github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-22 11:21:47 +00:00
Code Issues Projects Releases Wiki Activity

Indicate node authorizer does not support rule resolution

Browse Source
This commit is contained in:
Jordan Liggitt 2020-05-12 13:40:25 -04:00
parent 0a6c826d3e
commit fd78947489
5 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/kubeapiserver/authorizer/config.go
View File

@ -86,6 +86,7 @@ func (config Config) New() (authorizer.Authorizer, authorizer.RuleResolver, erro
) )
nodeAuthorizer := node.NewAuthorizer(graph, nodeidentifier.NewDefaultNodeIdentifier(), bootstrappolicy.NodeRules()) nodeAuthorizer := node.NewAuthorizer(graph, nodeidentifier.NewDefaultNodeIdentifier(), bootstrappolicy.NodeRules())
authorizers = append(authorizers, nodeAuthorizer) authorizers = append(authorizers, nodeAuthorizer)
ruleResolvers = append(ruleResolvers, nodeAuthorizer)
case modes.ModeAlwaysAllow: case modes.ModeAlwaysAllow:
alwaysAllowAuthorizer := authorizerfactory.NewAlwaysAllowAuthorizer() alwaysAllowAuthorizer := authorizerfactory.NewAlwaysAllowAuthorizer()

1
plugin/pkg/auth/authorizer/node/BUILD
View File

@ -52,6 +52,7 @@ go_library(
"//staging/src/k8s.io/api/rbac/v1:go_default_library", "//staging/src/k8s.io/api/rbac/v1:go_default_library",
"//staging/src/k8s.io/api/storage/v1:go_default_library", "//staging/src/k8s.io/api/storage/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authentication/user:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library", "//staging/src/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library", "//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
"//staging/src/k8s.io/client-go/informers/core/v1:go_default_library", "//staging/src/k8s.io/client-go/informers/core/v1:go_default_library",

2
plugin/pkg/auth/authorizer/node/graph_test.go
View File

@ -188,7 +188,7 @@ func TestIndex(t *testing.T) {
g := NewGraph() g := NewGraph()
g.destinationEdgeThreshold = 3 g.destinationEdgeThreshold = 3
a := NewAuthorizer(g, nil, nil).(*NodeAuthorizer) a := NewAuthorizer(g, nil, nil)
addPod := func(podNumber, nodeNumber int) { addPod := func(podNumber, nodeNumber int) {
t.Helper() t.Helper()

14
plugin/pkg/auth/authorizer/node/node_authorizer.go
View File

@ -24,6 +24,7 @@ import (
rbacv1 "k8s.io/api/rbac/v1" rbacv1 "k8s.io/api/rbac/v1"
"k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/authentication/user"
"k8s.io/apiserver/pkg/authorization/authorizer" "k8s.io/apiserver/pkg/authorization/authorizer"
utilfeature "k8s.io/apiserver/pkg/util/feature" utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/component-base/featuregate" "k8s.io/component-base/featuregate"
@ -58,8 +59,11 @@ type NodeAuthorizer struct {
features featuregate.FeatureGate features featuregate.FeatureGate
} }
var _ = authorizer.Authorizer(&NodeAuthorizer{})
var _ = authorizer.RuleResolver(&NodeAuthorizer{})
// NewAuthorizer returns a new node authorizer // NewAuthorizer returns a new node authorizer
func NewAuthorizer(graph *Graph, identifier nodeidentifier.NodeIdentifier, rules []rbacv1.PolicyRule) authorizer.Authorizer { func NewAuthorizer(graph *Graph, identifier nodeidentifier.NodeIdentifier, rules []rbacv1.PolicyRule) *NodeAuthorizer {
return &NodeAuthorizer{ return &NodeAuthorizer{
graph: graph, graph: graph,
identifier: identifier, identifier: identifier,
@ -79,6 +83,14 @@ var (
csiNodeResource = storageapi.Resource("csinodes") csiNodeResource = storageapi.Resource("csinodes")
) )
func (r *NodeAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) {
if _, isNode := r.identifier.NodeIdentity(user); isNode {
// indicate nodes do not have fully enumerated permissions
return nil, nil, true, fmt.Errorf("node authorizer does not support user rule resolution")
}
return nil, nil, false, nil
}
func (r *NodeAuthorizer) Authorize(ctx context.Context, attrs authorizer.Attributes) (authorizer.Decision, string, error) { func (r *NodeAuthorizer) Authorize(ctx context.Context, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
nodeName, isNode := r.identifier.NodeIdentity(attrs.GetUser()) nodeName, isNode := r.identifier.NodeIdentity(attrs.GetUser())
if !isNode { if !isNode {

4
plugin/pkg/auth/authorizer/node/node_authorizer_test.go
View File

@ -82,7 +82,7 @@ func TestAuthorizer(t *testing.T) {
populate(g, nodes, pods, pvs, attachments) populate(g, nodes, pods, pvs, attachments)
identifier := nodeidentifier.NewDefaultNodeIdentifier() identifier := nodeidentifier.NewDefaultNodeIdentifier()
authz := NewAuthorizer(g, identifier, bootstrappolicy.NodeRules()).(*NodeAuthorizer) authz := NewAuthorizer(g, identifier, bootstrappolicy.NodeRules())
node0 := &user.DefaultInfo{Name: "system:node:node0", Groups: []string{"system:nodes"}} node0 := &user.DefaultInfo{Name: "system:node:node0", Groups: []string{"system:nodes"}}
@ -671,7 +671,7 @@ func BenchmarkAuthorization(b *testing.B) {
populate(g, nodes, pods, pvs, attachments) populate(g, nodes, pods, pvs, attachments)
identifier := nodeidentifier.NewDefaultNodeIdentifier() identifier := nodeidentifier.NewDefaultNodeIdentifier()
authz := NewAuthorizer(g, identifier, bootstrappolicy.NodeRules()).(*NodeAuthorizer) authz := NewAuthorizer(g, identifier, bootstrappolicy.NodeRules())
node0 := &user.DefaultInfo{Name: "system:node:node0", Groups: []string{"system:nodes"}} node0 := &user.DefaultInfo{Name: "system:node:node0", Groups: []string{"system:nodes"}}