Web view

Makefile

@@ -4,7 +4,7 @@ rback_version := 0.4.0
 
 build :
 	GO111MODULE=on GOOS=linux GOARCH=amd64 go build -o ./release/linux_rback .
-	GO111MODULE=on go build -o ./release/macos_rback .
+	GO111MODULE=on GOOS=darwin GOARCH=amd64 go build -o ./release/macos_rback .
 
 clean :
 	@rm ./release/*

README.md

@@ -60,20 +60,27 @@ There are plenty of Graphviz (`dot`) online visualization tools available, for e
 
 ### Render locally
 
-Install [Graphviz](https://www.graphviz.org/), for example, on macOS you can do `brew install graphviz`. Then you can do the following (on macOS):
+Install [Graphviz](https://www.graphviz.org/), for example, on macOS you can do `brew install graphviz`. Then you can do the following:
 
 ```sh
 $ kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback | dot -Tpng  > /tmp/rback.png && open /tmp/rback.png
 ```
 
+### Web view
+
+Graph can also be rendered using [viz.js](https://github.com/mdaines/viz.js/) and displayed in a browser. Just run:
+
+```sh
+$ kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback -web
+```
 
 ## Using rback as a kubectl plugin
 
 There is also a very crude first version of a kubectl plugin in https://github.com/team-soteria/rback/blob/master/kubectl-plugin/kubectl-rback. Add the file to your path, ensure it is executable and modify it to suit your environment. Then, you'll be able to simply run:
 ```sh
 $ kubectl rback
 ```
-This will generate the `.dot` file, render it using GraphViz (must be installed on your system) and open the rendered image using `xgd-open`. 
+This render the graph using viz.js and display it in a browser.
 
 We welcome contributions to make the plugin work in other environments.
 

go.mod

@@ -1,5 +1,8 @@
-module github.com/mhausenblas/rback
+module github.com/team-soteria/rback
 
 go 1.12
 
-require github.com/emicklei/dot v0.10.0
+require (
+	github.com/emicklei/dot v0.10.0
+	github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4
+)

go.sum

@@ -1,2 +1,4 @@
 github.com/emicklei/dot v0.10.0 h1:BAuTQEJM56bu8Z0+d073CPJrc9I8gj4uXCKDIO0Cwpk=
 github.com/emicklei/dot v0.10.0/go.mod h1:kZg82Ikwc4pqb31Ct2yb0B7RUqxh3JESIXw2uWSv/xY=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4 h1:49lOXmGaUpV9Fz3gd7TFZY106KVlPVa5jcYD1gaQf98=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=

kubectl-plugin/kubectl-rback

@@ -1,6 +1,3 @@
 #!/bin/bash
 
-kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | \
-	rback $@ > /tmp/rback.dot && \
-	dot /tmp/rback.dot -Tpng -Gsplines=spline -Kdot > /tmp/rback.png && \
-	xdg-open /tmp/rback.png
+kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback -web

main.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"os"
 	"strings"
+
+	"github.com/pkg/browser"
 )
 
 type Rback struct {
@@ -21,6 +23,7 @@ type Config struct {
 	resourceKind    string
 	resourceNames   []string
 	whoCan          WhoCan
+	web             bool
 }
 
 type WhoCan struct {
@@ -48,7 +51,25 @@ func main() {
 		os.Exit(-1)
 	}
 	g := rback.genGraph()
-	fmt.Println(g.String())
+
+	switch {
+	// If "web" flag is present, display the graph in a browser.
+	case config.web:
+		html, err := generateWebView(g)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Error generating web view: %v\n", err)
+			os.Exit(-1)
+		}
+
+		err = browser.OpenReader(html)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "Error displaying graph in browser: %v\n", err)
+			os.Exit(-1)
+		}
+	// If no flags are present, print the graph to stdout.
+	default:
+		fmt.Println(g.String())
+	}
 }
 
 func parseConfigFromArgs() Config {
@@ -57,6 +78,7 @@ func parseConfigFromArgs() Config {
 	flag.BoolVar(&config.showLegend, "show-legend", true, "Whether to show the legend or not")
 	flag.BoolVar(&config.showRules, "show-rules", true, "Whether to render RBAC access rules (e.g. \"get pods\") or not")
 	flag.BoolVar(&config.whoCan.showMatchedOnly, "show-matched-rules-only", false, "When running who-can, only show the matched rule instead of all rules specified in the role")
+	flag.BoolVar(&config.web, "web", false, "Show the graph in a browser.")
 
 	var namespaces string
 	flag.StringVar(&namespaces, "n", "", "The namespace to render (also supports multiple, comma-delimited namespaces)")

render.go

@@ -50,7 +50,7 @@ func (r *Rback) genGraph() *dot.Graph {
 			}
 			gns := newNamespaceSubgraph(g, ns)
 
-			for sa, _ := range sas {
+			for sa := range sas {
 				renderSA := r.config.resourceKind == "" || (r.namespaceSelected(ns) && r.resourceNameSelected(sa))
 				if renderSA {
 					r.newSubjectNode(gns, "ServiceAccount", ns, sa)
@@ -75,7 +75,7 @@ func (r *Rback) genGraph() *dot.Graph {
 		}
 
 		gns := newNamespaceSubgraph(g, ns)
-		for roleName, _ := range roles {
+		for roleName := range roles {
 			renderRole := r.namespaceSelected(ns) && r.resourceNameSelected(roleName)
 			if renderRole {
 				r.newRoleAndRulesNodePair(gns, "", NamespacedName{ns, roleName})

third-party/svgpanzoom/LICENSE

@@ -0,0 +1,23 @@
+Copyright 2009-2010 Andrea Leofreddi <[email protected]>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.