mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-08-05 10:19:50 +00:00
provides RequestHeaderAuthRequestController for dynamically filling RequestHeaderConfig struct
This commit is contained in:
Lukasz Szaszkiewicz
parent
d3d870f051
commit
6e0211b3d8
@ -0,0 +1,319 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2020 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package headerrequest
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/api/equality"
|
||||||
|
"k8s.io/apimachinery/pkg/api/errors"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||||
|
"k8s.io/apimachinery/pkg/util/wait"
|
||||||
|
coreinformers "k8s.io/client-go/informers/core/v1"
|
||||||
|
"k8s.io/client-go/kubernetes"
|
||||||
|
corev1listers "k8s.io/client-go/listers/core/v1"
|
||||||
|
"k8s.io/client-go/tools/cache"
|
||||||
|
"k8s.io/client-go/util/workqueue"
|
||||||
|
"k8s.io/klog"
|
||||||
|
"sync/atomic"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
authenticationRoleName = "extension-apiserver-authentication-reader"
|
||||||
|
)
|
||||||
|
|
||||||
|
type requestHeaderBundle struct {
|
||||||
|
UsernameHeaders []string
|
||||||
|
GroupHeaders []string
|
||||||
|
ExtraHeaderPrefixes []string
|
||||||
|
AllowedClientNames []string
|
||||||
|
}
|
||||||
|
|
||||||
|
// RequestHeaderAuthRequestController a controller that exposes a set of methods for dynamically filling RequestHeaderConfig struct.
|
||||||
|
// The methods are sourced from the config map which is being monitored by this controller.
|
||||||
|
// The controller is primed from the server at the construction time for components that don't want to dynamically react to changes
|
||||||
|
// in the config map.
|
||||||
|
type RequestHeaderAuthRequestController struct {
|
||||||
|
name string
|
||||||
|
|
||||||
|
configmapName string
|
||||||
|
configmapNamespace string
|
||||||
|
|
||||||
|
configmapLister corev1listers.ConfigMapNamespaceLister
|
||||||
|
configmapInformerSynced cache.InformerSynced
|
||||||
|
|
||||||
|
queue workqueue.RateLimitingInterface
|
||||||
|
|
||||||
|
// exportedRequestHeaderBundle is a requestHeaderBundle that contains the last read, non-zero length content of the configmap
|
||||||
|
exportedRequestHeaderBundle atomic.Value
|
||||||
|
|
||||||
|
usernameHeadersKey string
|
||||||
|
groupHeadersKey string
|
||||||
|
extraHeaderPrefixesKey string
|
||||||
|
allowedClientNamesKey string
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewRequestHeaderAuthRequestController creates a new controller that implements RequestHeaderAuthRequestController
|
||||||
|
func NewRequestHeaderAuthRequestController(
|
||||||
|
cmName string,
|
||||||
|
cmNamespace string,
|
||||||
|
client kubernetes.Interface,
|
||||||
|
cmInformer coreinformers.ConfigMapInformer,
|
||||||
|
usernameHeadersKey, groupHeadersKey, extraHeaderPrefixesKey, allowedClientNamesKey string) (*RequestHeaderAuthRequestController, error) {
|
||||||
|
c := &RequestHeaderAuthRequestController{
|
||||||
|
name: "RequestHeaderAuthRequestController",
|
||||||
|
|
||||||
|
configmapName: cmName,
|
||||||
|
configmapNamespace: cmNamespace,
|
||||||
|
|
||||||
|
usernameHeadersKey: usernameHeadersKey,
|
||||||
|
groupHeadersKey: groupHeadersKey,
|
||||||
|
extraHeaderPrefixesKey: extraHeaderPrefixesKey,
|
||||||
|
allowedClientNamesKey: allowedClientNamesKey,
|
||||||
|
|
||||||
|
queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "RequestHeaderAuthRequestController"),
|
||||||
|
}
|
||||||
|
|
||||||
|
// use the live client to prime the controller
|
||||||
|
if err := c.syncOnce(client); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
cmInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
|
||||||
|
FilterFunc: func(obj interface{}) bool {
|
||||||
|
if cast, ok := obj.(*corev1.ConfigMap); ok {
|
||||||
|
return cast.Name == c.configmapName && cast.Namespace == c.configmapNamespace
|
||||||
|
}
|
||||||
|
if tombstone, ok := obj.(cache.DeletedFinalStateUnknown); ok {
|
||||||
|
if cast, ok := tombstone.Obj.(*corev1.ConfigMap); ok {
|
||||||
|
return cast.Name == c.configmapName && cast.Namespace == c.configmapNamespace
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return true // always return true just in case. The checks are fairly cheap
|
||||||
|
},
|
||||||
|
Handler: cache.ResourceEventHandlerFuncs{
|
||||||
|
// we have a filter, so any time we're called, we may as well queue. We only ever check one configmap
|
||||||
|
// so we don't have to be choosy about our key.
|
||||||
|
AddFunc: func(obj interface{}) {
|
||||||
|
c.queue.Add(c.keyFn())
|
||||||
|
},
|
||||||
|
UpdateFunc: func(oldObj, newObj interface{}) {
|
||||||
|
c.queue.Add(c.keyFn())
|
||||||
|
},
|
||||||
|
DeleteFunc: func(obj interface{}) {
|
||||||
|
c.queue.Add(c.keyFn())
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
c.configmapLister = cmInformer.Lister().ConfigMaps(c.configmapNamespace)
|
||||||
|
c.configmapInformerSynced = cmInformer.Informer().HasSynced
|
||||||
|
|
||||||
|
return c, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) UsernameHeaders() []string {
|
||||||
|
return c.loadRequestHeaderFor(c.usernameHeadersKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) GroupHeaders() []string {
|
||||||
|
return c.loadRequestHeaderFor(c.groupHeadersKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) ExtraHeaderPrefixes() []string {
|
||||||
|
return c.loadRequestHeaderFor(c.extraHeaderPrefixesKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) AllowedClientNames() []string {
|
||||||
|
return c.loadRequestHeaderFor(c.allowedClientNamesKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Run starts RequestHeaderAuthRequestController controller and blocks until stopCh is closed.
|
||||||
|
func (c *RequestHeaderAuthRequestController) Run(workers int, stopCh <-chan struct{}) {
|
||||||
|
defer utilruntime.HandleCrash()
|
||||||
|
defer c.queue.ShutDown()
|
||||||
|
|
||||||
|
klog.Infof("Starting %s", c.name)
|
||||||
|
defer klog.Infof("Shutting down %s", c.name)
|
||||||
|
|
||||||
|
// wait for caches to fill before starting your work
|
||||||
|
if !cache.WaitForNamedCacheSync(c.name, stopCh, c.configmapInformerSynced) {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// doesn't matter what workers say, only start one.
|
||||||
|
go wait.Until(c.runWorker, time.Second, stopCh)
|
||||||
|
|
||||||
|
<-stopCh
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) runWorker() {
|
||||||
|
for c.processNextWorkItem() {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) processNextWorkItem() bool {
|
||||||
|
dsKey, quit := c.queue.Get()
|
||||||
|
if quit {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
defer c.queue.Done(dsKey)
|
||||||
|
|
||||||
|
err := c.sync()
|
||||||
|
if err == nil {
|
||||||
|
c.queue.Forget(dsKey)
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
utilruntime.HandleError(fmt.Errorf("%v failed with : %v", dsKey, err))
|
||||||
|
c.queue.AddRateLimited(dsKey)
|
||||||
|
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) syncOnce(client kubernetes.Interface) error {
|
||||||
|
configMap, err := client.CoreV1().ConfigMaps(c.configmapNamespace).Get(context.TODO(), c.configmapName, metav1.GetOptions{})
|
||||||
|
switch {
|
||||||
|
case errors.IsNotFound(err):
|
||||||
|
// ignore, authConfigMap is nil now
|
||||||
|
return nil
|
||||||
|
case errors.IsForbidden(err):
|
||||||
|
klog.Warningf("Unable to get configmap/%s in %s. Usually fixed by "+
|
||||||
|
"'kubectl create rolebinding -n %s ROLEBINDING_NAME --role=%s --serviceaccount=YOUR_NS:YOUR_SA'",
|
||||||
|
c.configmapName, c.configmapNamespace, c.configmapNamespace, authenticationRoleName)
|
||||||
|
return err
|
||||||
|
case err != nil:
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return c.syncConfigMap(configMap)
|
||||||
|
}
|
||||||
|
|
||||||
|
// sync reads the config and propagates the changes to exportedRequestHeaderBundle
|
||||||
|
// which is exposed by the set of methods that are used to fill RequestHeaderConfig struct
|
||||||
|
func (c *RequestHeaderAuthRequestController) sync() error {
|
||||||
|
configMap, err := c.configmapLister.Get(c.configmapName)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return c.syncConfigMap(configMap)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) syncConfigMap(configMap *corev1.ConfigMap) error {
|
||||||
|
hasChanged, newRequestHeaderBundle, err := c.hasRequestHeaderBundleChanged(configMap)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if hasChanged {
|
||||||
|
c.exportedRequestHeaderBundle.Store(newRequestHeaderBundle)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) hasRequestHeaderBundleChanged(cm *corev1.ConfigMap) (bool, *requestHeaderBundle, error) {
|
||||||
|
currentHeadersBundle, err := c.getRequestHeaderBundleFromConfigMap(cm)
|
||||||
|
if err != nil {
|
||||||
|
return false, nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
rawHeaderBundle := c.exportedRequestHeaderBundle.Load()
|
||||||
|
if rawHeaderBundle == nil {
|
||||||
|
return true, currentHeadersBundle, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// check to see if we have a change. If the values are the same, do nothing.
|
||||||
|
loadedHeadersBundle, ok := rawHeaderBundle.(*requestHeaderBundle)
|
||||||
|
if !ok {
|
||||||
|
return true, currentHeadersBundle, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if !equality.Semantic.DeepEqual(loadedHeadersBundle, currentHeadersBundle) {
|
||||||
|
return true, currentHeadersBundle, nil
|
||||||
|
}
|
||||||
|
return false, nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) getRequestHeaderBundleFromConfigMap(cm *corev1.ConfigMap) (*requestHeaderBundle, error) {
|
||||||
|
usernameHeaderCurrentValue, err := deserializeStrings(cm.Data[c.usernameHeadersKey])
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
groupHeadersCurrentValue, err := deserializeStrings(cm.Data[c.groupHeadersKey])
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
extraHeaderPrefixesCurrentValue, err := deserializeStrings(cm.Data[c.extraHeaderPrefixesKey])
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
allowedClientNamesCurrentValue, err := deserializeStrings(cm.Data[c.allowedClientNamesKey])
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &requestHeaderBundle{
|
||||||
|
UsernameHeaders: usernameHeaderCurrentValue,
|
||||||
|
GroupHeaders: groupHeadersCurrentValue,
|
||||||
|
ExtraHeaderPrefixes: extraHeaderPrefixesCurrentValue,
|
||||||
|
AllowedClientNames: allowedClientNamesCurrentValue,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) loadRequestHeaderFor(key string) []string {
|
||||||
|
rawHeaderBundle := c.exportedRequestHeaderBundle.Load()
|
||||||
|
if rawHeaderBundle == nil {
|
||||||
|
return nil // this can happen if we've been unable load data from the apiserver for some reason
|
||||||
|
}
|
||||||
|
headerBundle := rawHeaderBundle.(*requestHeaderBundle)
|
||||||
|
|
||||||
|
switch key {
|
||||||
|
case c.usernameHeadersKey:
|
||||||
|
return headerBundle.UsernameHeaders
|
||||||
|
case c.groupHeadersKey:
|
||||||
|
return headerBundle.GroupHeaders
|
||||||
|
case c.extraHeaderPrefixesKey:
|
||||||
|
return headerBundle.ExtraHeaderPrefixes
|
||||||
|
case c.allowedClientNamesKey:
|
||||||
|
return headerBundle.AllowedClientNames
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *RequestHeaderAuthRequestController) keyFn() string {
|
||||||
|
// this format matches DeletionHandlingMetaNamespaceKeyFunc for our single key
|
||||||
|
return c.configmapNamespace + "/" + c.configmapName
|
||||||
|
}
|
||||||
|
|
||||||
|
func deserializeStrings(in string) ([]string, error) {
|
||||||
|
if len(in) == 0 {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
var ret []string
|
||||||
|
if err := json.Unmarshal([]byte(in), &ret); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return ret, nil
|
||||||
|
}
|
||||||
@ -0,0 +1,284 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2020 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package headerrequest
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"k8s.io/apimachinery/pkg/api/equality"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
"k8s.io/client-go/kubernetes/fake"
|
||||||
|
corev1listers "k8s.io/client-go/listers/core/v1"
|
||||||
|
"k8s.io/client-go/tools/cache"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
defConfigMapName = "extension-apiserver-authentication"
|
||||||
|
defConfigMapNamespace = "kube-system"
|
||||||
|
|
||||||
|
defUsernameHeadersKey = "user-key"
|
||||||
|
defGroupHeadersKey = "group-key"
|
||||||
|
defExtraHeaderPrefixesKey = "extra-key"
|
||||||
|
defAllowedClientNamesKey = "names-key"
|
||||||
|
)
|
||||||
|
|
||||||
|
type expectedHeadersHolder struct {
|
||||||
|
usernameHeaders []string
|
||||||
|
groupHeaders []string
|
||||||
|
extraHeaderPrefixes []string
|
||||||
|
allowedClientNames []string
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRequestHeaderAuthRequestController(t *testing.T) {
|
||||||
|
scenarios := []struct {
|
||||||
|
name string
|
||||||
|
cm *corev1.ConfigMap
|
||||||
|
expectedHeader expectedHeadersHolder
|
||||||
|
expectErr bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "happy-path: headers values are populated form a config map",
|
||||||
|
cm: defaultConfigMap(t, []string{"user-val"}, []string{"group-val"}, []string{"extra-val"}, []string{"names-val"}),
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val"},
|
||||||
|
groupHeaders: []string{"group-val"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val"},
|
||||||
|
allowedClientNames: []string{"names-val"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "passing an empty config map doesn't break the controller",
|
||||||
|
cm: func() *corev1.ConfigMap {
|
||||||
|
c := defaultConfigMap(t, nil, nil, nil, nil)
|
||||||
|
c.Data = map[string]string{}
|
||||||
|
return c
|
||||||
|
}(),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "an invalid config map produces an error",
|
||||||
|
cm: func() *corev1.ConfigMap {
|
||||||
|
c := defaultConfigMap(t, nil, nil, nil, nil)
|
||||||
|
c.Data = map[string]string{
|
||||||
|
defUsernameHeadersKey: "incorrect-json-array",
|
||||||
|
}
|
||||||
|
return c
|
||||||
|
}(),
|
||||||
|
expectErr: true,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, scenario := range scenarios {
|
||||||
|
t.Run(scenario.name, func(t *testing.T) {
|
||||||
|
// test data
|
||||||
|
indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
|
||||||
|
if err := indexer.Add(scenario.cm); err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
target := newDefaultTarget()
|
||||||
|
target.configmapLister = corev1listers.NewConfigMapLister(indexer).ConfigMaps(defConfigMapNamespace)
|
||||||
|
|
||||||
|
// act
|
||||||
|
err := target.sync()
|
||||||
|
|
||||||
|
if err != nil && !scenario.expectErr {
|
||||||
|
t.Errorf("got unexpected error %v", err)
|
||||||
|
}
|
||||||
|
if err == nil && scenario.expectErr {
|
||||||
|
t.Error("expected an error but didn't get one")
|
||||||
|
}
|
||||||
|
|
||||||
|
// validate
|
||||||
|
validateExpectedHeaders(t, target, scenario.expectedHeader)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRequestHeaderAuthRequestControllerPreserveState(t *testing.T) {
|
||||||
|
scenarios := []struct {
|
||||||
|
name string
|
||||||
|
cm *corev1.ConfigMap
|
||||||
|
expectedHeader expectedHeadersHolder
|
||||||
|
expectErr bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "scenario 1: headers values are populated form a config map",
|
||||||
|
cm: defaultConfigMap(t, []string{"user-val"}, []string{"group-val"}, []string{"extra-val"}, []string{"names-val"}),
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val"},
|
||||||
|
groupHeaders: []string{"group-val"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val"},
|
||||||
|
allowedClientNames: []string{"names-val"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "scenario 2: an invalid config map produces an error but doesn't destroy the state (scenario 1)",
|
||||||
|
cm: func() *corev1.ConfigMap {
|
||||||
|
c := defaultConfigMap(t, nil, nil, nil, nil)
|
||||||
|
c.Data = map[string]string{
|
||||||
|
defUsernameHeadersKey: "incorrect-json-array",
|
||||||
|
}
|
||||||
|
return c
|
||||||
|
}(),
|
||||||
|
expectErr: true,
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val"},
|
||||||
|
groupHeaders: []string{"group-val"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val"},
|
||||||
|
allowedClientNames: []string{"names-val"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "scenario 3: some headers values have changed (prev set by scenario 1)",
|
||||||
|
cm: defaultConfigMap(t, []string{"user-val"}, []string{"group-val-scenario-3"}, []string{"extra-val"}, []string{"names-val"}),
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val"},
|
||||||
|
groupHeaders: []string{"group-val-scenario-3"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val"},
|
||||||
|
allowedClientNames: []string{"names-val"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "scenario 4: all headers values have changed (prev set by scenario 3)",
|
||||||
|
cm: defaultConfigMap(t, []string{"user-val-scenario-4"}, []string{"group-val-scenario-4"}, []string{"extra-val-scenario-4"}, []string{"names-val-scenario-4"}),
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val-scenario-4"},
|
||||||
|
groupHeaders: []string{"group-val-scenario-4"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val-scenario-4"},
|
||||||
|
allowedClientNames: []string{"names-val-scenario-4"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
target := newDefaultTarget()
|
||||||
|
|
||||||
|
for _, scenario := range scenarios {
|
||||||
|
t.Run(scenario.name, func(t *testing.T) {
|
||||||
|
// test data
|
||||||
|
if scenario.cm != nil {
|
||||||
|
indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
|
||||||
|
if err := indexer.Add(scenario.cm); err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
target.configmapLister = corev1listers.NewConfigMapLister(indexer).ConfigMaps(defConfigMapNamespace)
|
||||||
|
}
|
||||||
|
|
||||||
|
// act
|
||||||
|
err := target.sync()
|
||||||
|
|
||||||
|
if err != nil && !scenario.expectErr {
|
||||||
|
t.Errorf("got unexpected error %v", err)
|
||||||
|
}
|
||||||
|
if err == nil && scenario.expectErr {
|
||||||
|
t.Error("expected an error but didn't get one")
|
||||||
|
}
|
||||||
|
|
||||||
|
// validate
|
||||||
|
validateExpectedHeaders(t, target, scenario.expectedHeader)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRequestHeaderAuthRequestControllerSyncOnce(t *testing.T) {
|
||||||
|
scenarios := []struct {
|
||||||
|
name string
|
||||||
|
cm *corev1.ConfigMap
|
||||||
|
expectedHeader expectedHeadersHolder
|
||||||
|
expectErr bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "headers values are populated form a config map",
|
||||||
|
cm: defaultConfigMap(t, []string{"user-val"}, []string{"group-val"}, []string{"extra-val"}, []string{"names-val"}),
|
||||||
|
expectedHeader: expectedHeadersHolder{
|
||||||
|
usernameHeaders: []string{"user-val"},
|
||||||
|
groupHeaders: []string{"group-val"},
|
||||||
|
extraHeaderPrefixes: []string{"extra-val"},
|
||||||
|
allowedClientNames: []string{"names-val"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, scenario := range scenarios {
|
||||||
|
t.Run(scenario.name, func(t *testing.T) {
|
||||||
|
// test data
|
||||||
|
target := newDefaultTarget()
|
||||||
|
fakeKubeClient := fake.NewSimpleClientset(scenario.cm)
|
||||||
|
|
||||||
|
// act
|
||||||
|
err := target.syncOnce(fakeKubeClient)
|
||||||
|
|
||||||
|
if err != nil && !scenario.expectErr {
|
||||||
|
t.Errorf("got unexpected error %v", err)
|
||||||
|
}
|
||||||
|
if err == nil && scenario.expectErr {
|
||||||
|
t.Error("expected an error but didn't get one")
|
||||||
|
}
|
||||||
|
|
||||||
|
// validate
|
||||||
|
validateExpectedHeaders(t, target, scenario.expectedHeader)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func defaultConfigMap(t *testing.T, usernameHeaderVal, groupHeadersVal, extraHeaderPrefixesVal, allowedClientNamesVal []string) *corev1.ConfigMap {
|
||||||
|
encode := func(val []string) string {
|
||||||
|
encodedVal, err := json.Marshal(val)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("unable to marshal %q , due to %v", usernameHeaderVal, err)
|
||||||
|
}
|
||||||
|
return string(encodedVal)
|
||||||
|
}
|
||||||
|
return &corev1.ConfigMap{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: defConfigMapName,
|
||||||
|
Namespace: defConfigMapNamespace,
|
||||||
|
},
|
||||||
|
Data: map[string]string{
|
||||||
|
defUsernameHeadersKey: encode(usernameHeaderVal),
|
||||||
|
defGroupHeadersKey: encode(groupHeadersVal),
|
||||||
|
defExtraHeaderPrefixesKey: encode(extraHeaderPrefixesVal),
|
||||||
|
defAllowedClientNamesKey: encode(allowedClientNamesVal),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func newDefaultTarget() *RequestHeaderAuthRequestController {
|
||||||
|
return &RequestHeaderAuthRequestController{
|
||||||
|
configmapName: defConfigMapName,
|
||||||
|
configmapNamespace: defConfigMapNamespace,
|
||||||
|
usernameHeadersKey: defUsernameHeadersKey,
|
||||||
|
groupHeadersKey: defGroupHeadersKey,
|
||||||
|
extraHeaderPrefixesKey: defExtraHeaderPrefixesKey,
|
||||||
|
allowedClientNamesKey: defAllowedClientNamesKey,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func validateExpectedHeaders(t *testing.T, target *RequestHeaderAuthRequestController, expected expectedHeadersHolder) {
|
||||||
|
if !equality.Semantic.DeepEqual(target.UsernameHeaders(), expected.usernameHeaders) {
|
||||||
|
t.Fatalf("incorrect usernameHeaders, got %v, wanted %v", target.UsernameHeaders(), expected.usernameHeaders)
|
||||||
|
}
|
||||||
|
if !equality.Semantic.DeepEqual(target.GroupHeaders(), expected.groupHeaders) {
|
||||||
|
t.Fatalf("incorrect groupHeaders, got %v, wanted %v", target.GroupHeaders(), expected.groupHeaders)
|
||||||
|
}
|
||||||
|
if !equality.Semantic.DeepEqual(target.ExtraHeaderPrefixes(), expected.extraHeaderPrefixes) {
|
||||||
|
t.Fatalf("incorrect extraheaderPrefixes, got %v, wanted %v", target.ExtraHeaderPrefixes(), expected.extraHeaderPrefixes)
|
||||||
|
}
|
||||||
|
if !equality.Semantic.DeepEqual(target.AllowedClientNames(), expected.allowedClientNames) {
|
||||||
|
t.Fatalf("incorrect expectedAllowedClientNames, got %v, wanted %v", target.AllowedClientNames(), expected.allowedClientNames)
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user