rancher/steve
1
0
Fork 0
mirror of https://github.com/rancher/steve.git synced 2025-09-09 03:09:50 +00:00
Code Issues Projects Releases Wiki Activity

RBAC caching

Browse Source
This commit is contained in:
Darren Shepherd
2020-02-08 13:03:57 -07:00
parent 87a107e23e
commit 9f771dcf65
6 changed files with 213 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
pkg/accesscontrol/policy_rule_index.go
View File

@@ -44,6 +44,15 @@ func newPolicyRuleIndex(user bool, rbac v1.Interface) *policyRuleIndex {
func (p *policyRuleIndex) clusterRoleBindingBySubjectIndexer(crb *rbacv1.ClusterRoleBinding) (result []string, err error) {
for _, subject := range crb.Subjects {
if subject.APIGroup == rbacGroup && subject.Kind == p.kind && crb.RoleRef.Kind == "ClusterRole" {
result = append(result, subject.Name)
}
}
return
}
func (p *policyRuleIndex) roleBindingBySubject(rb *rbacv1.RoleBinding) (result []string, err error) {
for _, subject := range rb.Subjects {
if subject.APIGroup == rbacGroup && subject.Kind == p.kind {
result = append(result, subject.Name)
}
@@ -51,13 +60,26 @@ func (p *policyRuleIndex) clusterRoleBindingBySubjectIndexer(crb *rbacv1.Cluster
return
}
func (p *policyRuleIndex) roleBindingBySubject(crb *rbacv1.RoleBinding) (result []string, err error) {
for _, subject := range crb.Subjects {
if subject.APIGroup == rbacGroup && subject.Kind == p.kind {
result = append(result, subject.Name)
func (p *policyRuleIndex) addRolesToMap(roles map[roleKey]struct{}, subjectName string) {
for _, crb := range p.getClusterRoleBindings(subjectName) {
roles[roleKey{
name: crb.RoleRef.Name,
}] = struct{}{}
}
for _, rb := range p.getRoleBindings(subjectName) {
switch rb.RoleRef.Kind {
case "Role":
roles[roleKey{
name: rb.RoleRef.Name,
namespace: rb.Namespace,
}] = struct{}{}
case "ClusterRole":
roles[roleKey{
name: rb.RoleRef.Name,
}] = struct{}{}
}
}
return
}
func (p *policyRuleIndex) get(subjectName string) *AccessSet {