github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 05:27:21 +00:00
Code Issues Projects Releases Wiki Activity

slim down authorization listing interfaces

Browse Source
This commit is contained in:
deads2k 2016-10-04 15:48:40 -04:00
parent aa485ce82c
commit ceaf026881
12 changed files with 126 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
pkg/apis/rbac/validation/rulevalidation.go
View File

@ -32,7 +32,7 @@ import (
type AuthorizationRuleResolver interface { type AuthorizationRuleResolver interface {
// GetRoleReferenceRules attempts to resolve the role reference of a RoleBinding or ClusterRoleBinding. The passed namespace should be the namepsace // GetRoleReferenceRules attempts to resolve the role reference of a RoleBinding or ClusterRoleBinding. The passed namespace should be the namepsace
// of the role binding, the empty string if a cluster role binding. // of the role binding, the empty string if a cluster role binding.
GetRoleReferenceRules(ctx api.Context, roleRef rbac.RoleRef, namespace string) ([]rbac.PolicyRule, error) GetRoleReferenceRules(roleRef rbac.RoleRef, namespace string) ([]rbac.PolicyRule, error)
// RulesFor returns the list of rules that apply to a given user in a given namespace and error. If an error is returned, the slice of // RulesFor returns the list of rules that apply to a given user in a given namespace and error. If an error is returned, the slice of
// PolicyRules may not be complete, but it contains all retrievable rules. This is done because policy rules are purely additive and policy determinations // PolicyRules may not be complete, but it contains all retrievable rules. This is done because policy rules are purely additive and policy determinations
@ -77,35 +77,34 @@ func NewDefaultRuleResolver(roleGetter RoleGetter, roleBindingLister RoleBinding
} }
type RoleGetter interface { type RoleGetter interface {
GetRole(ctx api.Context, id string) (*rbac.Role, error) GetRole(namespace, name string) (*rbac.Role, error)
} }
type RoleBindingLister interface { type RoleBindingLister interface {
ListRoleBindings(ctx api.Context, options *api.ListOptions) (*rbac.RoleBindingList, error) ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error)
} }
type ClusterRoleGetter interface { type ClusterRoleGetter interface {
GetClusterRole(ctx api.Context, id string) (*rbac.ClusterRole, error) GetClusterRole(name string) (*rbac.ClusterRole, error)
} }
type ClusterRoleBindingLister interface { type ClusterRoleBindingLister interface {
ListClusterRoleBindings(ctx api.Context, options *api.ListOptions) (*rbac.ClusterRoleBindingList, error) ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error)
} }
func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac.PolicyRule, error) { func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac.PolicyRule, error) {
policyRules := []rbac.PolicyRule{} policyRules := []rbac.PolicyRule{}
errorlist := []error{} errorlist := []error{}
ctx := api.NewContext() if clusterRoleBindings, err := r.clusterRoleBindingLister.ListClusterRoleBindings(); err != nil {
if clusterRoleBindings, err := r.clusterRoleBindingLister.ListClusterRoleBindings(ctx, &api.ListOptions{}); err != nil {
errorlist = append(errorlist, err) errorlist = append(errorlist, err)
} else { } else {
for _, clusterRoleBinding := range clusterRoleBindings.Items { for _, clusterRoleBinding := range clusterRoleBindings {
if !appliesTo(user, clusterRoleBinding.Subjects, "") { if !appliesTo(user, clusterRoleBinding.Subjects, "") {
continue continue
} }
rules, err := r.GetRoleReferenceRules(ctx, clusterRoleBinding.RoleRef, "") rules, err := r.GetRoleReferenceRules(clusterRoleBinding.RoleRef, "")
if err != nil { if err != nil {
errorlist = append(errorlist, err) errorlist = append(errorlist, err)
continue continue
@ -115,17 +114,15 @@ func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac
} }
if len(namespace) > 0 { if len(namespace) > 0 {
ctx := api.WithNamespace(api.NewContext(), namespace) if roleBindings, err := r.roleBindingLister.ListRoleBindings(namespace); err != nil {
if roleBindings, err := r.roleBindingLister.ListRoleBindings(ctx, &api.ListOptions{}); err != nil {
errorlist = append(errorlist, err) errorlist = append(errorlist, err)
} else { } else {
for _, roleBinding := range roleBindings.Items { for _, roleBinding := range roleBindings {
if !appliesTo(user, roleBinding.Subjects, namespace) { if !appliesTo(user, roleBinding.Subjects, namespace) {
continue continue
} }
rules, err := r.GetRoleReferenceRules(ctx, roleBinding.RoleRef, namespace) rules, err := r.GetRoleReferenceRules(roleBinding.RoleRef, namespace)
if err != nil { if err != nil {
errorlist = append(errorlist, err) errorlist = append(errorlist, err)
continue continue
@ -139,17 +136,17 @@ func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac
} }
// GetRoleReferenceRules attempts to resolve the RoleBinding or ClusterRoleBinding. // GetRoleReferenceRules attempts to resolve the RoleBinding or ClusterRoleBinding.
func (r *DefaultRuleResolver) GetRoleReferenceRules(ctx api.Context, roleRef rbac.RoleRef, bindingNamespace string) ([]rbac.PolicyRule, error) { func (r *DefaultRuleResolver) GetRoleReferenceRules(roleRef rbac.RoleRef, bindingNamespace string) ([]rbac.PolicyRule, error) {
switch kind := rbac.RoleRefGroupKind(roleRef); kind { switch kind := rbac.RoleRefGroupKind(roleRef); kind {
case rbac.Kind("Role"): case rbac.Kind("Role"):
role, err := r.roleGetter.GetRole(api.WithNamespace(ctx, bindingNamespace), roleRef.Name) role, err := r.roleGetter.GetRole(bindingNamespace, roleRef.Name)
if err != nil { if err != nil {
return nil, err return nil, err
} }
return role.Rules, nil return role.Rules, nil
case rbac.Kind("ClusterRole"): case rbac.Kind("ClusterRole"):
clusterRole, err := r.clusterRoleGetter.GetClusterRole(api.WithNamespace(ctx, ""), roleRef.Name) clusterRole, err := r.clusterRoleGetter.GetClusterRole(roleRef.Name)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -193,7 +190,7 @@ func appliesToUser(user user.Info, subject rbac.Subject, namespace string) bool
} }
// NewTestRuleResolver returns a rule resolver from lists of role objects. // NewTestRuleResolver returns a rule resolver from lists of role objects.
func NewTestRuleResolver(roles []rbac.Role, roleBindings []rbac.RoleBinding, clusterRoles []rbac.ClusterRole, clusterRoleBindings []rbac.ClusterRoleBinding) AuthorizationRuleResolver { func NewTestRuleResolver(roles []*rbac.Role, roleBindings []*rbac.RoleBinding, clusterRoles []*rbac.ClusterRole, clusterRoleBindings []*rbac.ClusterRoleBinding) AuthorizationRuleResolver {
r := staticRoles{ r := staticRoles{
roles: roles, roles: roles,
roleBindings: roleBindings, roleBindings: roleBindings,
@ -208,62 +205,49 @@ func newMockRuleResolver(r *staticRoles) AuthorizationRuleResolver {
} }
type staticRoles struct { type staticRoles struct {
roles []rbac.Role roles []*rbac.Role
roleBindings []rbac.RoleBinding roleBindings []*rbac.RoleBinding
clusterRoles []rbac.ClusterRole clusterRoles []*rbac.ClusterRole
clusterRoleBindings []rbac.ClusterRoleBinding clusterRoleBindings []*rbac.ClusterRoleBinding
} }
func (r *staticRoles) GetRole(ctx api.Context, id string) (*rbac.Role, error) { func (r *staticRoles) GetRole(namespace, name string) (*rbac.Role, error) {
namespace, ok := api.NamespaceFrom(ctx) if len(namespace) == 0 {
if !ok || namespace == "" {
return nil, errors.New("must provide namespace when getting role") return nil, errors.New("must provide namespace when getting role")
} }
for _, role := range r.roles { for _, role := range r.roles {
if role.Namespace == namespace && role.Name == id { if role.Namespace == namespace && role.Name == name {
return &role, nil return role, nil
} }
} }
return nil, errors.New("role not found") return nil, errors.New("role not found")
} }
func (r *staticRoles) GetClusterRole(ctx api.Context, id string) (*rbac.ClusterRole, error) { func (r *staticRoles) GetClusterRole(name string) (*rbac.ClusterRole, error) {
namespace, ok := api.NamespaceFrom(ctx)
if ok && namespace != "" {
return nil, errors.New("cannot provide namespace when getting cluster role")
}
for _, clusterRole := range r.clusterRoles { for _, clusterRole := range r.clusterRoles {
if clusterRole.Namespace == namespace && clusterRole.Name == id { if clusterRole.Name == name {
return &clusterRole, nil return clusterRole, nil
} }
} }
return nil, errors.New("role not found") return nil, errors.New("role not found")
} }
func (r *staticRoles) ListRoleBindings(ctx api.Context, options *api.ListOptions) (*rbac.RoleBindingList, error) { func (r *staticRoles) ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error) {
namespace, ok := api.NamespaceFrom(ctx) if len(namespace) == 0 {
if !ok || namespace == "" {
return nil, errors.New("must provide namespace when listing role bindings") return nil, errors.New("must provide namespace when listing role bindings")
} }
roleBindingList := new(rbac.RoleBindingList) roleBindingList := []*rbac.RoleBinding{}
for _, roleBinding := range r.roleBindings { for _, roleBinding := range r.roleBindings {
if roleBinding.Namespace != namespace { if roleBinding.Namespace != namespace {
continue continue
} }
// TODO(ericchiang): need to implement label selectors? // TODO(ericchiang): need to implement label selectors?
roleBindingList.Items = append(roleBindingList.Items, roleBinding) roleBindingList = append(roleBindingList, roleBinding)
} }
return roleBindingList, nil return roleBindingList, nil
} }
func (r *staticRoles) ListClusterRoleBindings(ctx api.Context, options *api.ListOptions) (*rbac.ClusterRoleBindingList, error) { func (r *staticRoles) ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error) {
namespace, ok := api.NamespaceFrom(ctx) return r.clusterRoleBindings, nil
if ok && namespace != "" {
return nil, errors.New("cannot list cluster role bindings from within a namespace")
}
clusterRoleBindings := new(rbac.ClusterRoleBindingList)
clusterRoleBindings.Items = make([]rbac.ClusterRoleBinding, len(r.clusterRoleBindings))
copy(clusterRoleBindings.Items, r.clusterRoleBindings)
return clusterRoleBindings, nil
} }

8
pkg/apis/rbac/validation/rulevalidation_test.go
View File

@ -73,13 +73,13 @@ func TestDefaultRuleResolver(t *testing.T) {
} }
staticRoles1 := staticRoles{ staticRoles1 := staticRoles{
roles: []rbac.Role{ roles: []*rbac.Role{
{ {
ObjectMeta: api.ObjectMeta{Namespace: "namespace1", Name: "readthings"}, ObjectMeta: api.ObjectMeta{Namespace: "namespace1", Name: "readthings"},
Rules: []rbac.PolicyRule{ruleReadPods, ruleReadServices}, Rules: []rbac.PolicyRule{ruleReadPods, ruleReadServices},
}, },
}, },
clusterRoles: []rbac.ClusterRole{ clusterRoles: []*rbac.ClusterRole{
{ {
ObjectMeta: api.ObjectMeta{Name: "cluster-admin"}, ObjectMeta: api.ObjectMeta{Name: "cluster-admin"},
Rules: []rbac.PolicyRule{ruleAdmin}, Rules: []rbac.PolicyRule{ruleAdmin},
@ -89,7 +89,7 @@ func TestDefaultRuleResolver(t *testing.T) {
Rules: []rbac.PolicyRule{ruleWriteNodes}, Rules: []rbac.PolicyRule{ruleWriteNodes},
}, },
}, },
roleBindings: []rbac.RoleBinding{ roleBindings: []*rbac.RoleBinding{
{ {
ObjectMeta: api.ObjectMeta{Namespace: "namespace1"}, ObjectMeta: api.ObjectMeta{Namespace: "namespace1"},
Subjects: []rbac.Subject{ Subjects: []rbac.Subject{
@ -99,7 +99,7 @@ func TestDefaultRuleResolver(t *testing.T) {
RoleRef: rbac.RoleRef{APIGroup: rbac.GroupName, Kind: "Role", Name: "readthings"}, RoleRef: rbac.RoleRef{APIGroup: rbac.GroupName, Kind: "Role", Name: "readthings"},
}, },
}, },
clusterRoleBindings: []rbac.ClusterRoleBinding{ clusterRoleBindings: []*rbac.ClusterRoleBinding{
{ {
Subjects: []rbac.Subject{ Subjects: []rbac.Subject{
{Kind: rbac.UserKind, Name: "admin"}, {Kind: rbac.UserKind, Name: "admin"},

9
pkg/registry/rbac/clusterrole/registry.go
View File

@ -79,3 +79,12 @@ func (s *storage) DeleteClusterRole(ctx api.Context, name string) error {
_, err := s.Delete(ctx, name, nil) _, err := s.Delete(ctx, name, nil)
return err return err
} }
// AuthorizerAdapter adapts the registry to the authorizer interface
type AuthorizerAdapter struct {
Registry Registry
}
func (a AuthorizerAdapter) GetClusterRole(name string) (*rbac.ClusterRole, error) {
return a.Registry.GetClusterRole(api.NewContext(), name)
}

4
pkg/registry/rbac/clusterrolebinding/policybased/storage.go
View File

@ -48,7 +48,7 @@ func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, e
} }
clusterRoleBinding := obj.(*rbac.ClusterRoleBinding) clusterRoleBinding := obj.(*rbac.ClusterRoleBinding)
rules, err := s.ruleResolver.GetRoleReferenceRules(ctx, clusterRoleBinding.RoleRef, clusterRoleBinding.Namespace) rules, err := s.ruleResolver.GetRoleReferenceRules(clusterRoleBinding.RoleRef, clusterRoleBinding.Namespace)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -66,7 +66,7 @@ func (s *Storage) Update(ctx api.Context, name string, obj rest.UpdatedObjectInf
nonEscalatingInfo := wrapUpdatedObjectInfo(obj, func(ctx api.Context, obj runtime.Object, oldObj runtime.Object) (runtime.Object, error) { nonEscalatingInfo := wrapUpdatedObjectInfo(obj, func(ctx api.Context, obj runtime.Object, oldObj runtime.Object) (runtime.Object, error) {
clusterRoleBinding := obj.(*rbac.ClusterRoleBinding) clusterRoleBinding := obj.(*rbac.ClusterRoleBinding)
rules, err := s.ruleResolver.GetRoleReferenceRules(ctx, clusterRoleBinding.RoleRef, clusterRoleBinding.Namespace) rules, err := s.ruleResolver.GetRoleReferenceRules(clusterRoleBinding.RoleRef, clusterRoleBinding.Namespace)
if err != nil { if err != nil {
return nil, err return nil, err
} }

18
pkg/registry/rbac/clusterrolebinding/registry.go
View File

@ -79,3 +79,21 @@ func (s *storage) DeleteClusterRoleBinding(ctx api.Context, name string) error {
_, err := s.Delete(ctx, name, nil) _, err := s.Delete(ctx, name, nil)
return err return err
} }
// AuthorizerAdapter adapts the registry to the authorizer interface
type AuthorizerAdapter struct {
Registry Registry
}
func (a AuthorizerAdapter) ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error) {
list, err := a.Registry.ListClusterRoleBindings(api.NewContext(), &api.ListOptions{})
if err != nil {
return nil, err
}
ret := []*rbac.ClusterRoleBinding{}
for i := range list.Items {
ret = append(ret, &list.Items[i])
}
return ret, nil
}

8
pkg/registry/rbac/rest/storage_rbac.go
View File

@ -71,10 +71,10 @@ func (p *RESTStorageProvider) v1alpha1Storage(apiResourceConfigSource genericapi
newRuleValidator := func() rbacvalidation.AuthorizationRuleResolver { newRuleValidator := func() rbacvalidation.AuthorizationRuleResolver {
once.Do(func() { once.Do(func() {
authorizationRuleResolver = rbacvalidation.NewDefaultRuleResolver( authorizationRuleResolver = rbacvalidation.NewDefaultRuleResolver(
role.NewRegistry(roleetcd.NewREST(restOptionsGetter(rbac.Resource("roles")))), role.AuthorizerAdapter{Registry: role.NewRegistry(roleetcd.NewREST(restOptionsGetter(rbac.Resource("roles"))))},
rolebinding.NewRegistry(rolebindingetcd.NewREST(restOptionsGetter(rbac.Resource("rolebindings")))), rolebinding.AuthorizerAdapter{Registry: rolebinding.NewRegistry(rolebindingetcd.NewREST(restOptionsGetter(rbac.Resource("rolebindings"))))},
clusterrole.NewRegistry(clusterroleetcd.NewREST(restOptionsGetter(rbac.Resource("clusterroles")))), clusterrole.AuthorizerAdapter{Registry: clusterrole.NewRegistry(clusterroleetcd.NewREST(restOptionsGetter(rbac.Resource("clusterroles"))))},
clusterrolebinding.NewRegistry(clusterrolebindingetcd.NewREST(restOptionsGetter(rbac.Resource("clusterrolebindings")))), clusterrolebinding.AuthorizerAdapter{Registry: clusterrolebinding.NewRegistry(clusterrolebindingetcd.NewREST(restOptionsGetter(rbac.Resource("clusterrolebindings"))))},
) )
}) })
return authorizationRuleResolver return authorizationRuleResolver

9
pkg/registry/rbac/role/registry.go
View File

@ -79,3 +79,12 @@ func (s *storage) DeleteRole(ctx api.Context, name string) error {
_, err := s.Delete(ctx, name, nil) _, err := s.Delete(ctx, name, nil)
return err return err
} }
// AuthorizerAdapter adapts the registry to the authorizer interface
type AuthorizerAdapter struct {
Registry Registry
}
func (a AuthorizerAdapter) GetRole(namespace, name string) (*rbac.Role, error) {
return a.Registry.GetRole(api.WithNamespace(api.NewContext(), namespace), name)
}

4
pkg/registry/rbac/rolebinding/policybased/storage.go
View File

@ -48,7 +48,7 @@ func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, e
} }
roleBinding := obj.(*rbac.RoleBinding) roleBinding := obj.(*rbac.RoleBinding)
rules, err := s.ruleResolver.GetRoleReferenceRules(ctx, roleBinding.RoleRef, roleBinding.Namespace) rules, err := s.ruleResolver.GetRoleReferenceRules(roleBinding.RoleRef, roleBinding.Namespace)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -66,7 +66,7 @@ func (s *Storage) Update(ctx api.Context, name string, obj rest.UpdatedObjectInf
nonEscalatingInfo := wrapUpdatedObjectInfo(obj, func(ctx api.Context, obj runtime.Object, oldObj runtime.Object) (runtime.Object, error) { nonEscalatingInfo := wrapUpdatedObjectInfo(obj, func(ctx api.Context, obj runtime.Object, oldObj runtime.Object) (runtime.Object, error) {
roleBinding := obj.(*rbac.RoleBinding) roleBinding := obj.(*rbac.RoleBinding)
rules, err := s.ruleResolver.GetRoleReferenceRules(ctx, roleBinding.RoleRef, roleBinding.Namespace) rules, err := s.ruleResolver.GetRoleReferenceRules(roleBinding.RoleRef, roleBinding.Namespace)
if err != nil { if err != nil {
return nil, err return nil, err
} }

18
pkg/registry/rbac/rolebinding/registry.go
View File

@ -80,3 +80,21 @@ func (s *storage) DeleteRoleBinding(ctx api.Context, name string) error {
_, err := s.Delete(ctx, name, nil) _, err := s.Delete(ctx, name, nil)
return err return err
} }
// AuthorizerAdapter adapts the registry to the authorizer interface
type AuthorizerAdapter struct {
Registry Registry
}
func (a AuthorizerAdapter) ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error) {
list, err := a.Registry.ListRoleBindings(api.WithNamespace(api.NewContext(), namespace), &api.ListOptions{})
if err != nil {
return nil, err
}
ret := []*rbac.RoleBinding{}
for i := range list.Items {
ret = append(ret, &list.Items[i])
}
return ret, nil
}

8
plugin/pkg/auth/authorizer/rbac/rbac.go
View File

@ -59,10 +59,10 @@ func New(roleRegistry role.Registry, roleBindingRegistry rolebinding.Registry, c
authorizer := &RBACAuthorizer{ authorizer := &RBACAuthorizer{
superUser: superUser, superUser: superUser,
authorizationRuleResolver: validation.NewDefaultRuleResolver( authorizationRuleResolver: validation.NewDefaultRuleResolver(
roleRegistry, role.AuthorizerAdapter{Registry: roleRegistry},
roleBindingRegistry, rolebinding.AuthorizerAdapter{Registry: roleBindingRegistry},
clusterRoleRegistry, clusterrole.AuthorizerAdapter{Registry: clusterRoleRegistry},
clusterRoleBindingRegistry, clusterrolebinding.AuthorizerAdapter{Registry: clusterRoleBindingRegistry},
), ),
} }
return authorizer return authorizer

40
plugin/pkg/auth/authorizer/rbac/rbac_test.go
View File

@ -37,12 +37,12 @@ func newRule(verbs, apiGroups, resources, nonResourceURLs string) rbac.PolicyRul
} }
} }
func newRole(name, namespace string, rules ...rbac.PolicyRule) rbac.Role { func newRole(name, namespace string, rules ...rbac.PolicyRule) *rbac.Role {
return rbac.Role{ObjectMeta: api.ObjectMeta{Namespace: namespace, Name: name}, Rules: rules} return &rbac.Role{ObjectMeta: api.ObjectMeta{Namespace: namespace, Name: name}, Rules: rules}
} }
func newClusterRole(name string, rules ...rbac.PolicyRule) rbac.ClusterRole { func newClusterRole(name string, rules ...rbac.PolicyRule) *rbac.ClusterRole {
return rbac.ClusterRole{ObjectMeta: api.ObjectMeta{Name: name}, Rules: rules} return &rbac.ClusterRole{ObjectMeta: api.ObjectMeta{Name: name}, Rules: rules}
} }
const ( const (
@ -50,8 +50,8 @@ const (
bindToClusterRole uint16 = 0x1 bindToClusterRole uint16 = 0x1
) )
func newClusterRoleBinding(roleName string, subjects ...string) rbac.ClusterRoleBinding { func newClusterRoleBinding(roleName string, subjects ...string) *rbac.ClusterRoleBinding {
r := rbac.ClusterRoleBinding{ r := &rbac.ClusterRoleBinding{
ObjectMeta: api.ObjectMeta{}, ObjectMeta: api.ObjectMeta{},
RoleRef: rbac.RoleRef{ RoleRef: rbac.RoleRef{
APIGroup: rbac.GroupName, APIGroup: rbac.GroupName,
@ -68,8 +68,8 @@ func newClusterRoleBinding(roleName string, subjects ...string) rbac.ClusterRole
return r return r
} }
func newRoleBinding(namespace, roleName string, bindType uint16, subjects ...string) rbac.RoleBinding { func newRoleBinding(namespace, roleName string, bindType uint16, subjects ...string) *rbac.RoleBinding {
r := rbac.RoleBinding{ObjectMeta: api.ObjectMeta{Namespace: namespace}} r := &rbac.RoleBinding{ObjectMeta: api.ObjectMeta{Namespace: namespace}}
switch bindType { switch bindType {
case bindToRole: case bindToRole:
@ -117,10 +117,10 @@ func (d *defaultAttributes) GetPath() string { return "" }
func TestAuthorizer(t *testing.T) { func TestAuthorizer(t *testing.T) {
tests := []struct { tests := []struct {
roles []rbac.Role roles []*rbac.Role
roleBindings []rbac.RoleBinding roleBindings []*rbac.RoleBinding
clusterRoles []rbac.ClusterRole clusterRoles []*rbac.ClusterRole
clusterRoleBindings []rbac.ClusterRoleBinding clusterRoleBindings []*rbac.ClusterRoleBinding
superUser string superUser string
@ -128,10 +128,10 @@ func TestAuthorizer(t *testing.T) {
shouldFail []authorizer.Attributes shouldFail []authorizer.Attributes
}{ }{
{ {
clusterRoles: []rbac.ClusterRole{ clusterRoles: []*rbac.ClusterRole{
newClusterRole("admin", newRule("*", "*", "*", "*")), newClusterRole("admin", newRule("*", "*", "*", "*")),
}, },
roleBindings: []rbac.RoleBinding{ roleBindings: []*rbac.RoleBinding{
newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"), newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"),
}, },
shouldPass: []authorizer.Attributes{ shouldPass: []authorizer.Attributes{
@ -150,12 +150,12 @@ func TestAuthorizer(t *testing.T) {
}, },
{ {
// Non-resource-url tests // Non-resource-url tests
clusterRoles: []rbac.ClusterRole{ clusterRoles: []*rbac.ClusterRole{
newClusterRole("non-resource-url-getter", newRule("get", "", "", "/apis")), newClusterRole("non-resource-url-getter", newRule("get", "", "", "/apis")),
newClusterRole("non-resource-url", newRule("*", "", "", "/apis")), newClusterRole("non-resource-url", newRule("*", "", "", "/apis")),
newClusterRole("non-resource-url-prefix", newRule("get", "", "", "/apis/*")), newClusterRole("non-resource-url-prefix", newRule("get", "", "", "/apis/*")),
}, },
clusterRoleBindings: []rbac.ClusterRoleBinding{ clusterRoleBindings: []*rbac.ClusterRoleBinding{
newClusterRoleBinding("non-resource-url-getter", "User:foo", "Group:bar"), newClusterRoleBinding("non-resource-url-getter", "User:foo", "Group:bar"),
newClusterRoleBinding("non-resource-url", "User:admin", "Group:admin"), newClusterRoleBinding("non-resource-url", "User:admin", "Group:admin"),
newClusterRoleBinding("non-resource-url-prefix", "User:prefixed", "Group:prefixed"), newClusterRoleBinding("non-resource-url-prefix", "User:prefixed", "Group:prefixed"),
@ -191,10 +191,10 @@ func TestAuthorizer(t *testing.T) {
}, },
{ {
// test subresource resolution // test subresource resolution
clusterRoles: []rbac.ClusterRole{ clusterRoles: []*rbac.ClusterRole{
newClusterRole("admin", newRule("*", "*", "pods", "*")), newClusterRole("admin", newRule("*", "*", "pods", "*")),
}, },
roleBindings: []rbac.RoleBinding{ roleBindings: []*rbac.RoleBinding{
newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"), newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"),
}, },
shouldPass: []authorizer.Attributes{ shouldPass: []authorizer.Attributes{
@ -206,10 +206,10 @@ func TestAuthorizer(t *testing.T) {
}, },
{ {
// test subresource resolution // test subresource resolution
clusterRoles: []rbac.ClusterRole{ clusterRoles: []*rbac.ClusterRole{
newClusterRole("admin", newRule("*", "*", "pods/status", "*")), newClusterRole("admin", newRule("*", "*", "pods/status", "*")),
}, },
roleBindings: []rbac.RoleBinding{ roleBindings: []*rbac.RoleBinding{
newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"), newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"),
}, },
shouldPass: []authorizer.Attributes{ shouldPass: []authorizer.Attributes{

8
test/integration/auth/rbac_test.go
View File

@ -91,10 +91,10 @@ func newRBACAuthorizer(t *testing.T, superUser string, config *master.Config) au
return generic.RESTOptions{StorageConfig: storageConfig, Decorator: generic.UndecoratedStorage, ResourcePrefix: resource} return generic.RESTOptions{StorageConfig: storageConfig, Decorator: generic.UndecoratedStorage, ResourcePrefix: resource}
} }
roleRegistry := role.NewRegistry(roleetcd.NewREST(newRESTOptions("roles"))) roleRegistry := role.AuthorizerAdapter{Registry: role.NewRegistry(roleetcd.NewREST(newRESTOptions("roles")))}
roleBindingRegistry := rolebinding.NewRegistry(rolebindingetcd.NewREST(newRESTOptions("rolebindings"))) roleBindingRegistry := rolebinding.AuthorizerAdapter{Registry: rolebinding.NewRegistry(rolebindingetcd.NewREST(newRESTOptions("rolebindings")))}
clusterRoleRegistry := clusterrole.NewRegistry(clusterroleetcd.NewREST(newRESTOptions("clusterroles"))) clusterRoleRegistry := clusterrole.AuthorizerAdapter{Registry: clusterrole.NewRegistry(clusterroleetcd.NewREST(newRESTOptions("clusterroles")))}
clusterRoleBindingRegistry := clusterrolebinding.NewRegistry(clusterrolebindingetcd.NewREST(newRESTOptions("clusterrolebindings"))) clusterRoleBindingRegistry := clusterrolebinding.AuthorizerAdapter{Registry: clusterrolebinding.NewRegistry(clusterrolebindingetcd.NewREST(newRESTOptions("clusterrolebindings")))}
return rbac.New(roleRegistry, roleBindingRegistry, clusterRoleRegistry, clusterRoleBindingRegistry, superUser) return rbac.New(roleRegistry, roleBindingRegistry, clusterRoleRegistry, clusterRoleBindingRegistry, superUser)
} }