Member Management Part2

backend/lib/routes/members.js

@@ -66,3 +66,15 @@ router.route('/:name')
       next(err)
     }
   })
+
+router.route('/:name/secret')
+  .delete(async (req, res, next) => {
+    try {
+      const user = req.user
+      const namespace = req.params.namespace
+      const name = req.params.name
+      res.send(await members.removeSecret({ user, namespace, name }))
+    } catch (err) {
+      next(err)
+    }
+  })

backend/lib/services/members/MemberManager.js

@@ -7,7 +7,7 @@
 'use strict'
 
 const _ = require('lodash')
-const { NotFound, Conflict, UnprocessableEntity } = require('http-errors')
+const { NotFound, Conflict, UnprocessableEntity, MethodNotAllowed } = require('http-errors')
 const { dumpKubeconfig } = require('@gardener-dashboard/kube-config')
 
 const config = require('../../config')
@@ -97,6 +97,21 @@ class MemberManager {
     return this.subjectList.members
   }
 
+  async deleteSecret (id) {
+    const item = this.subjectList.get(id)
+    if (!item) {
+      return this.subjectList.members
+    }
+
+    if (!item.kind === 'ServiceAccount') {
+      throw new MethodNotAllowed('Member is not a ServiceAccount')
+    }
+
+    await this.deleteServiceAccountSecret(item)
+
+    return this.subjectList.members
+  }
+
   setItemRoles (item, roles) {
     roles = _.compact(roles)
     if (!roles.length && item.kind !== 'ServiceAccount') {
@@ -169,6 +184,21 @@ class MemberManager {
     this.subjectList.delete(item.id)
   }
 
+  async deleteServiceAccountSecret (item) {
+    const { namespace } = Member.parseUsername(item.id)
+    if (namespace !== this.namespace) {
+      return
+    }
+
+    const secretName = _
+      .chain(item)
+      .get('extensions.secrets')
+      .head()
+      .get('name')
+      .value()
+    return await this.client.core.secrets.delete(namespace, secretName)
+  }
+
   async getKubeconfig (item) {
     const { namespace, name } = Member.parseUsername(item.id)
     const secretName = _

backend/lib/services/members/index.js

@@ -32,3 +32,8 @@ exports.remove = async function ({ user, namespace, name }) {
   const memberManager = await MemberManager.create(user, namespace)
   return memberManager.delete(name)
 }
+
+exports.removeSecret = async function ({ user, namespace, name }) {
+  const memberManager = await MemberManager.create(user, namespace)
+  return memberManager.deleteSecret(name)
+}

backend/test/acceptance/api.members.spec.js

@@ -301,4 +301,15 @@ module.exports = function ({ agent, k8s, auth }) {
     const expectedBody = _.filter(members, ({ username }) => username !== name)
     expect(res.body).to.eql(expectedBody)
   })
+
+  it('should delete a service account secret', async function () {
+    const bearer = await user.bearer
+    const name = 'system:serviceaccount:garden-foo:robot'
+    k8s.stub.removeServiceAccountSecret({ bearer, namespace, name })
+    const res = await agent
+      .delete(`/api/namespaces/${namespace}/members/${name}/secret`)
+      .set('cookie', await user.cookie)
+
+    expect(res).to.have.status(200)
+  })
 }

backend/test/support/nocks/k8s.js

@@ -1502,6 +1502,20 @@ const stub = {
     }
     return scope
   },
+  removeServiceAccountSecret ({ bearer, namespace, name: username }) {
+    const scope = nockWithAuthorization(bearer)
+    const project = mockCreateProjectMemberManagerAndReturnProject(scope, namespace)
+    const isMember = _.findIndex(project.spec.members, ['name', username]) !== -1
+    const [, serviceAccountNamespace, serviceAccountName] = /^system:serviceaccount:([^:]+):([^:]+)$/.exec(username) || []
+    if (serviceAccountNamespace === namespace && isMember) {
+      const serviceAccount = _.find(serviceAccountList, ({ metadata }) => metadata.name === serviceAccountName && metadata.namespace === namespace)
+      const serviceAccountSecretName = _.first(serviceAccount.secrets).name
+      scope
+        .delete(`/api/v1/namespaces/${namespace}/secrets/${serviceAccountSecretName}`)
+        .reply(200)
+    }
+    return scope
+  },
   healthz () {
     return nockWithAuthorization(auth.bearer)
       .get('/healthz')

frontend/src/components/ServiceAccountRoles.vue → frontend/src/components/AccountRoles.vue

@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
  -->
 
 <template>
-  <div d-flex flex-row>
+  <div>
     <v-tooltip top v-for="{ displayName, notEditable, tooltip } in roleDisplayNames" :key="displayName" :disabled="!tooltip">
       <template v-slot:activator="{ on }">
         <v-chip v-on="on" class="mr-3" small :color="notEditable ? 'grey' : 'black'" outlined>