b) => a.id - b.id,
 		)) {
-			point = point.tag(`alliance-${id.toFixed(0)}`, level.toFixed(0));
+			if (
+				id !== null &&
+				id !== undefined &&
+				level !== null &&
+				level !== undefined
+			) {
+				point = point.tag(
+					`alliance-${id.toFixed(0)}`,
+					level.toFixed(0),
+				);
+			}
 		}
 
 		return point;
@@ -212,7 +232,17 @@ export class MatchPersistor {
 		for (const { id, level } of activeAlliances.sort(
 			(a, b) => a.id - b.id,
 		)) {
-			point = point.tag(`alliance-${id.toFixed(0)}`, level.toFixed(0));
+			if (
+				id !== null &&
+				id !== undefined &&
+				level !== null &&
+				level !== undefined
+			) {
+				point = point.tag(
+					`alliance-${id.toFixed(0)}`,
+					level.toFixed(0),
+				);
+			}
 		}
 
 		return point;