Add commands for manage users groups and access by Jabejixo · Pull Request #339 · deckhouse/deckhouse-cli

Jabejixo · 2026-04-27T07:16:18Z

Description

New d8 iam command tree for managing local users, groups, and access grants. Five top-level subcommands under internal/iam/:

d8 iam user — create / delete / reset-password / reset2fa / lock / unlock.
d8 iam group — create / delete / add-member / remove-member.
d8 iam access — grant / revoke.
d8 iam get — user, group, rule.
d8 iam list — users|user, groups|group, rules|rule.

Read verbs are top-level (d8 iam get user alice, d8 iam list users), not per-domain wrappers.

Subjects are positional. grant / revoke take -n/--namespace (repeatable, AR) or --scope cluster|all-namespaces|labels=K=V[,K2=V2,...] (CAR with namespaceSelector.labelSelector). Capabilities (--allow-scale, --port-forwarding) compose with any scope. d8-managed grants get a deterministic name, so grant / revoke are idempotent.

Password input is unified across user create and user reset-password: interactive (default), --password-stdin, --generate-password, or --password-hash. The CLI handles the format difference between User.spec.password (base64-bcrypt) and UserOperation.spec.resetPassword.newPasswordHash (raw bcrypt).

Shell completion covers command names, resource names, namespaces, access levels, scope values, rule refs, and output formats. Common k8s helpers (PrintObject, NewDynamicClient, AddOutputFlag, CompleteResourceNames, ...) live in internal/utilk8s/. The previously top-level d8 user was moved under d8 iam user.

Why do we need it, and what problem does it solve?

Managing users, groups, and access in Deckhouse today means hand-crafting User, Group, AuthorizationRule, and ClusterAuthorizationRule CRs and applying them via kubectl. There is no first-class CLI for inventory, "who has access to what", or safe revocation.

d8 iam provides:

a single discoverable command tree with consistent flag semantics;
effective-access inventory: iam list users|groups (aggregated table) and iam get user|group <name> (direct grants, transitive group membership, inherited grants, effective summary, warnings for cycles / orphaned members / manually maintained rules), with SuperAdmin wildcard capabilities surfaced as implicit;
iam list rules / iam get rule with reverse lookup of subjects to local User / Group CRs;
idempotent grant / revoke

Why do we need it in the patch release (if we do)?

Not necessarily.

Changelog entries

section: deckhouse-cli
type: feature
summary: Add `d8 iam` command tree for managing local users, groups, and access grants

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

AlwxSin

There are lack of some test scenarios:

no grant -> revoke round-trip
no remove-member tests
no tests for UserOperation creation
no tests for group create/delete

AlwxSin · 2026-04-29T15:38:55Z

+		hash8,
+	)
+
+	if len(name) > 253 {


The 8-char hash that guarantees uniqueness sits at the end of the name. I suggest add the hash in the end, after length check.

AlwxSin · 2026-04-29T15:40:38Z

+				return fmt.Errorf("setting members: %w", err)
+			}
+
+			_, err = groupClient.Update(ctx, obj, metav1.UpdateOptions{})


Consider adding retry.RetryOnConflict from k8s.io/client-go/util/retry for case when someone do the update between .Get and .Update

AlwxSin · 2026-04-29T15:40:54Z

+	if err := unstructured.SetNestedSlice(obj.Object, members, "spec", "members"); err != nil {
+		return EnsureMemberResult{}, fmt.Errorf("setting members on group %q: %w", groupName, err)
+	}
+	if _, err := groupClient.Update(ctx, obj, metav1.UpdateOptions{}); err != nil {


Consider adding retry.RetryOnConflict from k8s.io/client-go/util/retry for case when someone do the update between .Get and .Update

AlwxSin · 2026-04-29T15:47:06Z

+	case iamtypes.KindGroup:
+		subjectPrincipal = subjectName
+		if _, err := dyn.Resource(iamtypes.GroupGVR).Get(cmd.Context(), subjectName, metav1.GetOptions{}); err != nil {
+			fmt.Fprintf(cmd.ErrOrStderr(), "Warning: local Group CR %q not found. Grant may target an external provider group.\n", subjectName)


Consider using check apierrors.IsNotFound(err) for Not found. If not, just print err (there are possible Forbidden, Timeout errors).

AlwxSin · 2026-04-29T15:50:08Z

+}
+
+func findViaGroup(inv *accessInventory, userName, grantGroupName string) string {
+	directGroups, transitiveGroups := inv.ResolveUserGroups(userName)


Consider using cache for groups. For now code walks over all groups even if .ResolveUserGroups returns all groups

AlwxSin · 2026-04-29T15:57:55Z

+  # Revoke a labels-scoped grant (must match the original --scope value)
+  d8 iam access revoke group admins --access-level Editor --scope labels=team=platform,tier=prod`)
+
+func newRevokeCommand() *cobra.Command {


grant has --dry-run flag, but revoke hasn't. Consider adding dry run flag.

AlwxSin · 2026-04-29T16:00:06Z

+				return fmt.Errorf("deleting User %q: %w", name, err)
+			}
+
+			fmt.Fprintf(cmd.ErrOrStderr(), "Warning: user %q may still be referenced in Group memberships. Use \"d8 iam group remove-member\" to clean up.\n", name)


Shouldn't we automate this? There is a task for that, that we should remove deleted user from groups.

AlwxSin · 2026-04-29T16:04:06Z

+	if !managedOnly && !manualOnly {
+		return rows
+	}
+	out := rows[:0]


rows[:0] will mutate outer variable.

Suggested change

out := rows[:0]

out := make([]ruleRow, 0, len(rows))

AlwxSin · 2026-04-29T16:06:38Z

+	PortForwarding bool          `json:"portForwarding"`
+	ManagedByD8    bool          `json:"managedByD8Cli"`
+	Subjects       []subjectJSON `json:"subjects"`
+	CreationTime   time.Time     `json:"creationTimestamp,omitempty"`


My linter tells me, that omitempty is useless against time.Time.
Either:

*time.Time json:"omitempty"

time.Time json:"omitzero"

AlwxSin · 2026-04-29T16:08:06Z

+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	ri := dyn.Resource(gvr)


Consider use dyn.Resource(gvr).Namespace(namespace) if namespace != ""

Jabejixo force-pushed the add-user-group-access-managing branch from e82de0c to 13a6cc9 Compare April 27, 2026 07:52

Add commands for manage users groups and access

cabfa61

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

Jabejixo force-pushed the add-user-group-access-managing branch from 13a6cc9 to cabfa61 Compare April 27, 2026 07:53

Jabejixo added 4 commits April 27, 2026 12:34

Refactor

3528112

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

fix

b409d79

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

refactor2

17d772b

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

refactor3

41aa31c

Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>

Jabejixo marked this pull request as ready for review April 29, 2026 07:10

Jabejixo requested a review from ldmonster as a code owner April 29, 2026 07:10

AlwxSin reviewed Apr 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add commands for manage users groups and access#339

Add commands for manage users groups and access#339
Jabejixo wants to merge 5 commits intomainfrom
add-user-group-access-managing

Jabejixo commented Apr 27, 2026 •

edited

Loading

Uh oh!

AlwxSin left a comment

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

AlwxSin Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Jabejixo commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Why do we need it, and what problem does it solve?

Why do we need it in the patch release (if we do)?

Changelog entries

Uh oh!

AlwxSin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Jabejixo commented Apr 27, 2026 •

edited

Loading