github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 05:57:25 +00:00
Code Issues Projects Releases Wiki Activity

Make NodeRestriction admission require identifiable nodes

Browse Source
This commit is contained in:
Jordan Liggitt 2017-05-27 02:33:53 -04:00
parent d278a80a67
commit fed30040c9
No known key found for this signature in database
GPG Key ID: 24E7ADF9A3B42012
2 changed files with 7 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
plugin/pkg/admission/noderestriction/admission.go
View File

@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
package node package noderestriction
import ( import (
"fmt" "fmt"
@ -37,24 +37,22 @@ const (
// Register registers a plugin // Register registers a plugin
func Register(plugins *admission.Plugins) { func Register(plugins *admission.Plugins) {
plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) { plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
return NewPlugin(nodeidentifier.NewDefaultNodeIdentifier(), false), nil return NewPlugin(nodeidentifier.NewDefaultNodeIdentifier()), nil
}) })
} }
// NewPlugin creates a new NodeRestriction admission plugin. // NewPlugin creates a new NodeRestriction admission plugin.
// This plugin identifies requests from nodes // This plugin identifies requests from nodes
func NewPlugin(nodeIdentifier nodeidentifier.NodeIdentifier, strict bool) *nodePlugin { func NewPlugin(nodeIdentifier nodeidentifier.NodeIdentifier) *nodePlugin {
return &nodePlugin{ return &nodePlugin{
Handler: admission.NewHandler(admission.Create, admission.Update, admission.Delete), Handler: admission.NewHandler(admission.Create, admission.Update, admission.Delete),
nodeIdentifier: nodeIdentifier, nodeIdentifier: nodeIdentifier,
strict: strict,
} }
} }
// nodePlugin holds state for and implements the admission plugin. // nodePlugin holds state for and implements the admission plugin.
type nodePlugin struct { type nodePlugin struct {
*admission.Handler *admission.Handler
strict bool
nodeIdentifier nodeidentifier.NodeIdentifier nodeIdentifier nodeidentifier.NodeIdentifier
podsGetter coreinternalversion.PodsGetter podsGetter coreinternalversion.PodsGetter
} }
@ -92,12 +90,8 @@ func (c *nodePlugin) Admit(a admission.Attributes) error {
} }
if len(nodeName) == 0 { if len(nodeName) == 0 {
if c.strict { // disallow requests we cannot match to a particular node
// In strict mode, disallow requests from nodes we cannot match to a particular node return admission.NewForbidden(a, fmt.Errorf("could not determine node from user %s", a.GetUserInfo().GetName()))
return admission.NewForbidden(a, fmt.Errorf("could not determine node identity from user"))
}
// Our job is just to restrict identifiable nodes
return nil
} }
switch a.GetResource().GroupResource() { switch a.GetResource().GroupResource() {

5
plugin/pkg/admission/noderestriction/admission_test.go
View File

@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
package node package noderestriction
import ( import (
"strings" "strings"
@ -82,7 +82,6 @@ func Test_nodePlugin_Admit(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
strict bool
podsGetter coreinternalversion.PodsGetter podsGetter coreinternalversion.PodsGetter
attributes admission.Attributes attributes admission.Attributes
err string err string
@ -473,7 +472,7 @@ func Test_nodePlugin_Admit(t *testing.T) {
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
c := NewPlugin(nodeidentifier.NewDefaultNodeIdentifier(), tt.strict) c := NewPlugin(nodeidentifier.NewDefaultNodeIdentifier())
c.podsGetter = tt.podsGetter c.podsGetter = tt.podsGetter
err := c.Admit(tt.attributes) err := c.Admit(tt.attributes)
if (err == nil) != (len(tt.err) == 0) { if (err == nil) != (len(tt.err) == 0) {