github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 05:27:21 +00:00
Code Issues Projects Releases Wiki Activity

Enact golint recommendations per issue 68026.

Browse Source 
Remove the 'abac' package from the golint exclusion list.
Add/edit comments per golint feedback.
Set PolicyList to be exported, as not exporting was breaking one of
golint's rules around exported funcs returning an unexported type.
Fix a broken test
This commit is contained in:
James Lucktaylor 2019-03-25 15:43:28 +00:00
parent fee14516fc
commit dbb696508a
3 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hack/.golint_failures
View File

@ -66,7 +66,6 @@ pkg/apis/storage/v1
pkg/apis/storage/v1/util pkg/apis/storage/v1/util
pkg/apis/storage/v1beta1 pkg/apis/storage/v1beta1
pkg/apis/storage/v1beta1/util pkg/apis/storage/v1beta1/util
pkg/auth/authorizer/abac
pkg/capabilities pkg/capabilities
pkg/cloudprovider/providers/fake pkg/cloudprovider/providers/fake
pkg/cloudprovider/providers/photon pkg/cloudprovider/providers/photon

22
pkg/auth/authorizer/abac/abac.go
View File

@ -14,11 +14,9 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
// Package abac authorizes Kubernetes API actions using an Attribute-based access control scheme.
package abac package abac
// Policy authorizes Kubernetes API actions using an Attribute-based access
// control scheme.
import ( import (
"bufio" "bufio"
"fmt" "fmt"
@ -31,6 +29,8 @@ import (
"k8s.io/apiserver/pkg/authentication/user" "k8s.io/apiserver/pkg/authentication/user"
"k8s.io/apiserver/pkg/authorization/authorizer" "k8s.io/apiserver/pkg/authorization/authorizer"
"k8s.io/kubernetes/pkg/apis/abac" "k8s.io/kubernetes/pkg/apis/abac"
// Import latest API for init/side-effects
_ "k8s.io/kubernetes/pkg/apis/abac/latest" _ "k8s.io/kubernetes/pkg/apis/abac/latest"
"k8s.io/kubernetes/pkg/apis/abac/v0" "k8s.io/kubernetes/pkg/apis/abac/v0"
) )
@ -49,10 +49,13 @@ func (p policyLoadError) Error() string {
return fmt.Sprintf("error reading policy file %s: %v", p.path, p.err) return fmt.Sprintf("error reading policy file %s: %v", p.path, p.err)
} }
type policyList []*abac.Policy // PolicyList is simply a slice of Policy structs.
type PolicyList []*abac.Policy
// NewFromFile attempts to create a policy list from the given file.
//
// TODO: Have policies be created via an API call and stored in REST storage. // TODO: Have policies be created via an API call and stored in REST storage.
func NewFromFile(path string) (policyList, error) { func NewFromFile(path string) (PolicyList, error) {
// File format is one map per line. This allows easy concatenation of files, // File format is one map per line. This allows easy concatenation of files,
// comments in files, and identification of errors by line number. // comments in files, and identification of errors by line number.
file, err := os.Open(path) file, err := os.Open(path)
@ -62,7 +65,7 @@ func NewFromFile(path string) (policyList, error) {
defer file.Close() defer file.Close()
scanner := bufio.NewScanner(file) scanner := bufio.NewScanner(file)
pl := make(policyList, 0) pl := make(PolicyList, 0)
decoder := abac.Codecs.UniversalDecoder() decoder := abac.Codecs.UniversalDecoder()
@ -220,8 +223,8 @@ func resourceMatches(p abac.Policy, a authorizer.Attributes) bool {
return false return false
} }
// Authorizer implements authorizer.Authorize // Authorize implements authorizer.Authorize
func (pl policyList) Authorize(a authorizer.Attributes) (authorizer.Decision, string, error) { func (pl PolicyList) Authorize(a authorizer.Attributes) (authorizer.Decision, string, error) {
for _, p := range pl { for _, p := range pl {
if matches(*p, a) { if matches(*p, a) {
return authorizer.DecisionAllow, "", nil return authorizer.DecisionAllow, "", nil
@ -233,7 +236,8 @@ func (pl policyList) Authorize(a authorizer.Attributes) (authorizer.Decision, st
// Then, add Caching only if needed. // Then, add Caching only if needed.
} }
func (pl policyList) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) { // RulesFor returns rules for the given user and namespace.
func (pl PolicyList) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) {
var ( var (
resourceRules []authorizer.ResourceRuleInfo resourceRules []authorizer.ResourceRuleInfo
nonResourceRules []authorizer.NonResourceRuleInfo nonResourceRules []authorizer.NonResourceRuleInfo

2
pkg/auth/authorizer/abac/abac_test.go
View File

@ -815,7 +815,7 @@ func TestSubjectMatches(t *testing.T) {
} }
} }
func newWithContents(t *testing.T, contents string) (policyList, error) { func newWithContents(t *testing.T, contents string) (PolicyList, error) {
f, err := ioutil.TempFile("", "abac_test") f, err := ioutil.TempFile("", "abac_test")
if err != nil { if err != nil {
t.Fatalf("unexpected error creating policyfile: %v", err) t.Fatalf("unexpected error creating policyfile: %v", err)