github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-05 02:09:56 +00:00
Code Issues Projects Releases Wiki Activity

Split construction of authorizer / ruleResolver

Browse Source
This commit is contained in:
Jordan Liggitt 2023-11-07 12:23:15 -06:00
parent 1fddc948ed
commit 2b00035b5f
No known key found for this signature in database
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/kubeapiserver/authorizer/config.go
View File

@ -111,6 +111,23 @@ func (config Config) New() (authorizer.Authorizer, authorizer.RuleResolver, erro
} }
// Construct the authorizers / ruleResolvers for the given configuration // Construct the authorizers / ruleResolvers for the given configuration
authorizer, ruleResolver, err := r.newForConfig(r.initialConfig.AuthorizationConfiguration)
if err != nil {
return nil, nil, err
}
r.current.Store(&authorizerResolver{
authorizer: authorizer,
ruleResolver: ruleResolver,
})
return r, r, nil
}
// newForConfig constructs
func (r *reloadableAuthorizerResolver) newForConfig(authzConfig *authzconfig.AuthorizationConfiguration) (authorizer.Authorizer, authorizer.RuleResolver, error) {
if len(authzConfig.Authorizers) == 0 {
return nil, nil, fmt.Errorf("at least one authorization mode must be passed")
}
var ( var (
authorizers []authorizer.Authorizer authorizers []authorizer.Authorizer
@ -121,7 +138,7 @@ func (config Config) New() (authorizer.Authorizer, authorizer.RuleResolver, erro
superuserAuthorizer := authorizerfactory.NewPrivilegedGroups(user.SystemPrivilegedGroup) superuserAuthorizer := authorizerfactory.NewPrivilegedGroups(user.SystemPrivilegedGroup)
authorizers = append(authorizers, superuserAuthorizer) authorizers = append(authorizers, superuserAuthorizer)
for _, configuredAuthorizer := range config.AuthorizationConfiguration.Authorizers { for _, configuredAuthorizer := range authzConfig.Authorizers {
// Keep cases in sync with constant list in k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes/modes.go. // Keep cases in sync with constant list in k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes/modes.go.
switch configuredAuthorizer.Type { switch configuredAuthorizer.Type {
case authzconfig.AuthorizerType(modes.ModeNode): case authzconfig.AuthorizerType(modes.ModeNode):
@ -185,12 +202,7 @@ func (config Config) New() (authorizer.Authorizer, authorizer.RuleResolver, erro
} }
} }
r.current.Store(&authorizerResolver{ return union.New(authorizers...), union.NewRuleResolvers(ruleResolvers...), nil
authorizer: union.New(authorizers...),
ruleResolver: union.NewRuleResolvers(ruleResolvers...),
})
return r, r, nil
} }
// RepeatableAuthorizerTypes is the list of Authorizer that can be repeated in the Authorization Config // RepeatableAuthorizerTypes is the list of Authorizer that can be repeated in the Authorization Config