github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity

add permissions to kubectl test for rbac

Browse Source
This commit is contained in:
deads2k 2017-01-03 07:52:55 -05:00
parent ecd23a0217
commit 3a265d0eec
6 changed files with 72 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
test/e2e/framework/BUILD
View File

@ -47,9 +47,11 @@ go_library(
"//pkg/apis/extensions/v1beta1:go_default_library",
"//pkg/apis/meta/v1:go_default_library",
"//pkg/apis/meta/v1/unstructured:go_default_library",
"//pkg/apis/rbac/v1alpha1:go_default_library",
"//pkg/client/clientset_generated/clientset:go_default_library",
"//pkg/client/clientset_generated/clientset/typed/authorization/v1beta1:go_default_library",
"//pkg/client/clientset_generated/clientset/typed/core/v1:go_default_library",
"//pkg/client/clientset_generated/clientset/typed/rbac/v1alpha1:go_default_library",
"//pkg/client/clientset_generated/internalclientset:go_default_library",
"//pkg/client/conditions:go_default_library",
"//pkg/client/restclient:go_default_library",

47
test/e2e/framework/authorizer_util.go
View File

@ -17,11 +17,15 @@ limitations under the License.
package framework
import (
"fmt"
"time"
apierrors "k8s.io/kubernetes/pkg/api/errors"
legacyv1 "k8s.io/kubernetes/pkg/api/v1"
authorizationv1beta1 "k8s.io/kubernetes/pkg/apis/authorization/v1beta1"
rbacv1alpha1 "k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
v1beta1authorization "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/authorization/v1beta1"
v1alpha1rbac "k8s.io/kubernetes/pkg/client/clientset_generated/clientset/typed/rbac/v1alpha1"
"k8s.io/kubernetes/pkg/runtime/schema"
"k8s.io/kubernetes/pkg/util/wait"
)
@ -50,6 +54,7 @@ func WaitForAuthorizationUpdate(c v1beta1authorization.SubjectAccessReviewsGette
// GKE doesn't enable the SAR endpoint. Without this endpoint, we cannot determine if the policy engine
// has adjusted as expected. In this case, simply wait one second and hope it's up to date
if apierrors.IsNotFound(err) {
fmt.Printf("SubjectAccessReview endpoint is missing\n")
time.Sleep(1 * time.Second)
return true, nil
}
@ -63,3 +68,45 @@ func WaitForAuthorizationUpdate(c v1beta1authorization.SubjectAccessReviewsGette
})
return err
}
// BindClusterRole binds the cluster role at the cluster scope
func BindClusterRole(c v1alpha1rbac.ClusterRoleBindingsGetter, clusterRole, ns string, subjects ...rbacv1alpha1.Subject) {
// Since the namespace names are unique, we can leave this lying around so we don't have to race any caches
_, err := c.ClusterRoleBindings().Create(&rbacv1alpha1.ClusterRoleBinding{
ObjectMeta: legacyv1.ObjectMeta{
Name: ns + "--" + clusterRole,
},
RoleRef: rbacv1alpha1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: clusterRole,
},
Subjects: subjects,
})
// if we failed, don't fail the entire test because it may still work. RBAC may simply be disabled.
if err != nil {
fmt.Printf("Error binding clusterrole/%s for %q for %v\n", clusterRole, ns, subjects)
}
}
// BindClusterRoleInNamespace binds the cluster role at the namespace scope
func BindClusterRoleInNamespace(c v1alpha1rbac.RoleBindingsGetter, clusterRole, ns string, subjects ...rbacv1alpha1.Subject) {
// Since the namespace names are unique, we can leave this lying around so we don't have to race any caches
_, err := c.RoleBindings(ns).Create(&rbacv1alpha1.RoleBinding{
ObjectMeta: legacyv1.ObjectMeta{
Name: ns + "--" + clusterRole,
},
RoleRef: rbacv1alpha1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: clusterRole,
},
Subjects: subjects,
})
// if we failed, don't fail the entire test because it may still work. RBAC may simply be disabled.
if err != nil {
fmt.Printf("Error binding clusterrole/%s into %q for %v\n", clusterRole, ns, subjects)
}
}

31
test/e2e/ingress.go
View File

@ -21,8 +21,6 @@ import (
"path/filepath"
"time"
apierrors "k8s.io/kubernetes/pkg/api/errors"
legacyv1 "k8s.io/kubernetes/pkg/api/v1"
rbacv1alpha1 "k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
"k8s.io/kubernetes/pkg/runtime/schema"
"k8s.io/kubernetes/pkg/serviceaccount"
@ -78,33 +76,10 @@ var _ = framework.KubeDescribe("Loadbalancing: L7", func() {
// this test wants powerful permissions. Since the namespace names are unique, we can leave this
// lying around so we don't have to race any caches
_, err := jig.client.Rbac().ClusterRoleBindings().Create(&rbacv1alpha1.ClusterRoleBinding{
ObjectMeta: legacyv1.ObjectMeta{
Name: f.Namespace.Name + "--cluster-admin",
},
RoleRef: rbacv1alpha1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "cluster-admin",
},
Subjects: []rbacv1alpha1.Subject{
{
Kind: rbacv1alpha1.ServiceAccountKind,
Namespace: f.Namespace.Name,
Name: "default",
},
},
})
if apierrors.IsForbidden(err) {
// The user is not allowed to create ClusterRoleBindings. This
// probably means that RBAC is not being used. If RBAC is being
// used, this test will probably fail later.
framework.Logf("Attempt to create ClusterRoleBinding was forbidden: %v.", err)
return
}
framework.ExpectNoError(err)
framework.BindClusterRole(jig.client.Rbac(), "cluster-admin", f.Namespace.Name,
rbacv1alpha1.Subject{Kind: rbacv1alpha1.ServiceAccountKind, Namespace: f.Namespace.Name, Name: "default"})
err = framework.WaitForAuthorizationUpdate(jig.client.Authorization(),
err := framework.WaitForAuthorizationUpdate(jig.client.Authorization(),
serviceaccount.MakeUsername(f.Namespace.Name, "default"),
"", "create", schema.GroupResource{Resource: "pods"}, true)
framework.ExpectNoError(err)

16
test/e2e/kubectl.go
View File

@ -46,11 +46,14 @@ import (
"k8s.io/kubernetes/pkg/api/resource"
"k8s.io/kubernetes/pkg/api/v1"
metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
rbacv1alpha1 "k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
clientset "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
"k8s.io/kubernetes/pkg/controller"
"k8s.io/kubernetes/pkg/kubectl/cmd/util"
"k8s.io/kubernetes/pkg/labels"
genericregistry "k8s.io/kubernetes/pkg/registry/generic/registry"
"k8s.io/kubernetes/pkg/runtime/schema"
"k8s.io/kubernetes/pkg/serviceaccount"
uexec "k8s.io/kubernetes/pkg/util/exec"
utilnet "k8s.io/kubernetes/pkg/util/net"
"k8s.io/kubernetes/pkg/util/uuid"
@ -566,6 +569,16 @@ var _ = framework.KubeDescribe("Kubectl client", func() {
})
It("should handle in-cluster config", func() {
By("adding rbac permissions")
// grant the view permission widely to allow inspection of the `invalid` namespace.
framework.BindClusterRole(f.ClientSet.Rbac(), "view", f.Namespace.Name,
rbacv1alpha1.Subject{Kind: rbacv1alpha1.ServiceAccountKind, Namespace: f.Namespace.Name, Name: "default"})
err := framework.WaitForAuthorizationUpdate(f.ClientSet.Authorization(),
serviceaccount.MakeUsername(f.Namespace.Name, "default"),
f.Namespace.Name, "list", schema.GroupResource{Resource: "pods"}, true)
framework.ExpectNoError(err)
By("overriding icc with values provided by flags")
kubectlPath := framework.TestContext.KubectlPath
@ -580,7 +593,7 @@ var _ = framework.KubeDescribe("Kubectl client", func() {
}
By("trying to use kubectl with invalid token")
_, err := framework.RunHostCmd(ns, simplePodName, "/kubectl get pods --token=invalid --v=7 2>&1")
_, err = framework.RunHostCmd(ns, simplePodName, "/kubectl get pods --token=invalid --v=7 2>&1")
framework.Logf("got err %v", err)
Expect(err).To(HaveOccurred())
Expect(err).To(ContainSubstring("Using in-cluster namespace"))
@ -604,7 +617,6 @@ var _ = framework.KubeDescribe("Kubectl client", func() {
if matched, _ := regexp.MatchString(fmt.Sprintf("GET http[s]?://%s:%s/api/v1/namespaces/invalid/pods", inClusterHost, inClusterPort), output); !matched {
framework.Failf("Unexpected kubectl exec output: ", output)
}
})
})

31
test/e2e/node_problem_detector.go
View File

@ -23,9 +23,7 @@ import (
"time"
"k8s.io/kubernetes/pkg/api"
apierrors "k8s.io/kubernetes/pkg/api/errors"
"k8s.io/kubernetes/pkg/api/v1"
legacyv1 "k8s.io/kubernetes/pkg/api/v1"
metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
rbacv1alpha1 "k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
clientset "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
@ -65,33 +63,10 @@ var _ = framework.KubeDescribe("NodeProblemDetector", func() {
// this test wants extra permissions. Since the namespace names are unique, we can leave this
// lying around so we don't have to race any caches
_, err := f.ClientSet.Rbac().ClusterRoleBindings().Create(&rbacv1alpha1.ClusterRoleBinding{
ObjectMeta: legacyv1.ObjectMeta{
Name: f.Namespace.Name + "--cluster-admin",
},
RoleRef: rbacv1alpha1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "cluster-admin",
},
Subjects: []rbacv1alpha1.Subject{
{
Kind: rbacv1alpha1.ServiceAccountKind,
Namespace: f.Namespace.Name,
Name: "default",
},
},
})
if apierrors.IsForbidden(err) {
// The user is not allowed to create ClusterRoleBindings. This
// probably means that RBAC is not being used. If RBAC is being
// used, this test will probably fail later.
framework.Logf("Attempt to create ClusterRoleBinding was forbidden: %v.", err)
return
}
framework.ExpectNoError(err)
framework.BindClusterRole(f.ClientSet.Rbac(), "cluster-admin", f.Namespace.Name,
rbacv1alpha1.Subject{Kind: rbacv1alpha1.ServiceAccountKind, Namespace: f.Namespace.Name, Name: "default"})
err = framework.WaitForAuthorizationUpdate(f.ClientSet.Authorization(),
err := framework.WaitForAuthorizationUpdate(f.ClientSet.Authorization(),
serviceaccount.MakeUsername(f.Namespace.Name, "default"),
"", "create", schema.GroupResource{Resource: "pods"}, true)
framework.ExpectNoError(err)

31
test/e2e/pre_stop.go
View File

@ -21,9 +21,7 @@ import (
"fmt"
"time"
apierrors "k8s.io/kubernetes/pkg/api/errors"
"k8s.io/kubernetes/pkg/api/v1"
legacyv1 "k8s.io/kubernetes/pkg/api/v1"
metav1 "k8s.io/kubernetes/pkg/apis/meta/v1"
rbacv1alpha1 "k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
clientset "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"
@ -171,33 +169,10 @@ var _ = framework.KubeDescribe("PreStop", func() {
BeforeEach(func() {
// this test wants extra permissions. Since the namespace names are unique, we can leave this
// lying around so we don't have to race any caches
_, err := f.ClientSet.Rbac().ClusterRoleBindings().Create(&rbacv1alpha1.ClusterRoleBinding{
ObjectMeta: legacyv1.ObjectMeta{
Name: f.Namespace.Name + "--cluster-admin",
},
RoleRef: rbacv1alpha1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "cluster-admin",
},
Subjects: []rbacv1alpha1.Subject{
{
Kind: rbacv1alpha1.ServiceAccountKind,
Namespace: f.Namespace.Name,
Name: "default",
},
},
})
if apierrors.IsForbidden(err) {
// The user is not allowed to create ClusterRoleBindings. This
// probably means that RBAC is not being used. If RBAC is being
// used, this test will probably fail later.
framework.Logf("Attempt to create ClusterRoleBinding was forbidden: %v.", err)
return
}
framework.ExpectNoError(err)
framework.BindClusterRole(f.ClientSet.Rbac(), "cluster-admin", f.Namespace.Name,
rbacv1alpha1.Subject{Kind: rbacv1alpha1.ServiceAccountKind, Namespace: f.Namespace.Name, Name: "default"})
err = framework.WaitForAuthorizationUpdate(f.ClientSet.Authorization(),
err := framework.WaitForAuthorizationUpdate(f.ClientSet.Authorization(),
serviceaccount.MakeUsername(f.Namespace.Name, "default"),
"", "create", schema.GroupResource{Resource: "pods"}, true)
framework.ExpectNoError(err)