forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add non-resource and API group support to ABAC authorizer, version AB…
…AC policy rules
- Loading branch information
Showing
16 changed files
with
1,477 additions
and
198 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| /* | ||
| Copyright 2014 The Kubernetes Authors All rights reserved. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package latest | ||
|
|
||
| import ( | ||
| "k8s.io/kubernetes/pkg/apis/abac/v1beta1" | ||
| ) | ||
|
|
||
| // Codec is the default codec for serializing input that should use the latest supported version. | ||
| var Codec = v1beta1.Codec |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| /* | ||
| Copyright 2015 The Kubernetes Authors All rights reserved. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package api | ||
|
|
||
| import ( | ||
| "k8s.io/kubernetes/pkg/api/unversioned" | ||
| "k8s.io/kubernetes/pkg/runtime" | ||
| ) | ||
|
|
||
| // Group is the API group for abac | ||
| const Group = "abac.authorization.kubernetes.io" | ||
|
|
||
| // Scheme is the default instance of runtime.Scheme to which types in the abac API group are registered. | ||
| var Scheme = runtime.NewScheme() | ||
|
|
||
| func init() { | ||
| Scheme.AddInternalGroupVersion(unversioned.GroupVersion{Group: Group, Version: ""}) | ||
| Scheme.AddKnownTypes(unversioned.GroupVersion{Group: Group, Version: ""}, | ||
| &Policy{}, | ||
| ) | ||
| } | ||
|
|
||
| func (*Policy) IsAnAPIObject() {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| /* | ||
| Copyright 2015 The Kubernetes Authors All rights reserved. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package api | ||
|
|
||
| import "k8s.io/kubernetes/pkg/api/unversioned" | ||
|
|
||
| // Policy contains a single ABAC policy rule | ||
| type Policy struct { | ||
| unversioned.TypeMeta | ||
|
|
||
| // Spec describes the policy rule | ||
| Spec PolicySpec | ||
| } | ||
|
|
||
| // PolicySpec contains the attributes for a policy rule | ||
| type PolicySpec struct { | ||
|
|
||
| // User is the username this rule applies to. | ||
| // Either user or group is required to match the request. | ||
| // "*" matches all users. | ||
| User string | ||
|
|
||
| // Group is the group this rule applies to. | ||
| // Either user or group is required to match the request. | ||
| // "*" matches all groups. | ||
| Group string | ||
|
|
||
| // Readonly matches readonly requests when true, and all requests when false | ||
| Readonly bool | ||
|
|
||
| // APIGroup is the name of an API group. APIGroup, Resource, and Namespace are required to match resource requests. | ||
| // "*" matches all API groups | ||
| APIGroup string | ||
|
|
||
| // Resource is the name of a resource. APIGroup, Resource, and Namespace are required to match resource requests. | ||
| // "*" matches all resources | ||
| Resource string | ||
|
|
||
| // Namespace is the name of a namespace. APIGroup, Resource, and Namespace are required to match resource requests. | ||
| // "*" matches all namespaces (including unnamespaced requests) | ||
| Namespace string | ||
|
|
||
| // NonResourcePath matches non-resource request paths. | ||
| // "*" matches all paths | ||
| // "/foo/*" matches all subpaths of foo | ||
| NonResourcePath string | ||
|
|
||
| // TODO: "expires" string in RFC3339 format. | ||
|
|
||
| // TODO: want a way to allow some users to restart containers of a pod but | ||
| // not delete or modify it. | ||
|
|
||
| // TODO: want a way to allow a controller to create a pod based only on a | ||
| // certain podTemplates. | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| /* | ||
| Copyright 2015 The Kubernetes Authors All rights reserved. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package v0 | ||
|
|
||
| import ( | ||
| "k8s.io/kubernetes/pkg/apis/abac" | ||
| "k8s.io/kubernetes/pkg/conversion" | ||
| ) | ||
|
|
||
| func init() { | ||
| api.Scheme.AddConversionFuncs( | ||
| func(in *Policy, out *api.Policy, s conversion.Scope) error { | ||
| // Begin by copying all fields | ||
| out.Spec.User = in.User | ||
| out.Spec.Group = in.Group | ||
| out.Spec.Namespace = in.Namespace | ||
| out.Spec.Resource = in.Resource | ||
| out.Spec.Readonly = in.Readonly | ||
|
|
||
| // In v0, unspecified user and group matches all subjects | ||
| if len(in.User) == 0 && len(in.Group) == 0 { | ||
| out.Spec.User = "*" | ||
| } | ||
|
|
||
| // In v0, leaving namespace empty matches all namespaces | ||
| if len(in.Namespace) == 0 { | ||
| out.Spec.Namespace = "*" | ||
| } | ||
| // In v0, leaving resource empty matches all resources | ||
| if len(in.Resource) == 0 { | ||
| out.Spec.Resource = "*" | ||
| } | ||
| // Any rule in v0 should match all API groups | ||
| out.Spec.APIGroup = "*" | ||
|
|
||
| // In v0, leaving namespace and resource blank allows non-resource paths | ||
| if len(in.Namespace) == 0 && len(in.Resource) == 0 { | ||
| out.Spec.NonResourcePath = "*" | ||
| } | ||
|
|
||
| return nil | ||
| }, | ||
| ) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| /* | ||
| Copyright 2015 The Kubernetes Authors All rights reserved. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package v0_test | ||
|
|
||
| import ( | ||
| "reflect" | ||
| "testing" | ||
|
|
||
| "k8s.io/kubernetes/pkg/apis/abac" | ||
| "k8s.io/kubernetes/pkg/apis/abac/v0" | ||
| ) | ||
|
|
||
| func TestConversion(t *testing.T) { | ||
| testcases := map[string]struct { | ||
| old *v0.Policy | ||
| expected *api.Policy | ||
| }{ | ||
| // a completely empty policy rule allows everything to all users | ||
| "empty": { | ||
| old: &v0.Policy{}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{User: "*", Readonly: false, NonResourcePath: "*", Namespace: "*", Resource: "*", APIGroup: "*"}}, | ||
| }, | ||
|
|
||
| // specifying a user is preserved | ||
| "user": { | ||
| old: &v0.Policy{User: "bob"}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{User: "bob", Readonly: false, NonResourcePath: "*", Namespace: "*", Resource: "*", APIGroup: "*"}}, | ||
| }, | ||
|
|
||
| // specifying a group is preserved (and no longer matches all users) | ||
| "group": { | ||
| old: &v0.Policy{Group: "mygroup"}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{Group: "mygroup", Readonly: false, NonResourcePath: "*", Namespace: "*", Resource: "*", APIGroup: "*"}}, | ||
| }, | ||
|
|
||
| // specifying a namespace removes the * match on non-resource path | ||
| "namespace": { | ||
| old: &v0.Policy{Namespace: "myns"}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{User: "*", Readonly: false, NonResourcePath: "", Namespace: "myns", Resource: "*", APIGroup: "*"}}, | ||
| }, | ||
|
|
||
| // specifying a resource removes the * match on non-resource path | ||
| "resource": { | ||
| old: &v0.Policy{Resource: "myresource"}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{User: "*", Readonly: false, NonResourcePath: "", Namespace: "*", Resource: "myresource", APIGroup: "*"}}, | ||
| }, | ||
|
|
||
| // specifying a namespace+resource removes the * match on non-resource path | ||
| "namespace+resource": { | ||
| old: &v0.Policy{Namespace: "myns", Resource: "myresource"}, | ||
| expected: &api.Policy{Spec: api.PolicySpec{User: "*", Readonly: false, NonResourcePath: "", Namespace: "myns", Resource: "myresource", APIGroup: "*"}}, | ||
| }, | ||
| } | ||
| for k, tc := range testcases { | ||
| internal := &api.Policy{} | ||
| if err := api.Scheme.Convert(tc.old, internal); err != nil { | ||
| t.Errorf("%s: unexpected error: %v", k, err) | ||
| } | ||
| if !reflect.DeepEqual(internal, tc.expected) { | ||
| t.Errorf("%s: expected\n\t%#v, got \n\t%#v", k, tc.expected, internal) | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.