Skip to content

Commit 86bdfef

Browse files
deads2kdeads2k
committed
switch to external SARs
1 parent 84a53be commit 86bdfef

File tree

23 files changed

+75
-70
lines changed

23 files changed

+75
-70
lines changed

‎pkg/authorization/util/util.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,24 @@ package util
33
import (
44
"errors"
55

6+
authorizationv1 "k8s.io/api/authorization/v1"
67
kerrors "k8s.io/apimachinery/pkg/api/errors"
78
"k8s.io/apimachinery/pkg/runtime/schema"
89
"k8s.io/apiserver/pkg/authentication/user"
9-
"k8s.io/kubernetes/pkg/apis/authorization"
10-
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
10+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1111
)
1212

1313
// AddUserToSAR adds the requisite user information to a SubjectAccessReview.
1414
// It returns the modified SubjectAccessReview.
15-
func AddUserToSAR(user user.Info, sar *authorization.SubjectAccessReview) *authorization.SubjectAccessReview {
15+
func AddUserToSAR(user user.Info, sar *authorizationv1.SubjectAccessReview) *authorizationv1.SubjectAccessReview {
1616
sar.Spec.User = user.GetName()
1717
// reminiscent of the bad old days of C. Copies copy the min number of elements of both source and dest
1818
sar.Spec.Groups = make([]string, len(user.GetGroups()))
1919
copy(sar.Spec.Groups, user.GetGroups())
20-
sar.Spec.Extra = map[string]authorization.ExtraValue{}
20+
sar.Spec.Extra = map[string]authorizationv1.ExtraValue{}
2121

2222
for k, v := range user.GetExtra() {
23-
sar.Spec.Extra[k] = authorization.ExtraValue(v)
23+
sar.Spec.Extra[k] = authorizationv1.ExtraValue(v)
2424
}
2525

2626
return sar
@@ -29,9 +29,9 @@ func AddUserToSAR(user user.Info, sar *authorization.SubjectAccessReview) *autho
2929
// Authorize verifies that a given user is permitted to carry out a given
3030
// action. If this cannot be determined, or if the user is not permitted, an
3131
// error is returned.
32-
func Authorize(sarClient internalversion.SubjectAccessReviewInterface, user user.Info, resourceAttributes *authorization.ResourceAttributes) error {
33-
sar := AddUserToSAR(user, &authorization.SubjectAccessReview{
34-
Spec: authorization.SubjectAccessReviewSpec{
32+
func Authorize(sarClient authorizationclient.SubjectAccessReviewInterface, user user.Info, resourceAttributes *authorizationv1.ResourceAttributes) error {
33+
sar := AddUserToSAR(user, &authorizationv1.SubjectAccessReview{
34+
Spec: authorizationv1.SubjectAccessReviewSpec{
3535
ResourceAttributes: resourceAttributes,
3636
},
3737
})

‎pkg/build/admission/strategyrestrictions/admission.go‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,15 @@ import (
55
"io"
66
"strings"
77

8+
authorizationv1 "k8s.io/api/authorization/v1"
89
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
910
"k8s.io/apimachinery/pkg/runtime/schema"
1011
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
1112
"k8s.io/apiserver/pkg/admission"
13+
"k8s.io/client-go/kubernetes"
14+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1215
"k8s.io/client-go/rest"
13-
"k8s.io/kubernetes/pkg/apis/authorization"
1416
kapihelper "k8s.io/kubernetes/pkg/apis/core/helper"
15-
"k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
16-
authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
17-
kubeadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
1817
rbacregistry "k8s.io/kubernetes/pkg/registry/rbac"
1918

2019
"github.com/openshift/api/build"
@@ -25,6 +24,7 @@ import (
2524
"github.com/openshift/origin/pkg/build/buildscheme"
2625
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2726
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
27+
"k8s.io/apiserver/pkg/admission/initializer"
2828
)
2929

3030
func Register(plugins *admission.Plugins) {
@@ -40,7 +40,7 @@ type buildByStrategy struct {
4040
buildClient buildclient.Interface
4141
}
4242

43-
var _ = kubeadmission.WantsInternalKubeClientSet(&buildByStrategy{})
43+
var _ = initializer.WantsExternalKubeClientSet(&buildByStrategy{})
4444
var _ = oadmission.WantsRESTClientConfig(&buildByStrategy{})
4545

4646
// NewBuildByStrategy returns an admission control for builds that checks
@@ -86,8 +86,8 @@ func (a *buildByStrategy) Admit(attr admission.Attributes) error {
8686
}
8787
}
8888

89-
func (a *buildByStrategy) SetInternalKubeClientSet(c internalclientset.Interface) {
90-
a.sarClient = c.Authorization().SubjectAccessReviews()
89+
func (a *buildByStrategy) SetExternalKubeClientSet(c kubernetes.Interface) {
90+
a.sarClient = c.AuthorizationV1().SubjectAccessReviews()
9191
}
9292

9393
func (a *buildByStrategy) SetRESTClientConfig(restClientConfig rest.Config) {
@@ -146,9 +146,9 @@ func (a *buildByStrategy) checkBuildAuthorization(build *buildapi.Build, attr ad
146146
subresource = tokens[1]
147147
}
148148

149-
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorization.SubjectAccessReview{
150-
Spec: authorization.SubjectAccessReviewSpec{
151-
ResourceAttributes: &authorization.ResourceAttributes{
149+
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorizationv1.SubjectAccessReview{
150+
Spec: authorizationv1.SubjectAccessReviewSpec{
151+
ResourceAttributes: &authorizationv1.ResourceAttributes{
152152
Namespace: attr.GetNamespace(),
153153
Verb: "create",
154154
Group: resource.Group,
@@ -174,9 +174,9 @@ func (a *buildByStrategy) checkBuildConfigAuthorization(buildConfig *buildapi.Bu
174174
subresource = tokens[1]
175175
}
176176

177-
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorization.SubjectAccessReview{
178-
Spec: authorization.SubjectAccessReviewSpec{
179-
ResourceAttributes: &authorization.ResourceAttributes{
177+
sar := util.AddUserToSAR(attr.GetUserInfo(), &authorizationv1.SubjectAccessReview{
178+
Spec: authorizationv1.SubjectAccessReviewSpec{
179+
ResourceAttributes: &authorizationv1.ResourceAttributes{
180180
Namespace: attr.GetNamespace(),
181181
Verb: "create",
182182
Group: resource.Group,
@@ -220,7 +220,7 @@ func (a *buildByStrategy) checkBuildRequestAuthorization(req *buildapi.BuildRequ
220220
}
221221
}
222222

223-
func (a *buildByStrategy) checkAccess(strategy buildapi.BuildStrategy, subjectAccessReview *authorization.SubjectAccessReview, attr admission.Attributes) error {
223+
func (a *buildByStrategy) checkAccess(strategy buildapi.BuildStrategy, subjectAccessReview *authorizationv1.SubjectAccessReview, attr admission.Attributes) error {
224224
resp, err := a.sarClient.Create(subjectAccessReview)
225225
if err != nil {
226226
return admission.NewForbidden(attr, err)

‎pkg/build/admission/strategyrestrictions/admission_test.go‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,19 @@ import (
44
"fmt"
55
"testing"
66

7+
authorizationv1 "k8s.io/api/authorization/v1"
78
apierrors "k8s.io/apimachinery/pkg/api/errors"
89
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
910
"k8s.io/apimachinery/pkg/runtime"
1011
"k8s.io/apimachinery/pkg/runtime/schema"
1112
"k8s.io/apiserver/pkg/admission"
1213
"k8s.io/apiserver/pkg/authentication/user"
14+
fakekubeclient "k8s.io/client-go/kubernetes/fake"
1315
clientgotesting "k8s.io/client-go/testing"
14-
"k8s.io/kubernetes/pkg/apis/authorization"
15-
fakekubeclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
16-
kubeadmission "k8s.io/kubernetes/pkg/kubeapiserver/admission"
1716

1817
buildapiv1 "github.com/openshift/api/build/v1"
1918
fakebuildclient "github.com/openshift/client-go/build/clientset/versioned/fake"
2019
buildapi "github.com/openshift/origin/pkg/build/apis/build"
21-
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
2220

2321
"github.com/openshift/api/build"
2422
_ "github.com/openshift/origin/pkg/build/apis/build/install"
@@ -33,7 +31,7 @@ func TestBuildAdmission(t *testing.T) {
3331
object runtime.Object
3432
oldObject runtime.Object
3533
responseObject runtime.Object
36-
reviewResponse *authorization.SubjectAccessReview
34+
reviewResponse *authorizationv1.SubjectAccessReview
3735
expectedResource string
3836
expectedSubresource string
3937
expectAccept bool
@@ -179,7 +177,7 @@ func TestBuildAdmission(t *testing.T) {
179177
},
180178
}
181179

182-
emptyResponse := &authorization.SubjectAccessReview{}
180+
emptyResponse := &authorizationv1.SubjectAccessReview{}
183181
ops := []admission.Operation{admission.Create, admission.Update}
184182
for _, test := range tests {
185183
t.Run(test.name, func(t *testing.T) {
@@ -191,7 +189,7 @@ func TestBuildAdmission(t *testing.T) {
191189

192190
fakeKubeClient := fakekubeclient.NewSimpleClientset()
193191
fakeKubeClient.PrependReactor("create", "subjectaccessreviews", func(action clientgotesting.Action) (handled bool, ret runtime.Object, err error) {
194-
review, ok := action.(clientgotesting.CreateAction).GetObject().(*authorization.SubjectAccessReview)
192+
review, ok := action.(clientgotesting.CreateAction).GetObject().(*authorizationv1.SubjectAccessReview)
195193
if !ok {
196194
return true, emptyResponse, fmt.Errorf("unexpected object received: %#v", review)
197195
}
@@ -211,8 +209,8 @@ func TestBuildAdmission(t *testing.T) {
211209
})
212210

213211
c := NewBuildByStrategy()
214-
c.(kubeadmission.WantsInternalKubeClientSet).SetInternalKubeClientSet(fakeKubeClient)
215-
c.(oadmission.WantsOpenshiftInternalBuildClient).SetOpenshiftInternalBuildClient(fakeBuildClient)
212+
c.(*buildByStrategy).sarClient = fakeKubeClient.AuthorizationV1().SubjectAccessReviews()
213+
c.(*buildByStrategy).buildClient = fakeBuildClient
216214
attrs := admission.NewAttributesRecord(test.object, test.oldObject, test.kind.WithVersion("version"), "foo", "test-build", test.resource.WithVersion("version"), test.subResource, op, fakeUser())
217215
err := c.(admission.MutationInterface).Admit(attrs)
218216
if err != nil && test.expectAccept {
@@ -298,9 +296,9 @@ func v1TestBuildConfig(strategy buildapiv1.BuildStrategy) *buildapiv1.BuildConfi
298296
}
299297
}
300298

301-
func reviewResponse(allowed bool, msg string) *authorization.SubjectAccessReview {
302-
return &authorization.SubjectAccessReview{
303-
Status: authorization.SubjectAccessReviewStatus{
299+
func reviewResponse(allowed bool, msg string) *authorizationv1.SubjectAccessReview {
300+
return &authorizationv1.SubjectAccessReview{
301+
Status: authorizationv1.SubjectAccessReviewStatus{
304302
Allowed: allowed,
305303
Reason: msg,
306304
},

‎pkg/cmd/openshift-controller-manager/controller/template.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ func RunTemplateInstanceController(ctx ControllerContext) (bool, error) {
2121
go templatecontroller.NewTemplateInstanceController(
2222
ctx.RestMapper,
2323
dynamicClient,
24+
ctx.ClientBuilder.ClientGoClientOrDie(saName).AuthorizationV1(),
2425
ctx.ClientBuilder.KubeInternalClientOrDie(saName),
2526
ctx.ClientBuilder.OpenshiftInternalBuildClientOrDie(saName),
2627
ctx.ClientBuilder.OpenshiftInternalTemplateClientOrDie(saName),

‎pkg/image/apiserver/apiserver.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ import (
1414
knet "k8s.io/apimachinery/pkg/util/net"
1515
"k8s.io/apiserver/pkg/registry/rest"
1616
genericapiserver "k8s.io/apiserver/pkg/server"
17+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1718
restclient "k8s.io/client-go/rest"
1819
"k8s.io/client-go/util/flowcontrol"
19-
authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
2020
coreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
2121

2222
imageapiv1 "github.com/openshift/api/image/v1"

‎pkg/image/apiserver/registry/imagestream/etcd/etcd.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
"k8s.io/apiserver/pkg/registry/generic/registry"
1111
"k8s.io/apiserver/pkg/registry/rest"
1212
"k8s.io/apiserver/pkg/storage"
13-
authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
13+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1414
"k8s.io/kubernetes/pkg/printers"
1515
printerstorage "k8s.io/kubernetes/pkg/printers/storage"
1616

‎pkg/image/apiserver/registry/imagestream/etcd/etcd_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
imageapi "github.com/openshift/origin/pkg/image/apis/image"
88
"github.com/openshift/origin/pkg/image/apis/image/validation/fake"
99
"github.com/openshift/origin/pkg/util/restoptions"
10+
authorizationapi "k8s.io/api/authorization/v1"
1011
"k8s.io/apimachinery/pkg/api/errors"
1112
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1213
"k8s.io/apimachinery/pkg/runtime/schema"
@@ -16,7 +17,6 @@ import (
1617
"k8s.io/apiserver/pkg/registry/rest"
1718
etcdtesting "k8s.io/apiserver/pkg/storage/etcd/testing"
1819
"k8s.io/kubernetes/pkg/api/legacyscheme"
19-
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
2020
kapihelper "k8s.io/kubernetes/pkg/apis/core/helper"
2121

2222
// install all APIs

‎pkg/image/apiserver/registry/imagestream/strategy.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"strings"
77

88
"github.com/golang/glog"
9+
authorizationapi "k8s.io/api/authorization/v1"
910
kerrors "k8s.io/apimachinery/pkg/api/errors"
1011
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1112
"k8s.io/apimachinery/pkg/runtime"
@@ -14,11 +15,10 @@ import (
1415
"k8s.io/apiserver/pkg/authentication/user"
1516
apirequest "k8s.io/apiserver/pkg/endpoints/request"
1617
"k8s.io/apiserver/pkg/storage/names"
18+
authorizationclient "k8s.io/client-go/kubernetes/typed/authorization/v1"
1719
"k8s.io/kubernetes/pkg/api/legacyscheme"
18-
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
1920
kapi "k8s.io/kubernetes/pkg/apis/core"
2021
kapihelper "k8s.io/kubernetes/pkg/apis/core/helper"
21-
authorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
2222

2323
authorizationutil "github.com/openshift/origin/pkg/authorization/util"
2424
imageadmission "github.com/openshift/origin/pkg/image/admission"

‎pkg/image/apiserver/registry/imagestream/strategy_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"strings"
1010
"testing"
1111

12+
authorizationapi "k8s.io/api/authorization/v1"
1213
kapierrors "k8s.io/apimachinery/pkg/api/errors"
1314
"k8s.io/apimachinery/pkg/api/resource"
1415
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -17,7 +18,6 @@ import (
1718
"k8s.io/apimachinery/pkg/util/validation/field"
1819
"k8s.io/apiserver/pkg/authentication/user"
1920
apirequest "k8s.io/apiserver/pkg/endpoints/request"
20-
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
2121
kapi "k8s.io/kubernetes/pkg/apis/core"
2222
kquota "k8s.io/kubernetes/pkg/quota"
2323

‎pkg/image/apiserver/registry/imagestreamimage/rest_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ import (
66
etcd "github.com/coreos/etcd/clientv3"
77
"golang.org/x/net/context"
88

9+
authorizationapi "k8s.io/api/authorization/v1"
910
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1011
"k8s.io/apimachinery/pkg/runtime"
1112
"k8s.io/apimachinery/pkg/runtime/schema"
1213
apirequest "k8s.io/apiserver/pkg/endpoints/request"
1314
"k8s.io/apiserver/pkg/storage/etcd/etcdtest"
1415
etcdtesting "k8s.io/apiserver/pkg/storage/etcd/testing"
1516
"k8s.io/kubernetes/pkg/api/legacyscheme"
16-
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
1717

1818
imagev1 "github.com/openshift/api/image/v1"
1919
admfake "github.com/openshift/origin/pkg/image/admission/fake"

0 commit comments

Comments
 (0)