Skip to content

Commit 72e6ce7

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #20491 from deads2k/server-05-admission-shrink
avoid unnecessary admission plugin initializers
2 parents c83ba6c + c3f9477 commit 72e6ce7

File tree

41 files changed

+196
-269
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+196
-269
lines changed

‎pkg/authorization/apiserver/admission/restrictusers/restrictusers.go‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,18 @@ import (
55
"fmt"
66
"io"
77

8+
"k8s.io/client-go/rest"
89
kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
910

1011
"github.com/golang/glog"
1112
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1213
kerrors "k8s.io/apimachinery/pkg/util/errors"
14+
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
1315
"k8s.io/apiserver/pkg/admission"
1416
"k8s.io/kubernetes/pkg/apis/rbac"
1517
kadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
1618

1719
userapi "github.com/openshift/api/user/v1"
18-
authorizationclient "github.com/openshift/client-go/authorization/clientset/versioned"
1920
authorizationtypedclient "github.com/openshift/client-go/authorization/clientset/versioned/typed/authorization/v1"
2021
userclient "github.com/openshift/client-go/user/clientset/versioned"
2122
userinformer "github.com/openshift/client-go/user/informers/externalversions"
@@ -46,8 +47,7 @@ type restrictUsersAdmission struct {
4647
groupCache GroupCache
4748
}
4849

49-
var _ = oadmission.WantsOpenshiftInternalAuthorizationClient(&restrictUsersAdmission{})
50-
var _ = oadmission.WantsOpenshiftInternalUserClient(&restrictUsersAdmission{})
50+
var _ = oadmission.WantsRESTClientConfig(&restrictUsersAdmission{})
5151
var _ = oadmission.WantsUserInformer(&restrictUsersAdmission{})
5252
var _ = kadmission.WantsInternalKubeClientSet(&restrictUsersAdmission{})
5353

@@ -63,12 +63,18 @@ func (q *restrictUsersAdmission) SetInternalKubeClientSet(c kclientset.Interface
6363
q.kclient = c
6464
}
6565

66-
func (q *restrictUsersAdmission) SetOpenshiftInternalAuthorizationClient(roleBindingRestrictionsGetter authorizationclient.Interface) {
67-
q.roleBindingRestrictionsGetter = roleBindingRestrictionsGetter.Authorization()
68-
}
69-
70-
func (q *restrictUsersAdmission) SetOpenshiftInternalUserClient(userClient userclient.Interface) {
71-
q.userClient = userClient
66+
func (q *restrictUsersAdmission) SetRESTClientConfig(restClientConfig rest.Config) {
67+
var err error
68+
q.roleBindingRestrictionsGetter, err = authorizationtypedclient.NewForConfig(&restClientConfig)
69+
if err != nil {
70+
utilruntime.HandleError(err)
71+
return
72+
}
73+
q.userClient, err = userclient.NewForConfig(&restClientConfig)
74+
if err != nil {
75+
utilruntime.HandleError(err)
76+
return
77+
}
7278
}
7379

7480
func (q *restrictUsersAdmission) SetUserInformer(userInformers userinformer.SharedInformerFactory) {

‎pkg/authorization/apiserver/admission/restrictusers/restrictusers_test.go‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ import (
55
"strings"
66
"testing"
77

8+
authorizationapi "github.com/openshift/api/authorization/v1"
9+
userapi "github.com/openshift/api/user/v1"
10+
fakeauthorizationclient "github.com/openshift/client-go/authorization/clientset/versioned/fake"
11+
fakeuserclient "github.com/openshift/client-go/user/clientset/versioned/fake"
812
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
913
"k8s.io/apimachinery/pkg/runtime"
1014
"k8s.io/apimachinery/pkg/runtime/schema"
@@ -13,13 +17,6 @@ import (
1317
kapi "k8s.io/kubernetes/pkg/apis/core"
1418
"k8s.io/kubernetes/pkg/apis/rbac"
1519
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
16-
kadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
17-
18-
authorizationapi "github.com/openshift/api/authorization/v1"
19-
userapi "github.com/openshift/api/user/v1"
20-
fakeauthorizationclient "github.com/openshift/client-go/authorization/clientset/versioned/fake"
21-
fakeuserclient "github.com/openshift/client-go/user/clientset/versioned/fake"
22-
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2320
)
2421

2522
func TestAdmission(t *testing.T) {
@@ -365,9 +362,9 @@ func TestAdmission(t *testing.T) {
365362
t.Errorf("unexpected error initializing admission plugin: %v", err)
366363
}
367364

368-
plugin.(kadmission.WantsInternalKubeClientSet).SetInternalKubeClientSet(kclientset)
369-
plugin.(oadmission.WantsOpenshiftInternalAuthorizationClient).SetOpenshiftInternalAuthorizationClient(fakeAuthorizationClient)
370-
plugin.(oadmission.WantsOpenshiftInternalUserClient).SetOpenshiftInternalUserClient(fakeUserClient)
365+
plugin.(*restrictUsersAdmission).kclient = kclientset
366+
plugin.(*restrictUsersAdmission).roleBindingRestrictionsGetter = fakeAuthorizationClient.AuthorizationV1()
367+
plugin.(*restrictUsersAdmission).userClient = fakeUserClient
371368
plugin.(*restrictUsersAdmission).groupCache = fakeGroupCache{}
372369

373370
err = admission.ValidateInitialization(plugin)

‎pkg/authorization/util/util.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,24 @@ package util
33
import (
44
"errors"
55

6+
authorizationv1 "k8s.io/api/authorization/v1"
67
kerrors "k8s.io/apimachinery/pkg/api/errors"
78
"k8s.io/apimachinery/pkg/runtime/schema"
89
"k8s.io/apiserver/pkg/authentication/user"
9-
"k8s.io/kubernetes/pkg/apis/authorization"
10-
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
10+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1111
)
1212

1313
// AddUserToSAR adds the requisite user information to a SubjectAccessReview.
1414
// It returns the modified SubjectAccessReview.
15-
func AddUserToSAR(user user.Info, sar *authorization.SubjectAccessReview) *authorization.SubjectAccessReview {
15+
func AddUserToSAR(user user.Info, sar *authorizationv1.SubjectAccessReview) *authorizationv1.SubjectAccessReview {
1616
sar.Spec.User = user.GetName()
1717
// reminiscent of the bad old days of C. Copies copy the min number of elements of both source and dest
1818
sar.Spec.Groups = make([]string, len(user.GetGroups()))
1919
copy(sar.Spec.Groups, user.GetGroups())
20-
sar.Spec.Extra = map[string]authorization.ExtraValue{}
20+
sar.Spec.Extra = map[string]authorizationv1.ExtraValue{}
2121

2222
for k, v := range user.GetExtra() {
23-
sar.Spec.Extra[k] = authorization.ExtraValue(v)
23+
sar.Spec.Extra[k] = authorizationv1.ExtraValue(v)
2424
}
2525

2626
return sar
@@ -29,9 +29,9 @@ func AddUserToSAR(user user.Info, sar *authorization.SubjectAccessReview) *autho
2929
// Authorize verifies that a given user is permitted to carry out a given
3030
// action. If this cannot be determined, or if the user is not permitted, an
3131
// error is returned.
32-
func Authorize(sarClient internalversion.SubjectAccessReviewInterface, user user.Info, resourceAttributes *authorization.ResourceAttributes) error {
33-
sar := AddUserToSAR(user, &authorization.SubjectAccessReview{
34-
Spec: authorization.SubjectAccessReviewSpec{
32+
func Authorize(sarClient authorizationclient.SubjectAccessReviewInterface, user user.Info, resourceAttributes *authorizationv1.ResourceAttributes) error {
33+
sar := AddUserToSAR(user, &authorizationv1.SubjectAccessReview{
34+
Spec: authorizationv1.SubjectAccessReviewSpec{
3535
ResourceAttributes: resourceAttributes,
3636
},
3737
})

‎pkg/build/apiserver/admission/strategyrestrictions/admission.go‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,26 @@ import (
55
"io"
66
"strings"
77

8-
"github.com/openshift/api/build"
9-
"github.com/openshift/origin/pkg/api/legacy"
10-
"github.com/openshift/origin/pkg/build/buildscheme"
8+
authorizationv1 "k8s.io/api/authorization/v1"
119
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1210
"k8s.io/apimachinery/pkg/runtime/schema"
11+
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
1312
"k8s.io/apiserver/pkg/admission"
13+
"k8s.io/client-go/kubernetes"
14+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
15+
"k8s.io/client-go/rest"
1416
kapihelper "k8s.io/kubernetes/pkg/apis/core/helper"
15-
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
16-
authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
17-
kubeadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
1817
rbacregistry "k8s.io/kubernetes/pkg/registry/rbac"
1918

19+
"github.com/openshift/api/build"
2020
buildclient "github.com/openshift/client-go/build/clientset/versioned"
21+
"github.com/openshift/origin/pkg/api/legacy"
2122
"github.com/openshift/origin/pkg/authorization/util"
2223
buildapi "github.com/openshift/origin/pkg/build/apis/build"
24+
"github.com/openshift/origin/pkg/build/buildscheme"
2325
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2426
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
25-
"k8s.io/kubernetes/pkg/apis/authorization"
27+
"k8s.io/apiserver/pkg/admission/initializer"
2628
)
2729

2830
func Register(plugins *admission.Plugins) {
@@ -38,8 +40,8 @@ type buildByStrategy struct {
3840
buildClient buildclient.Interface
3941
}
4042

41-
var _ = kubeadmission.WantsInternalKubeClientSet(&buildByStrategy{})
42-
var _ = oadmission.WantsOpenshiftInternalBuildClient(&buildByStrategy{})
43+
var _ = initializer.WantsExternalKubeClientSet(&buildByStrategy{})
44+
var _ = oadmission.WantsRESTClientConfig(&buildByStrategy{})
4345

4446
// NewBuildByStrategy returns an admission control for builds that checks
4547
// on policy based on the build strategy type
@@ -84,12 +86,17 @@ func (a *buildByStrategy) Admit(attr admission.Attributes) error {
8486
}
8587
}
8688

87-
func (a *buildByStrategy) SetInternalKubeClientSet(c internalclientset.Interface) {
88-
a.sarClient = c.Authorization().SubjectAccessReviews()
89+
func (a *buildByStrategy) SetExternalKubeClientSet(c kubernetes.Interface) {
90+
a.sarClient = c.AuthorizationV1().SubjectAccessReviews()
8991
}
9092

91-
func (a *buildByStrategy) SetOpenshiftInternalBuildClient(c buildclient.Interface) {
92-
a.buildClient = c
93+
func (a *buildByStrategy) SetRESTClientConfig(restClientConfig rest.Config) {
94+
var err error
95+
a.buildClient, err = buildclient.NewForConfig(&restClientConfig)
96+
if err != nil {
97+
utilruntime.HandleError(err)
98+
return
99+
}
93100
}
94101

95102
func (a *buildByStrategy) ValidateInitialization() error {
@@ -139,9 +146,9 @@ func (a *buildByStrategy) checkBuildAuthorization(build *buildapi.Build, attr ad
139146
subresource = tokens[1]
140147
}
141148

142-
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorization.SubjectAccessReview{
143-
Spec: authorization.SubjectAccessReviewSpec{
144-
ResourceAttributes: &authorization.ResourceAttributes{
149+
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorizationv1.SubjectAccessReview{
150+
Spec: authorizationv1.SubjectAccessReviewSpec{
151+
ResourceAttributes: &authorizationv1.ResourceAttributes{
145152
Namespace: attr.GetNamespace(),
146153
Verb: "create",
147154
Group: resource.Group,
@@ -167,9 +174,9 @@ func (a *buildByStrategy) checkBuildConfigAuthorization(buildConfig *buildapi.Bu
167174
subresource = tokens[1]
168175
}
169176

170-
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorization.SubjectAccessReview{
171-
Spec: authorization.SubjectAccessReviewSpec{
172-
ResourceAttributes: &authorization.ResourceAttributes{
177+
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorizationv1.SubjectAccessReview{
178+
Spec: authorizationv1.SubjectAccessReviewSpec{
179+
ResourceAttributes: &authorizationv1.ResourceAttributes{
173180
Namespace: attr.GetNamespace(),
174181
Verb: "create",
175182
Group: resource.Group,
@@ -213,7 +220,7 @@ func (a *buildByStrategy) checkBuildRequestAuthorization(req *buildapi.BuildRequ
213220
}
214221
}
215222

216-
func (a *buildByStrategy) checkAccess(strategy buildapi.BuildStrategy, subjectAccessReview *authorization.SubjectAccessReview, attr admission.Attributes) error {
223+
func (a *buildByStrategy) checkAccess(strategy buildapi.BuildStrategy, subjectAccessReview *authorizationv1.SubjectAccessReview, attr admission.Attributes) error {
217224
resp, err := a.sarClient.Create(subjectAccessReview)
218225
if err != nil {
219226
return admission.NewForbidden(attr, err)

‎pkg/build/apiserver/admission/strategyrestrictions/admission_test.go‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,19 @@ import (
44
"fmt"
55
"testing"
66

7+
authorizationv1 "k8s.io/api/authorization/v1"
78
apierrors "k8s.io/apimachinery/pkg/api/errors"
89
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
910
"k8s.io/apimachinery/pkg/runtime"
1011
"k8s.io/apimachinery/pkg/runtime/schema"
1112
"k8s.io/apiserver/pkg/admission"
1213
"k8s.io/apiserver/pkg/authentication/user"
14+
fakekubeclient "k8s.io/client-go/kubernetes/fake"
1315
clientgotesting "k8s.io/client-go/testing"
14-
"k8s.io/kubernetes/pkg/apis/authorization"
15-
fakekubeclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
16-
kubeadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
1716

1817
buildapiv1 "github.com/openshift/api/build/v1"
1918
fakebuildclient "github.com/openshift/client-go/build/clientset/versioned/fake"
2019
buildapi "github.com/openshift/origin/pkg/build/apis/build"
21-
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2220

2321
"github.com/openshift/api/build"
2422
_ "github.com/openshift/origin/pkg/build/apis/build/install"
@@ -33,7 +31,7 @@ func TestBuildAdmission(t *testing.T) {
3331
object runtime.Object
3432
oldObject runtime.Object
3533
responseObject runtime.Object
36-
reviewResponse *authorization.SubjectAccessReview
34+
reviewResponse *authorizationv1.SubjectAccessReview
3735
expectedResource string
3836
expectedSubresource string
3937
expectAccept bool
@@ -179,7 +177,7 @@ func TestBuildAdmission(t *testing.T) {
179177
},
180178
}
181179

182-
emptyResponse := &authorization.SubjectAccessReview{}
180+
emptyResponse := &authorizationv1.SubjectAccessReview{}
183181
ops := []admission.Operation{admission.Create, admission.Update}
184182
for _, test := range tests {
185183
t.Run(test.name, func(t *testing.T) {
@@ -191,7 +189,7 @@ func TestBuildAdmission(t *testing.T) {
191189

192190
fakeKubeClient := fakekubeclient.NewSimpleClientset()
193191
fakeKubeClient.PrependReactor("create", "subjectaccessreviews", func(action clientgotesting.Action) (handled bool, ret runtime.Object, err error) {
194-
review, ok := action.(clientgotesting.CreateAction).GetObject().(*authorization.SubjectAccessReview)
192+
review, ok := action.(clientgotesting.CreateAction).GetObject().(*authorizationv1.SubjectAccessReview)
195193
if !ok {
196194
return true, emptyResponse, fmt.Errorf("unexpected object received: %#v", review)
197195
}
@@ -211,8 +209,8 @@ func TestBuildAdmission(t *testing.T) {
211209
})
212210

213211
c := NewBuildByStrategy()
214-
c.(kubeadmission.WantsInternalKubeClientSet).SetInternalKubeClientSet(fakeKubeClient)
215-
c.(oadmission.WantsOpenshiftInternalBuildClient).SetOpenshiftInternalBuildClient(fakeBuildClient)
212+
c.(*buildByStrategy).sarClient = fakeKubeClient.AuthorizationV1().SubjectAccessReviews()
213+
c.(*buildByStrategy).buildClient = fakeBuildClient
216214
attrs := admission.NewAttributesRecord(test.object, test.oldObject, test.kind.WithVersion("version"), "foo", "test-build", test.resource.WithVersion("version"), test.subResource, op, fakeUser())
217215
err := c.(admission.MutationInterface).Admit(attrs)
218216
if err != nil && test.expectAccept {
@@ -298,9 +296,9 @@ func v1TestBuildConfig(strategy buildapiv1.BuildStrategy) *buildapiv1.BuildConfi
298296
}
299297
}
300298

301-
func reviewResponse(allowed bool, msg string) *authorization.SubjectAccessReview {
302-
return &authorization.SubjectAccessReview{
303-
Status: authorization.SubjectAccessReviewStatus{
299+
func reviewResponse(allowed bool, msg string) *authorizationv1.SubjectAccessReview {
300+
return &authorizationv1.SubjectAccessReview{
301+
Status: authorizationv1.SubjectAccessReviewStatus{
304302
Allowed: allowed,
305303
Reason: msg,
306304
},

‎pkg/cmd/openshift-apiserver/server.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func RunOpenShiftAPIServer(masterConfig *configapi.MasterConfig) error {
5151
return err
5252
}
5353

54-
if err := informers.GetInternalOpenshiftUserInformers().User().V1().Groups().Informer().AddIndexers(cache.Indexers{
54+
if err := informers.GetOpenshiftUserInformers().User().V1().Groups().Informer().AddIndexers(cache.Indexers{
5555
usercache.ByUserIndexName: usercache.ByUserIndexKeys,
5656
}); err != nil {
5757
return err

‎pkg/cmd/openshift-controller-manager/controller/template.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ func RunTemplateInstanceController(ctx ControllerContext) (bool, error) {
2121
go templatecontroller.NewTemplateInstanceController(
2222
ctx.RestMapper,
2323
dynamicClient,
24+
ctx.ClientBuilder.ClientGoClientOrDie(saName).AuthorizationV1(),
2425
ctx.ClientBuilder.KubeInternalClientOrDie(saName),
2526
ctx.ClientBuilder.OpenshiftInternalBuildClientOrDie(saName),
2627
ctx.ClientBuilder.OpenshiftInternalTemplateClientOrDie(saName),

‎pkg/cmd/openshift-controller-manager/controller_manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ func newControllerContext(
146146
InternalNetworkInformers: originInformers.GetInternalOpenshiftNetworkInformers(),
147147
InternalQuotaInformers: originInformers.GetInternalOpenshiftQuotaInformers(),
148148
InternalSecurityInformers: originInformers.GetInternalOpenshiftSecurityInformers(),
149-
InternalRouteInformers: originInformers.GetInternalOpenshiftRouteInformers(),
149+
InternalRouteInformers: originInformers.GetOpenshiftRouteInformers(),
150150
InternalTemplateInformers: originInformers.GetInternalOpenshiftTemplateInformers(),
151151
GenericResourceInformer: originInformers.ToGenericInformer(),
152152
Stop: stopCh,

0 commit comments

Comments
 (0)