Skip to content

Commit 4df3b59

Browse files
tamalsahatamalsaha
authored
Fix rbac authorization for GKE clusters (#216)
Signed-off-by: Tamal Saha <[email protected]>
1 parent d82e73d commit 4df3b59

File tree

13 files changed

+538
-48
lines changed

13 files changed

+538
-48
lines changed

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ require (
3838
k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
3939
k8s.io/kube-state-metrics/v2 v2.7.0
4040
kmodules.xyz/apiversion v0.2.0
41-
kmodules.xyz/authorizer v0.25.0
41+
kmodules.xyz/authorizer v0.25.1
4242
kmodules.xyz/client-go v0.25.23
4343
kmodules.xyz/custom-resources v0.25.1
4444
kmodules.xyz/go-containerregistry v0.0.11

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -2106,8 +2106,8 @@ k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJ
21062106
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
21072107
kmodules.xyz/apiversion v0.2.0 h1:vAQYqZFm4xu4pbB1cAdHbFEPES6EQkcR4wc06xdTOWk=
21082108
kmodules.xyz/apiversion v0.2.0/go.mod h1:oPX8g8LvlPdPX3Yc5YvCzJHQnw3YF/X4/jdW0b1am80=
2109-
kmodules.xyz/authorizer v0.25.0 h1:yRrLtMOdlU1p4mLzaSz5pmSLpBLsVXLQHkUfiME12iQ=
2110-
kmodules.xyz/authorizer v0.25.0/go.mod h1:Jb99YsLRJE4R4d8F5fFtlxEaxk0prdSk2LApZl4JdyI=
2109+
kmodules.xyz/authorizer v0.25.1 h1:W19AtlPD2A1+Q4UqDmNCJKfX9bKIgj+J6bQmkYwsHwY=
2110+
kmodules.xyz/authorizer v0.25.1/go.mod h1:hKAbHpRkbxZJjc+cMTUiyxQxp7amKUVDiN145IrpnhA=
21112111
kmodules.xyz/client-go v0.25.23 h1:qz5XJYHLVZUowqfRXEJD7JQ4iaLLzQ1O1zPMmsdrkJw=
21122112
kmodules.xyz/client-go v0.25.23/go.mod h1:wbdzLEoDYiCPI6dTW0mIAGNwkwFV4lC5BN1FJxiDsbw=
21132113
kmodules.xyz/crd-schema-fuzz v0.25.0 h1:c5ZxNRqJak1bkGhECmyrKpzKGThFMB4088Kynyvngbc=

‎pkg/apiserver/apiserver.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ import (
7272
restclient "k8s.io/client-go/rest"
7373
"k8s.io/klog/v2"
7474
"k8s.io/klog/v2/klogr"
75-
"kmodules.xyz/authorizer/rbac"
75+
"kmodules.xyz/authorizer"
7676
cu "kmodules.xyz/client-go/client"
7777
"kmodules.xyz/client-go/meta"
7878
appcatalogapi "kmodules.xyz/custom-resources/apis/appcatalog/v1alpha1"
@@ -214,7 +214,7 @@ func (c completedConfig) New(ctx context.Context) (*UIServer, error) {
214214
return nil, err
215215
}
216216

217-
rbacAuthorizer := rbac.NewForManagerOrDie(ctx, mgr)
217+
rbacAuthorizer := authorizer.NewForManagerOrDie(ctx, mgr)
218218

219219
builder, err := promclient.NewBuilder(mgr, &c.ExtraConfig.PromConfig)
220220
if err != nil {

‎pkg/registry/core/genericresource/storage.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -112,12 +112,13 @@ func (r *Storage) Get(ctx context.Context, name string, options *metav1.GetOptio
112112
rid := kmapi.NewResourceID(mapping)
113113

114114
attrs := authorizer.AttributesRecord{
115-
User: user,
116-
Verb: "get",
117-
Namespace: ns,
118-
APIGroup: mapping.Resource.Group,
119-
Resource: mapping.Resource.Resource,
120-
Name: objName,
115+
User: user,
116+
Verb: "get",
117+
Namespace: ns,
118+
APIGroup: mapping.Resource.Group,
119+
Resource: mapping.Resource.Resource,
120+
Name: objName,
121+
ResourceRequest: true,
121122
}
122123
decision, why, err := r.a.Authorize(ctx, attrs)
123124
if err != nil {
@@ -170,12 +171,13 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
170171
apiType := kmapi.NewResourceID(mapping)
171172

172173
attrs := authorizer.AttributesRecord{
173-
User: user,
174-
Verb: "get",
175-
Namespace: ns,
176-
APIGroup: mapping.Resource.Group,
177-
Resource: mapping.Resource.Resource,
178-
Name: "",
174+
User: user,
175+
Verb: "get",
176+
Namespace: ns,
177+
APIGroup: mapping.Resource.Group,
178+
Resource: mapping.Resource.Resource,
179+
Name: "",
180+
ResourceRequest: true,
179181
}
180182

181183
var list unstructured.UnstructuredList
@@ -185,6 +187,7 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
185187
}
186188
for _, item := range list.Items {
187189
attrs.Name = item.GetName()
190+
attrs.Namespace = item.GetNamespace()
188191
decision, _, err := r.a.Authorize(ctx, attrs)
189192
if err != nil {
190193
return nil, apierrors.NewInternalError(err)

‎pkg/registry/core/podview/storage.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,13 @@ func (r *Storage) Get(ctx context.Context, name string, options *metav1.GetOptio
9696
}
9797

9898
attrs := authorizer.AttributesRecord{
99-
User: user,
100-
Verb: "get",
101-
Namespace: ns,
102-
APIGroup: r.gr.Group,
103-
Resource: r.gr.Resource,
104-
Name: name,
99+
User: user,
100+
Verb: "get",
101+
Namespace: ns,
102+
APIGroup: r.gr.Group,
103+
Resource: r.gr.Resource,
104+
Name: name,
105+
ResourceRequest: true,
105106
}
106107
decision, why, err := r.a.Authorize(ctx, attrs)
107108
if err != nil {
@@ -228,12 +229,13 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
228229
}
229230

230231
attrs := authorizer.AttributesRecord{
231-
User: user,
232-
Verb: "get",
233-
Namespace: ns,
234-
APIGroup: r.gr.Group,
235-
Resource: r.gr.Resource,
236-
Name: "",
232+
User: user,
233+
Verb: "get",
234+
Namespace: ns,
235+
APIGroup: r.gr.Group,
236+
Resource: r.gr.Resource,
237+
Name: "",
238+
ResourceRequest: true,
237239
}
238240

239241
opts := client.ListOptions{Namespace: ns}
@@ -257,6 +259,7 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
257259
podviews := make([]corev1alpha1.PodView, 0, len(podList.Items))
258260
for _, pod := range podList.Items {
259261
attrs.Name = pod.Name
262+
attrs.Namespace = pod.Namespace
260263
decision, _, err := r.a.Authorize(context.TODO(), attrs)
261264
if err != nil {
262265
return nil, apierrors.NewInternalError(err)

‎pkg/registry/core/resourceservice/storage.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -124,12 +124,13 @@ func (r *Storage) Get(ctx context.Context, name string, options *metav1.GetOptio
124124
rid := kmapi.NewResourceID(mapping)
125125

126126
attrs := authorizer.AttributesRecord{
127-
User: user,
128-
Verb: "get",
129-
Namespace: ns,
130-
APIGroup: mapping.Resource.Group,
131-
Resource: mapping.Resource.Resource,
132-
Name: objName,
127+
User: user,
128+
Verb: "get",
129+
Namespace: ns,
130+
APIGroup: mapping.Resource.Group,
131+
Resource: mapping.Resource.Resource,
132+
Name: objName,
133+
ResourceRequest: true,
133134
}
134135
decision, why, err := r.a.Authorize(ctx, attrs)
135136
if err != nil {
@@ -182,12 +183,13 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
182183
apiType := kmapi.NewResourceID(mapping)
183184

184185
attrs := authorizer.AttributesRecord{
185-
User: user,
186-
Verb: "get",
187-
Namespace: ns,
188-
APIGroup: mapping.Resource.Group,
189-
Resource: mapping.Resource.Resource,
190-
Name: "",
186+
User: user,
187+
Verb: "get",
188+
Namespace: ns,
189+
APIGroup: mapping.Resource.Group,
190+
Resource: mapping.Resource.Resource,
191+
Name: "",
192+
ResourceRequest: true,
191193
}
192194

193195
var list unstructured.UnstructuredList
@@ -197,6 +199,7 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
197199
}
198200
for _, item := range list.Items {
199201
attrs.Name = item.GetName()
202+
attrs.Namespace = item.GetNamespace()
200203
decision, _, err := r.a.Authorize(ctx, attrs)
201204
if err != nil {
202205
return nil, apierrors.NewInternalError(err)

‎pkg/registry/core/resourcesummary/storage.go

+8-6
Original file line numberDiff line numberDiff line change
@@ -120,12 +120,13 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
120120
apiType := kmapi.NewResourceID(mapping)
121121

122122
attrs := authorizer.AttributesRecord{
123-
User: user,
124-
Verb: "get",
125-
Namespace: ns,
126-
APIGroup: mapping.Resource.Group,
127-
Resource: mapping.Resource.Resource,
128-
Name: "",
123+
User: user,
124+
Verb: "get",
125+
Namespace: ns,
126+
APIGroup: mapping.Resource.Group,
127+
Resource: mapping.Resource.Resource,
128+
Name: "",
129+
ResourceRequest: true,
129130
}
130131

131132
summary := corev1alpha1.ResourceSummary{
@@ -152,6 +153,7 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
152153
}
153154
for _, item := range list.Items {
154155
attrs.Name = item.GetName()
156+
attrs.Namespace = item.GetNamespace()
155157
decision, _, err := r.a.Authorize(ctx, attrs)
156158
if err != nil {
157159
return nil, apierrors.NewInternalError(err)

‎vendor/kmodules.xyz/authorizer/.gitignore

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Compiled Object files, Static and Dynamic libs (Shared Objects)
2+
*.o
3+
*.a
4+
*.so
5+
6+
# Folders
7+
_obj
8+
_test
9+
10+
# Architecture specific extensions/prefixes
11+
*.[568vq]
12+
[568vq].out
13+
14+
*.cgo1.go
15+
*.cgo2.c
16+
_cgo_defun.c
17+
_cgo_gotypes.go
18+
_cgo_export.*
19+
20+
_testmain.go
21+
22+
*.exe
23+
*.test
24+
*.prof
25+
.idea/
26+
dist/
27+
**/junit.xml
28+
**/.env
29+
.vscode/
30+
coverage.txt
31+
32+
/bin
33+
/.go
34+
35+
apiserver.local.config/**
36+
37+
.DS_Store
38+
39+
vendor

0 commit comments

Comments
 (0)