pkg/apis: rbac types added

pkg/apis/rbac/validation/cast.go

@@ -0,0 +1,107 @@
+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import "k8s.io/kubernetes/pkg/apis/rbac"
+
+// Casting utilities to and from "Cluster" level equivalents.
+
+func toClusterRole(in *rbac.Role) *rbac.ClusterRole {
+	if in == nil {
+		return nil
+	}
+
+	ret := &rbac.ClusterRole{}
+	ret.ObjectMeta = in.ObjectMeta
+	ret.Rules = in.Rules
+
+	return ret
+}
+
+func toClusterRoleList(in *rbac.RoleList) *rbac.ClusterRoleList {
+	ret := &rbac.ClusterRoleList{}
+	for _, curr := range in.Items {
+		ret.Items = append(ret.Items, *toClusterRole(&curr))
+	}
+
+	return ret
+}
+
+func toClusterRoleBinding(in *rbac.RoleBinding) *rbac.ClusterRoleBinding {
+	if in == nil {
+		return nil
+	}
+
+	ret := &rbac.ClusterRoleBinding{}
+	ret.ObjectMeta = in.ObjectMeta
+	ret.Subjects = in.Subjects
+	ret.RoleRef = in.RoleRef
+
+	return ret
+}
+
+func toClusterRoleBindingList(in *rbac.RoleBindingList) *rbac.ClusterRoleBindingList {
+	ret := &rbac.ClusterRoleBindingList{}
+	for _, curr := range in.Items {
+		ret.Items = append(ret.Items, *toClusterRoleBinding(&curr))
+	}
+
+	return ret
+}
+
+func toRole(in *rbac.ClusterRole) *rbac.Role {
+	if in == nil {
+		return nil
+	}
+
+	ret := &rbac.Role{}
+	ret.ObjectMeta = in.ObjectMeta
+	ret.Rules = in.Rules
+
+	return ret
+}
+
+func toRoleList(in *rbac.ClusterRoleList) *rbac.RoleList {
+	ret := &rbac.RoleList{}
+	for _, curr := range in.Items {
+		ret.Items = append(ret.Items, *toRole(&curr))
+	}
+
+	return ret
+}
+
+func toRoleBinding(in *rbac.ClusterRoleBinding) *rbac.RoleBinding {
+	if in == nil {
+		return nil
+	}
+
+	ret := &rbac.RoleBinding{}
+	ret.ObjectMeta = in.ObjectMeta
+	ret.Subjects = in.Subjects
+	ret.RoleRef = in.RoleRef
+
+	return ret
+}
+
+func toRoleBindingList(in *rbac.ClusterRoleBindingList) *rbac.RoleBindingList {
+	ret := &rbac.RoleBindingList{}
+	for _, curr := range in.Items {
+		ret.Items = append(ret.Items, *toRoleBinding(&curr))
+	}
+
+	return ret
+}

pkg/apis/rbac/validation/validation.go

@@ -0,0 +1,157 @@
+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"k8s.io/kubernetes/pkg/api/validation"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/util/validation/field"
+)
+
+// Minimal validation of names for roles and bindings. Identical to the validation for Openshift. See:
+// * https://github.com/kubernetes/kubernetes/blob/60db50/pkg/api/validation/name.go
+// * https://github.com/openshift/origin/blob/388478/pkg/api/helpers.go
+func minimalNameRequirements(name string, prefix bool) (bool, string) {
+	return validation.IsValidPathSegmentName(name)
+}
+
+func ValidateLocalRole(policy *rbac.Role) field.ErrorList {
+	return ValidateRole(policy, true)
+}
+
+func ValidateLocalRoleUpdate(policy *rbac.Role, oldRole *rbac.Role) field.ErrorList {
+	return ValidateRoleUpdate(policy, oldRole, true)
+}
+
+func ValidateClusterRole(policy *rbac.ClusterRole) field.ErrorList {
+	return ValidateRole(toRole(policy), false)
+}
+
+func ValidateClusterRoleUpdate(policy *rbac.ClusterRole, oldRole *rbac.ClusterRole) field.ErrorList {
+	return ValidateRoleUpdate(toRole(policy), toRole(oldRole), false)
+}
+
+func ValidateRole(role *rbac.Role, isNamespaced bool) field.ErrorList {
+	return validateRole(role, isNamespaced, nil)
+}
+
+func validateRole(role *rbac.Role, isNamespaced bool, fldPath *field.Path) field.ErrorList {
+	return validation.ValidateObjectMeta(&role.ObjectMeta, isNamespaced, minimalNameRequirements, fldPath.Child("metadata"))
+}
+
+func ValidateRoleUpdate(role *rbac.Role, oldRole *rbac.Role, isNamespaced bool) field.ErrorList {
+	allErrs := ValidateRole(role, isNamespaced)
+	allErrs = append(allErrs, validation.ValidateObjectMetaUpdate(&role.ObjectMeta, &oldRole.ObjectMeta, field.NewPath("metadata"))...)
+
+	return allErrs
+}
+
+func ValidateLocalRoleBinding(policy *rbac.RoleBinding) field.ErrorList {
+	return ValidateRoleBinding(policy, true)
+}
+
+func ValidateLocalRoleBindingUpdate(policy *rbac.RoleBinding, oldRoleBinding *rbac.RoleBinding) field.ErrorList {
+	return ValidateRoleBindingUpdate(policy, oldRoleBinding, true)
+}
+
+func ValidateClusterRoleBinding(policy *rbac.ClusterRoleBinding) field.ErrorList {
+	return ValidateRoleBinding(toRoleBinding(policy), false)
+}
+
+func ValidateClusterRoleBindingUpdate(policy *rbac.ClusterRoleBinding, oldRoleBinding *rbac.ClusterRoleBinding) field.ErrorList {
+	return ValidateRoleBindingUpdate(toRoleBinding(policy), toRoleBinding(oldRoleBinding), false)
+}
+
+func ValidateRoleBinding(roleBinding *rbac.RoleBinding, isNamespaced bool) field.ErrorList {
+	return validateRoleBinding(roleBinding, isNamespaced, nil)
+}
+
+func validateRoleBinding(roleBinding *rbac.RoleBinding, isNamespaced bool, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, validation.ValidateObjectMeta(&roleBinding.ObjectMeta, isNamespaced, minimalNameRequirements, fldPath.Child("metadata"))...)
+
+	// roleRef namespace is empty when referring to global policy.
+	if len(roleBinding.RoleRef.Namespace) > 0 {
+		if ok, reason := validation.ValidateNamespaceName(roleBinding.RoleRef.Namespace, false); !ok {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("roleRef", "namespace"), roleBinding.RoleRef.Namespace, reason))
+		}
+	}
+
+	if len(roleBinding.RoleRef.Name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("roleRef", "name"), ""))
+	} else {
+		if valid, err := minimalNameRequirements(roleBinding.RoleRef.Name, false); !valid {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("roleRef", "name"), roleBinding.RoleRef.Name, err))
+		}
+	}
+
+	subjectsPath := field.NewPath("subjects")
+	for i, subject := range roleBinding.Subjects {
+		allErrs = append(allErrs, validateRoleBindingSubject(subject, isNamespaced, subjectsPath.Index(i))...)
+	}
+
+	return allErrs
+}
+
+func validateRoleBindingSubject(subject rbac.Subject, isNamespaced bool, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+
+	if len(subject.Name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), ""))
+	}
+	if len(subject.APIVersion) != 0 {
+		allErrs = append(allErrs, field.Forbidden(fldPath.Child("apiVersion"), subject.APIVersion))
+	}
+
+	switch subject.Kind {
+	case rbac.ServiceAccountKind:
+		if valid, reason := validation.ValidateServiceAccountName(subject.Name, false); len(subject.Name) > 0 && !valid {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), subject.Name, reason))
+		}
+		if !isNamespaced && len(subject.Namespace) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("namespace"), ""))
+		}
+
+	case rbac.UserKind:
+		// TODO(ericchiang): What other restrictions on user name are there?
+		if len(subject.Name) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), subject.Name, "user name cannot be empty"))
+		}
+
+	case rbac.GroupKind:
+		// TODO(ericchiang): What other restrictions on group name are there?
+		if len(subject.Name) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), subject.Name, "group name cannot be empty"))
+		}
+
+	default:
+		allErrs = append(allErrs, field.NotSupported(fldPath.Child("kind"), subject.Kind, []string{rbac.ServiceAccountKind, rbac.UserKind, rbac.GroupKind}))
+	}
+
+	return allErrs
+}
+
+func ValidateRoleBindingUpdate(roleBinding *rbac.RoleBinding, oldRoleBinding *rbac.RoleBinding, isNamespaced bool) field.ErrorList {
+	allErrs := ValidateRoleBinding(roleBinding, isNamespaced)
+	allErrs = append(allErrs, validation.ValidateObjectMetaUpdate(&roleBinding.ObjectMeta, &oldRoleBinding.ObjectMeta, field.NewPath("metadata"))...)
+
+	if oldRoleBinding.RoleRef != roleBinding.RoleRef {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("roleRef"), roleBinding.RoleRef, "cannot change roleRef"))
+	}
+
+	return allErrs
+}

pkg/apis/rbac/validation/validation_test.go

@@ -0,0 +1,230 @@
+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"testing"
+
+	api "k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/util/validation/field"
+)
+
+func TestValidateRoleBinding(t *testing.T) {
+	errs := ValidateRoleBinding(
+		&rbac.RoleBinding{
+			ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+			RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+			Subjects: []rbac.Subject{
+				{Name: "validsaname", Kind: rbac.ServiceAccountKind},
+				{Name: "valid@username", Kind: rbac.UserKind},
+				{Name: "valid@groupname", Kind: rbac.GroupKind},
+			},
+		},
+		true,
+	)
+	if len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string]struct {
+		A rbac.RoleBinding
+		T field.ErrorType
+		F string
+	}{
+		"zero-length namespace": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Name: "default"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+			},
+			T: field.ErrorTypeRequired,
+			F: "metadata.namespace",
+		},
+		"zero-length name": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+			},
+			T: field.ErrorTypeRequired,
+			F: "metadata.name",
+		},
+		"invalid ref": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "name"},
+				RoleRef:    api.ObjectReference{Namespace: "-192083", Name: "valid"},
+			},
+			T: field.ErrorTypeInvalid,
+			F: "roleRef.namespace",
+		},
+		"bad role": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "default"},
+				RoleRef:    api.ObjectReference{Namespace: "default"},
+			},
+			T: field.ErrorTypeRequired,
+			F: "roleRef.name",
+		},
+		"bad subject kind": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+				Subjects:   []rbac.Subject{{Name: "subject"}},
+			},
+			T: field.ErrorTypeNotSupported,
+			F: "subjects[0].kind",
+		},
+		"bad subject name": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+				Subjects:   []rbac.Subject{{Name: "subject:bad", Kind: rbac.ServiceAccountKind}},
+			},
+			T: field.ErrorTypeInvalid,
+			F: "subjects[0].name",
+		},
+		"forbidden fields": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+				Subjects:   []rbac.Subject{{Name: "subject", Kind: rbac.ServiceAccountKind, APIVersion: "foo"}},
+			},
+			T: field.ErrorTypeForbidden,
+			F: "subjects[0].apiVersion",
+		},
+		"missing subject name": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+				Subjects:   []rbac.Subject{{Kind: rbac.ServiceAccountKind}},
+			},
+			T: field.ErrorTypeRequired,
+			F: "subjects[0].name",
+		},
+	}
+	for k, v := range errorCases {
+		errs := ValidateRoleBinding(&v.A, true)
+		if len(errs) == 0 {
+			t.Errorf("expected failure %s for %v", k, v.A)
+			continue
+		}
+		for i := range errs {
+			if errs[i].Type != v.T {
+				t.Errorf("%s: expected errors to have type %s: %v", k, v.T, errs[i])
+			}
+			if errs[i].Field != v.F {
+				t.Errorf("%s: expected errors to have field %s: %v", k, v.F, errs[i])
+			}
+		}
+	}
+}
+
+func TestValidateRoleBindingUpdate(t *testing.T) {
+	old := &rbac.RoleBinding{
+		ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master", ResourceVersion: "1"},
+		RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+	}
+
+	errs := ValidateRoleBindingUpdate(
+		&rbac.RoleBinding{
+			ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master", ResourceVersion: "1"},
+			RoleRef:    api.ObjectReference{Namespace: "master", Name: "valid"},
+		},
+		old,
+		true,
+	)
+	if len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string]struct {
+		A rbac.RoleBinding
+		T field.ErrorType
+		F string
+	}{
+		"changedRef": {
+			A: rbac.RoleBinding{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master", ResourceVersion: "1"},
+				RoleRef:    api.ObjectReference{Namespace: "master", Name: "changed"},
+			},
+			T: field.ErrorTypeInvalid,
+			F: "roleRef",
+		},
+	}
+	for k, v := range errorCases {
+		errs := ValidateRoleBindingUpdate(&v.A, old, true)
+		if len(errs) == 0 {
+			t.Errorf("expected failure %s for %v", k, v.A)
+			continue
+		}
+		for i := range errs {
+			if errs[i].Type != v.T {
+				t.Errorf("%s: expected errors to have type %s: %v", k, v.T, errs[i])
+			}
+			if errs[i].Field != v.F {
+				t.Errorf("%s: expected errors to have field %s: %v", k, v.F, errs[i])
+			}
+		}
+	}
+}
+
+func TestValidateRole(t *testing.T) {
+	errs := ValidateRole(
+		&rbac.Role{
+			ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault, Name: "master"},
+		},
+		true,
+	)
+	if len(errs) != 0 {
+		t.Errorf("expected success: %v", errs)
+	}
+
+	errorCases := map[string]struct {
+		A rbac.Role
+		T field.ErrorType
+		F string
+	}{
+		"zero-length namespace": {
+			A: rbac.Role{
+				ObjectMeta: api.ObjectMeta{Name: "default"},
+			},
+			T: field.ErrorTypeRequired,
+			F: "metadata.namespace",
+		},
+		"zero-length name": {
+			A: rbac.Role{
+				ObjectMeta: api.ObjectMeta{Namespace: api.NamespaceDefault},
+			},
+			T: field.ErrorTypeRequired,
+			F: "metadata.name",
+		},
+	}
+	for k, v := range errorCases {
+		errs := ValidateRole(&v.A, true)
+		if len(errs) == 0 {
+			t.Errorf("expected failure %s for %v", k, v.A)
+			continue
+		}
+		for i := range errs {
+			if errs[i].Type != v.T {
+				t.Errorf("%s: expected errors to have type %s: %v", k, v.T, errs[i])
+			}
+			if errs[i].Field != v.F {
+				t.Errorf("%s: expected errors to have field %s: %v", k, v.F, errs[i])
+			}
+		}
+	}
+}