Cleanup conversions

This commit is contained in:
wojtekt 2019-10-28 16:47:22 +01:00
parent 7d13dfe3c3
commit 32759d33bf
8 changed files with 62 additions and 76 deletions

View File

@ -2,6 +2,8 @@ cmd/cloud-controller-manager/app/apis/config/v1alpha1
cmd/kube-apiserver/app cmd/kube-apiserver/app
cmd/kubeadm/app/apis/kubeadm/v1beta1 cmd/kubeadm/app/apis/kubeadm/v1beta1
cmd/kubeadm/app/apis/kubeadm/v1beta2 cmd/kubeadm/app/apis/kubeadm/v1beta2
pkg/apis/abac/v0
pkg/apis/abac/v1beta1
pkg/apis/admission pkg/apis/admission
pkg/apis/admissionregistration/v1 pkg/apis/admissionregistration/v1
pkg/apis/admissionregistration/v1beta1 pkg/apis/admissionregistration/v1beta1

View File

@ -80,7 +80,10 @@ func ConvertV1ReplicaSetToAPIReplicationController(in *appsv1.ReplicaSet, out *a
} }
func TestSetControllerConversion(t *testing.T) { func TestSetControllerConversion(t *testing.T) {
if err := legacyscheme.Scheme.AddConversionFuncs(ConvertV1ReplicaSetToAPIReplicationController); err != nil { s := legacyscheme.Scheme
if err := s.AddConversionFunc((*appsv1.ReplicaSet)(nil), (*api.ReplicationController)(nil), func(a, b interface{}, scope conversion.Scope) error {
return ConvertV1ReplicaSetToAPIReplicationController(a.(*appsv1.ReplicaSet), b.(*api.ReplicationController), scope)
}); err != nil {
t.Fatal(err) t.Fatal(err)
} }

View File

@ -18,51 +18,45 @@ package v0
import ( import (
"k8s.io/apimachinery/pkg/conversion" "k8s.io/apimachinery/pkg/conversion"
"k8s.io/apimachinery/pkg/runtime" "k8s.io/kubernetes/pkg/apis/abac"
api "k8s.io/kubernetes/pkg/apis/abac"
) )
// allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated, // allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated,
// but we don't want a client library (which must include types), depending on a server library // but we don't want a client library (which must include types), depending on a server library
const allAuthenticated = "system:authenticated" const allAuthenticated = "system:authenticated"
func addConversionFuncs(scheme *runtime.Scheme) error { func Convert_v0_Policy_To_abac_Policy(in *Policy, out *abac.Policy, s conversion.Scope) error {
return scheme.AddConversionFuncs( out.Spec.User = in.User
func(in *Policy, out *api.Policy, s conversion.Scope) error { out.Spec.Group = in.Group
// Begin by copying all fields out.Spec.Namespace = in.Namespace
out.Spec.User = in.User out.Spec.Resource = in.Resource
out.Spec.Group = in.Group out.Spec.Readonly = in.Readonly
out.Spec.Namespace = in.Namespace
out.Spec.Resource = in.Resource
out.Spec.Readonly = in.Readonly
// In v0, unspecified user and group matches all authenticated subjects // In v0, unspecified user and group matches all authenticated subjects
if len(in.User) == 0 && len(in.Group) == 0 { if len(in.User) == 0 && len(in.Group) == 0 {
out.Spec.Group = allAuthenticated out.Spec.Group = allAuthenticated
} }
// In v0, user or group of * matches all authenticated subjects // In v0, user or group of * matches all authenticated subjects
if in.User == "*" || in.Group == "*" { if in.User == "*" || in.Group == "*" {
out.Spec.Group = allAuthenticated out.Spec.Group = allAuthenticated
out.Spec.User = "" out.Spec.User = ""
} }
// In v0, leaving namespace empty matches all namespaces // In v0, leaving namespace empty matches all namespaces
if len(in.Namespace) == 0 { if len(in.Namespace) == 0 {
out.Spec.Namespace = "*" out.Spec.Namespace = "*"
} }
// In v0, leaving resource empty matches all resources // In v0, leaving resource empty matches all resources
if len(in.Resource) == 0 { if len(in.Resource) == 0 {
out.Spec.Resource = "*" out.Spec.Resource = "*"
} }
// Any rule in v0 should match all API groups // Any rule in v0 should match all API groups
out.Spec.APIGroup = "*" out.Spec.APIGroup = "*"
// In v0, leaving namespace and resource blank allows non-resource paths // In v0, leaving namespace and resource blank allows non-resource paths
if len(in.Namespace) == 0 && len(in.Resource) == 0 { if len(in.Namespace) == 0 && len(in.Resource) == 0 {
out.Spec.NonResourcePath = "*" out.Spec.NonResourcePath = "*"
} }
return nil return nil
},
)
} }

View File

@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
// +k8s:conversion-gen=false
// +k8s:deepcopy-gen=package // +k8s:deepcopy-gen=package
// +groupName=abac.authorization.kubernetes.io // +groupName=abac.authorization.kubernetes.io

View File

@ -19,6 +19,7 @@ package v0
import ( import (
"k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/schema"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
"k8s.io/kubernetes/pkg/apis/abac" "k8s.io/kubernetes/pkg/apis/abac"
) )
@ -30,14 +31,9 @@ var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v0"}
func init() { func init() {
// TODO: Delete this init function, abac should not have its own scheme. // TODO: Delete this init function, abac should not have its own scheme.
if err := addKnownTypes(abac.Scheme); err != nil { utilruntime.Must(addKnownTypes(abac.Scheme))
// Programmer error.
panic(err) utilruntime.Must(RegisterConversions(abac.Scheme))
}
if err := addConversionFuncs(abac.Scheme); err != nil {
// Programmer error.
panic(err)
}
} }
var ( var (
@ -56,7 +52,7 @@ func init() {
// We only register manually written functions here. The registration of the // We only register manually written functions here. The registration of the
// generated functions takes place in the generated files. The separation // generated functions takes place in the generated files. The separation
// makes the code compile even when the generated files are missing. // makes the code compile even when the generated files are missing.
localSchemeBuilder.Register(addKnownTypes, addConversionFuncs) localSchemeBuilder.Register(addKnownTypes)
} }
func addKnownTypes(scheme *runtime.Scheme) error { func addKnownTypes(scheme *runtime.Scheme) error {

View File

@ -18,29 +18,23 @@ package v1beta1
import ( import (
"k8s.io/apimachinery/pkg/conversion" "k8s.io/apimachinery/pkg/conversion"
"k8s.io/apimachinery/pkg/runtime" "k8s.io/kubernetes/pkg/apis/abac"
api "k8s.io/kubernetes/pkg/apis/abac"
) )
// allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated, // allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated,
// but we don't want an client library (which must include types), depending on a server library // but we don't want an client library (which must include types), depending on a server library
const allAuthenticated = "system:authenticated" const allAuthenticated = "system:authenticated"
func addConversionFuncs(scheme *runtime.Scheme) error { func Convert_v1beta1_Policy_To_abac_Policy(in *Policy, out *abac.Policy, s conversion.Scope) error {
return scheme.AddConversionFuncs( if err := autoConvert_v1beta1_Policy_To_abac_Policy(in, out, s); err != nil {
func(in *Policy, out *api.Policy, s conversion.Scope) error { return err
// Begin by copying all fields }
if err := autoConvert_v1beta1_Policy_To_abac_Policy(in, out, s); err != nil {
return err
}
// In v1beta1, * user or group maps to all authenticated subjects // In v1beta1, * user or group maps to all authenticated subjects
if in.Spec.User == "*" || in.Spec.Group == "*" { if in.Spec.User == "*" || in.Spec.Group == "*" {
out.Spec.Group = allAuthenticated out.Spec.Group = allAuthenticated
out.Spec.User = "" out.Spec.User = ""
} }
return nil return nil
},
)
} }

View File

@ -19,6 +19,7 @@ package v1beta1
import ( import (
"k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/schema"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
"k8s.io/kubernetes/pkg/apis/abac" "k8s.io/kubernetes/pkg/apis/abac"
) )
@ -29,15 +30,10 @@ const GroupName = "abac.authorization.kubernetes.io"
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"} var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
func init() { func init() {
// TODO: delete this, abac should not have its own scheme. // TODO: Delete this init function, abac should not have its own scheme.
if err := addKnownTypes(abac.Scheme); err != nil { utilruntime.Must(addKnownTypes(abac.Scheme))
// Programmer error.
panic(err) utilruntime.Must(RegisterConversions(abac.Scheme))
}
if err := addConversionFuncs(abac.Scheme); err != nil {
// Programmer error.
panic(err)
}
} }
var ( var (
@ -56,7 +52,7 @@ func init() {
// We only register manually written functions here. The registration of the // We only register manually written functions here. The registration of the
// generated functions takes place in the generated files. The separation // generated functions takes place in the generated files. The separation
// makes the code compile even when the generated files are missing. // makes the code compile even when the generated files are missing.
localSchemeBuilder.Register(addKnownTypes, addConversionFuncs, RegisterDefaults) localSchemeBuilder.Register(addKnownTypes, RegisterDefaults)
} }
func addKnownTypes(scheme *runtime.Scheme) error { func addKnownTypes(scheme *runtime.Scheme) error {

View File

@ -43,8 +43,8 @@ limitations under the License.
// object that will be input to an apiserver), for such an override to // object that will be input to an apiserver), for such an override to
// be used by the apiserver the developer-maintained conversion // be used by the apiserver the developer-maintained conversion
// functions must also be registered by invoking the // functions must also be registered by invoking the
// `AddConversionFuncs` method of the relevant `Scheme` object from // `AddConversionFunc`/`AddGeneratedConversionFunc` method of the
// k8s.io/apimachinery/pkg/runtime. // relevant `Scheme` object from k8s.io/apimachinery/pkg/runtime.
// //
// `conversion-gen` will scan its `--input-dirs`, looking at the // `conversion-gen` will scan its `--input-dirs`, looking at the
// package defined in each of those directories for comment tags that // package defined in each of those directories for comment tags that