Rename permissions

Co-authored-by: Vincenzo Scamporlino <vincenzos@spotify.com>
Signed-off-by: Dominika Zemanovicova <dzemanov@redhat.com>

.changeset/real-foxes-film.md

@@ -5,6 +5,6 @@
 '@backstage/plugin-kubernetes': minor
 ---
 
-**BREAKING** The `/clusters` endpoint is now protected by the `kubernetes.clusters` permission.
-**BREAKING** The `/services/:serviceId` endpoint is now protected by the `kubernetes.resources` permission.
-**BREAKING** The `/resources` endpoints are now protected by the `kubernetes.resources` permission.
+**BREAKING** The `/clusters` endpoint is now protected by the `kubernetes.clusters.read` permission.
+**BREAKING** The `/services/:serviceId` endpoint is now protected by the `kubernetes.resources.read` permission.
+**BREAKING** The `/resources` endpoints are now protected by the `kubernetes.resources.read` permission.

plugins/kubernetes-backend/src/routes/resourcesRoutes.ts

@@ -25,7 +25,7 @@ import { KubernetesObjectsProvider } from '@backstage/plugin-kubernetes-node';
 import { AuthService, HttpAuthService } from '@backstage/backend-plugin-api';
 import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 import { requirePermission } from '../auth/requirePermission';
-import { kubernetesResourcesPermission } from '@backstage/plugin-kubernetes-common';
+import { kubernetesResourcesReadPermission } from '@backstage/plugin-kubernetes-common';
 
 export const addResourceRoutesToRouter = (
   router: express.Router,
@@ -68,7 +68,7 @@ export const addResourceRoutesToRouter = (
   router.post('/resources/workloads/query', async (req, res) => {
     await requirePermission(
       permissionApi,
-      kubernetesResourcesPermission,
+      kubernetesResourcesReadPermission,
       httpAuth,
       req,
     );
@@ -86,7 +86,7 @@ export const addResourceRoutesToRouter = (
   router.post('/resources/custom/query', async (req, res) => {
     await requirePermission(
       permissionApi,
-      kubernetesResourcesPermission,
+      kubernetesResourcesReadPermission,
       httpAuth,
       req,
     );

plugins/kubernetes-backend/src/service/KubernetesBuilder.test.ts

@@ -795,8 +795,8 @@ metadata:
     expect(response.body).toMatchObject({
       permissions: [
         { type: 'basic', name: 'kubernetes.proxy', attributes: {} },
-        { type: 'basic', name: 'kubernetes.resources', attributes: {} },
-        { type: 'basic', name: 'kubernetes.clusters', attributes: {} },
+        { type: 'basic', name: 'kubernetes.resources.read', attributes: {} },
+        { type: 'basic', name: 'kubernetes.clusters.read', attributes: {} },
       ],
       rules: [],
     });

plugins/kubernetes-backend/src/service/KubernetesBuilder.ts

@@ -18,9 +18,9 @@ import { Config } from '@backstage/config';
 import {
   ANNOTATION_KUBERNETES_AUTH_PROVIDER,
   ANNOTATION_KUBERNETES_OIDC_TOKEN_PROVIDER,
-  kubernetesClustersPermission,
+  kubernetesClustersReadPermission,
   kubernetesPermissions,
-  kubernetesResourcesPermission,
+  kubernetesResourcesReadPermission,
 } from '@backstage/plugin-kubernetes-common';
 import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';
@@ -398,7 +398,7 @@ export class KubernetesBuilder {
     router.post('/services/:serviceId', async (req, res) => {
       await requirePermission(
         permissionApi,
-        kubernetesResourcesPermission,
+        kubernetesResourcesReadPermission,
         httpAuth,
         req,
       );
@@ -424,7 +424,7 @@ export class KubernetesBuilder {
     router.get('/clusters', async (req, res) => {
       await requirePermission(
         permissionApi,
-        kubernetesClustersPermission,
+        kubernetesClustersReadPermission,
         httpAuth,
         req,
       );

plugins/kubernetes-cluster/src/components/KubernetesClusterContent/KubernetesClusterContent.tsx

@@ -24,7 +24,7 @@ import {
   useKubernetesClusterError,
 } from '../KubernetesClusterErrorContext/KubernetesClusterErrorContext';
 import { WarningPanel } from '@backstage/core-components';
-import { kubernetesClustersPermission } from '@backstage/plugin-kubernetes-common';
+import { kubernetesClustersReadPermission } from '@backstage/plugin-kubernetes-common';
 import { RequirePermission } from '@backstage/plugin-permission-react';
 
 const ContentGrid = () => {
@@ -61,12 +61,12 @@ const ContentGrid = () => {
 export const KubernetesClusterContent = () => {
   return (
     <RequirePermission
-      permission={kubernetesClustersPermission}
+      permission={kubernetesClustersReadPermission}
       errorPage={
         <WarningPanel
           title="Permission required"
           message={`To view Kubernetes objects, contact your administrator to give you the
-                        '${kubernetesClustersPermission.name}' permission.`}
+                        '${kubernetesClustersReadPermission.name}' permission.`}
         />
       }
     >

plugins/kubernetes-common/report.api.md

@@ -318,7 +318,7 @@ export interface JobsFetchResponse {
 }
 
 // @public
-export const kubernetesClustersPermission: BasicPermission;
+export const kubernetesClustersReadPermission: BasicPermission;
 
 // @public (undocumented)
 export type KubernetesErrorTypes =
@@ -351,7 +351,7 @@ export interface KubernetesRequestBody {
 }
 
 // @public
-export const kubernetesResourcesPermission: BasicPermission;
+export const kubernetesResourcesReadPermission: BasicPermission;
 
 // @public (undocumented)
 export interface LimitRangeFetchResponse {

plugins/kubernetes-common/src/index.ts

@@ -25,8 +25,8 @@ export * from './catalog-entity-constants';
 export * from './certificate-authority-constants';
 export {
   kubernetesProxyPermission,
-  kubernetesClustersPermission,
-  kubernetesResourcesPermission,
+  kubernetesClustersReadPermission,
+  kubernetesResourcesReadPermission,
   kubernetesPermissions,
 } from './permissions';
 export * from './error-detection';

plugins/kubernetes-common/src/permissions.ts

@@ -27,17 +27,21 @@ export const kubernetesProxyPermission = createPermission({
 /** This permission is used to check access to the /resources and /services/:serviceId endpoints
  * @public
  */
-export const kubernetesResourcesPermission = createPermission({
-  name: 'kubernetes.resources',
-  attributes: {},
+export const kubernetesResourcesReadPermission = createPermission({
+  name: 'kubernetes.resources.read',
+  attributes: {
+    action: 'read',
+  },
 });
 
 /** This permission is used to check access to the /clusters endpoint
  * @public
  */
-export const kubernetesClustersPermission = createPermission({
-  name: 'kubernetes.clusters',
-  attributes: {},
+export const kubernetesClustersReadPermission = createPermission({
+  name: 'kubernetes.clusters.read',
+  attributes: {
+    action: 'read',
+  },
 });
 
 /**
@@ -46,6 +50,6 @@ export const kubernetesClustersPermission = createPermission({
  */
 export const kubernetesPermissions = [
   kubernetesProxyPermission,
-  kubernetesResourcesPermission,
-  kubernetesClustersPermission,
+  kubernetesResourcesReadPermission,
+  kubernetesClustersReadPermission,
 ];

plugins/kubernetes/src/RequireKubernetesPermissions.tsx

@@ -15,8 +15,8 @@
  */
 import React, { ReactNode } from 'react';
 import {
-  kubernetesClustersPermission,
-  kubernetesResourcesPermission,
+  kubernetesClustersReadPermission,
+  kubernetesResourcesReadPermission,
 } from '@backstage/plugin-kubernetes-common';
 import { usePermission } from '@backstage/plugin-permission-react';
 import { Content, Page, WarningPanel } from '@backstage/core-components';
@@ -29,10 +29,10 @@ export function RequireKubernetesPermissions(
   props: RequireKubernetesPermissionProps,
 ): JSX.Element | null {
   const kubernetesClustersPermissionResult = usePermission({
-    permission: kubernetesClustersPermission,
+    permission: kubernetesClustersReadPermission,
   });
   const kubernetesResourcesPermissionResult = usePermission({
-    permission: kubernetesResourcesPermission,
+    permission: kubernetesResourcesReadPermission,
   });
 
   if (
@@ -55,7 +55,7 @@ export function RequireKubernetesPermissions(
         <WarningPanel
           title="Permission required"
           message={`To view Kubernetes objects, contact your administrator to give you the 
-              '${kubernetesClustersPermission.name}' and '${kubernetesResourcesPermission.name}' permission.`}
+              '${kubernetesClustersReadPermission.name}' and '${kubernetesResourcesReadPermission.name}' permission.`}
         />
       </Content>
     </Page>