Skip to content

feat: support admin & global permissions instance serviceaccount #302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
henrysachs merged 4 commits into from
May 26, 2026
Merged

feat: support admin & global permissions instance serviceaccount #302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
53f3c34
feat: support admin & global permissions instance serviceaccount
BoxBoxJason Apr 12, 2026
5ff0098
docs: update example
BoxBoxJason Apr 12, 2026
b24b62a
fix: unrequired observation update
BoxBoxJason Apr 13, 2026
b32c1c2
docs: fix example number
BoxBoxJason Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 37 additions & 1 deletion apis/cluster/instance/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 19 additions & 0 deletions apis/cluster/instance/v1alpha1/zz_serviceaccount_type.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions apis/common/v1alpha1/serviceaccount.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,4 +48,6 @@ type CommonServiceAccountObservation struct {
Username string `json:"username"`
// Email represents the email of the service account.
Email string `json:"email"`
// Admin represents whether the service account has admin privileges.
Admin bool `json:"admin"`
}
19 changes: 19 additions & 0 deletions apis/namespaced/instance/v1alpha1/serviceaccount_type.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,30 @@ import (
// ServiceAccountParameters defines the desired state of Gitlab Instance ServiceAccount
type ServiceAccountParameters struct {
commonv1alpha1.CommonServiceAccountParameters `json:",inline"`

// Admin represents whether the service account has admin privileges.
// +optional
Admin *bool `json:"admin,omitempty"`
// BaselinePermissions represents the minimal permissions level for all top level groups.
// WARNING: If this field is set to a value other than "no-access", the service account will be added to all groups with at least the specified access level. This can lead to unintended consequences if not used carefully.
// WARNING: This DOES NOT remove the service account from groups if changed from a higher access level to a lower access level. It only adds the service account to groups if changed from a lower access level to a higher access level.
// +optional
// +kubebuilder:validation:Enum=no-access;minimal-access;guest;planner;reporter;security-manager;developer;maintainer;owner
BaselinePermissions *string `json:"baselinePermissions,omitempty"`
}

// ServiceAccountObservation represents the observed state of the Gitlab Instance ServiceAccount
type ServiceAccountObservation struct {
commonv1alpha1.CommonServiceAccountObservation `json:",inline"`

// ServiceAccountBaselinePermissionsObservation represents the observed state of the service account's baseline permissions, which is used to determine if the service account is missing permissions for any top level groups or has the wrong permissions for any top level groups.
ServiceAccountBaselinePermissionsObservation `json:",inline"`
}

// ServiceAccountBaselinePermissionsObservation represents the observed state of the service account's baseline permissions, which is used to determine if the service account is missing permissions for any top level groups or has the wrong permissions for any top level groups.
type ServiceAccountBaselinePermissionsObservation struct {
MissingMemberShipGroups []int64 `json:"missingMembershipGroups,omitempty"`
WrongPermissionsGroups []int64 `json:"wrongPermissionsGroups,omitempty"`
}

// A ServiceAccountSpec defines the desired state of a GitLab instance service account.
Expand Down
38 changes: 37 additions & 1 deletion apis/namespaced/instance/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions examples/instance/serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,7 @@ spec:
username: example-service-account
# WARNING: field is immutable after creation
# email: example@example.com
# WARNING: dangerous field, it will grant admin permissions to the service account
# admin: true
# WARNING: dangerous field, it will grant developer permissions on all top level groups to the service account
# baselinePermissions: developer
5 changes: 5 additions & 0 deletions package/crds/groups.gitlab.crossplane.io_serviceaccounts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,10 @@ spec:
atProvider:
description: Represents the observed state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
email:
description: Email represents the email of the service account.
type: string
Expand All @@ -273,6 +277,7 @@ spec:
account.
type: string
required:
- admin
- email
- id
- name
Expand Down
5 changes: 5 additions & 0 deletions package/crds/groups.gitlab.m.crossplane.io_serviceaccounts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,10 @@ spec:
atProvider:
description: Represents the observed state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
email:
description: Email represents the email of the service account.
type: string
Expand All @@ -237,6 +241,7 @@ spec:
account.
type: string
required:
- admin
- email
- id
- name
Expand Down
35 changes: 35 additions & 0 deletions package/crds/instance.gitlab.crossplane.io_serviceaccounts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,26 @@ spec:
forProvider:
description: Defines the desired state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
baselinePermissions:
description: |-
BaselinePermissions represents the minimal permissions level for all top level groups.
WARNING: If this field is set to a value other than "no-access", the service account will be added to all groups with at least the specified access level. This can lead to unintended consequences if not used carefully.
WARNING: This DOES NOT remove the service account from groups if changed from a higher access level to a lower access level. It only adds the service account to groups if changed from a lower access level to a higher access level.
enum:
- no-access
- minimal-access
- guest
- planner
- reporter
- security-manager
- developer
- maintainer
- owner
type: string
email:
description: email represents the email of the service account.
type: string
Expand Down Expand Up @@ -177,21 +197,36 @@ spec:
atProvider:
description: Represents the observed state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
email:
description: Email represents the email of the service account.
type: string
id:
description: ID is the unique identifier of the service account.
format: int64
type: integer
missingMembershipGroups:
items:
format: int64
type: integer
type: array
name:
description: Name represents the display name of the service account.
type: string
username:
description: Username represents the user @ name of the service
account.
type: string
wrongPermissionsGroups:
items:
format: int64
type: integer
type: array
required:
- admin
- email
- id
- name
Expand Down
35 changes: 35 additions & 0 deletions package/crds/instance.gitlab.m.crossplane.io_serviceaccounts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,26 @@ spec:
forProvider:
description: Defines the desired state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
baselinePermissions:
description: |-
BaselinePermissions represents the minimal permissions level for all top level groups.
WARNING: If this field is set to a value other than "no-access", the service account will be added to all groups with at least the specified access level. This can lead to unintended consequences if not used carefully.
WARNING: This DOES NOT remove the service account from groups if changed from a higher access level to a lower access level. It only adds the service account to groups if changed from a lower access level to a higher access level.
enum:
- no-access
- minimal-access
- guest
- planner
- reporter
- security-manager
- developer
- maintainer
- owner
type: string
email:
description: email represents the email of the service account.
type: string
Expand Down Expand Up @@ -135,21 +155,36 @@ spec:
atProvider:
description: Represents the observed state of the ServiceAccount.
properties:
admin:
description: Admin represents whether the service account has
admin privileges.
type: boolean
email:
description: Email represents the email of the service account.
type: string
id:
description: ID is the unique identifier of the service account.
format: int64
type: integer
missingMembershipGroups:
items:
format: int64
type: integer
type: array
name:
description: Name represents the display name of the service account.
type: string
username:
description: Username represents the user @ name of the service
account.
type: string
wrongPermissionsGroups:
items:
format: int64
type: integer
type: array
required:
- admin
- email
- id
- name
Expand Down
6 changes: 6 additions & 0 deletions pkg/cluster/clients/groups/fake/zz_fake.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading