2019-01-12 04:58:27 +00:00
|
|
|
/*
|
|
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
You may obtain a copy of the License at
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package options
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/spf13/pflag"
|
|
|
|
|
|
|
|
"k8s.io/apimachinery/pkg/util/sets"
|
2020-12-01 01:06:26 +00:00
|
|
|
"k8s.io/apimachinery/pkg/util/wait"
|
|
|
|
genericoptions "k8s.io/apiserver/pkg/server/options"
|
2019-01-12 04:58:27 +00:00
|
|
|
versionedinformers "k8s.io/client-go/informers"
|
|
|
|
"k8s.io/kubernetes/pkg/kubeapiserver/authorizer"
|
|
|
|
authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
|
|
|
|
)
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
// BuiltInAuthorizationOptions contains all build-in authorization options for API Server
|
2019-01-12 04:58:27 +00:00
|
|
|
type BuiltInAuthorizationOptions struct {
|
|
|
|
Modes []string
|
2019-08-30 18:33:25 +00:00
|
|
|
PolicyFile string
|
2019-01-12 04:58:27 +00:00
|
|
|
WebhookConfigFile string
|
2019-12-12 01:27:03 +00:00
|
|
|
WebhookVersion string
|
2019-01-12 04:58:27 +00:00
|
|
|
WebhookCacheAuthorizedTTL time.Duration
|
|
|
|
WebhookCacheUnauthorizedTTL time.Duration
|
2020-12-01 01:06:26 +00:00
|
|
|
// WebhookRetryBackoff specifies the backoff parameters for the authorization webhook retry logic.
|
|
|
|
// This allows us to configure the sleep time at each iteration and the maximum number of retries allowed
|
|
|
|
// before we fail the webhook call in order to limit the fan out that ensues when the system is degraded.
|
|
|
|
WebhookRetryBackoff *wait.Backoff
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
// NewBuiltInAuthorizationOptions create a BuiltInAuthorizationOptions with default value
|
2019-01-12 04:58:27 +00:00
|
|
|
func NewBuiltInAuthorizationOptions() *BuiltInAuthorizationOptions {
|
|
|
|
return &BuiltInAuthorizationOptions{
|
|
|
|
Modes: []string{authzmodes.ModeAlwaysAllow},
|
2019-12-12 01:27:03 +00:00
|
|
|
WebhookVersion: "v1beta1",
|
2019-01-12 04:58:27 +00:00
|
|
|
WebhookCacheAuthorizedTTL: 5 * time.Minute,
|
|
|
|
WebhookCacheUnauthorizedTTL: 30 * time.Second,
|
2020-12-01 01:06:26 +00:00
|
|
|
WebhookRetryBackoff: genericoptions.DefaultAuthWebhookRetryBackoff(),
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
// Validate checks invalid config combination
|
|
|
|
func (o *BuiltInAuthorizationOptions) Validate() []error {
|
|
|
|
if o == nil {
|
2019-01-12 04:58:27 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
allErrors := []error{}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
if len(o.Modes) == 0 {
|
2019-01-12 04:58:27 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("at least one authorization-mode must be passed"))
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
modes := sets.NewString(o.Modes...)
|
|
|
|
for _, mode := range o.Modes {
|
2019-12-12 01:27:03 +00:00
|
|
|
if !authzmodes.IsValidAuthorizationMode(mode) {
|
2019-01-12 04:58:27 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("authorization-mode %q is not a valid mode", mode))
|
|
|
|
}
|
2019-08-30 18:33:25 +00:00
|
|
|
if mode == authzmodes.ModeABAC {
|
2020-12-01 01:06:26 +00:00
|
|
|
if o.PolicyFile == "" {
|
2019-08-30 18:33:25 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("authorization-mode ABAC's authorization policy file not passed"))
|
|
|
|
}
|
|
|
|
}
|
2019-01-12 04:58:27 +00:00
|
|
|
if mode == authzmodes.ModeWebhook {
|
2020-12-01 01:06:26 +00:00
|
|
|
if o.WebhookConfigFile == "" {
|
2019-01-12 04:58:27 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("authorization-mode Webhook's authorization config file not passed"))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
if o.PolicyFile != "" && !modes.Has(authzmodes.ModeABAC) {
|
2019-08-30 18:33:25 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("cannot specify --authorization-policy-file without mode ABAC"))
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
if o.WebhookConfigFile != "" && !modes.Has(authzmodes.ModeWebhook) {
|
2019-01-12 04:58:27 +00:00
|
|
|
allErrors = append(allErrors, fmt.Errorf("cannot specify --authorization-webhook-config-file without mode Webhook"))
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
if len(o.Modes) != len(modes.List()) {
|
|
|
|
allErrors = append(allErrors, fmt.Errorf("authorization-mode %q has mode specified more than once", o.Modes))
|
|
|
|
}
|
|
|
|
|
|
|
|
if o.WebhookRetryBackoff != nil && o.WebhookRetryBackoff.Steps <= 0 {
|
|
|
|
allErrors = append(allErrors, fmt.Errorf("number of webhook retry attempts must be greater than 1, but is: %d", o.WebhookRetryBackoff.Steps))
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return allErrors
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
// AddFlags returns flags of authorization for a API Server
|
|
|
|
func (o *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) {
|
|
|
|
fs.StringSliceVar(&o.Modes, "authorization-mode", o.Modes, ""+
|
2019-01-12 04:58:27 +00:00
|
|
|
"Ordered list of plug-ins to do authorization on secure port. Comma-delimited list of: "+
|
|
|
|
strings.Join(authzmodes.AuthorizationModeChoices, ",")+".")
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
fs.StringVar(&o.PolicyFile, "authorization-policy-file", o.PolicyFile, ""+
|
2019-08-30 18:33:25 +00:00
|
|
|
"File with authorization policy in json line by line format, used with --authorization-mode=ABAC, on the secure port.")
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
fs.StringVar(&o.WebhookConfigFile, "authorization-webhook-config-file", o.WebhookConfigFile, ""+
|
2019-01-12 04:58:27 +00:00
|
|
|
"File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. "+
|
|
|
|
"The API server will query the remote service to determine access on the API server's secure port.")
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
fs.StringVar(&o.WebhookVersion, "authorization-webhook-version", o.WebhookVersion, ""+
|
2019-12-12 01:27:03 +00:00
|
|
|
"The API version of the authorization.k8s.io SubjectAccessReview to send to and expect from the webhook.")
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
fs.DurationVar(&o.WebhookCacheAuthorizedTTL, "authorization-webhook-cache-authorized-ttl",
|
|
|
|
o.WebhookCacheAuthorizedTTL,
|
2019-01-12 04:58:27 +00:00
|
|
|
"The duration to cache 'authorized' responses from the webhook authorizer.")
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
fs.DurationVar(&o.WebhookCacheUnauthorizedTTL,
|
|
|
|
"authorization-webhook-cache-unauthorized-ttl", o.WebhookCacheUnauthorizedTTL,
|
2019-01-12 04:58:27 +00:00
|
|
|
"The duration to cache 'unauthorized' responses from the webhook authorizer.")
|
|
|
|
}
|
|
|
|
|
2020-12-01 01:06:26 +00:00
|
|
|
// ToAuthorizationConfig convert BuiltInAuthorizationOptions to authorizer.Config
|
|
|
|
func (o *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) authorizer.Config {
|
2019-01-12 04:58:27 +00:00
|
|
|
return authorizer.Config{
|
2020-12-01 01:06:26 +00:00
|
|
|
AuthorizationModes: o.Modes,
|
|
|
|
PolicyFile: o.PolicyFile,
|
|
|
|
WebhookConfigFile: o.WebhookConfigFile,
|
|
|
|
WebhookVersion: o.WebhookVersion,
|
|
|
|
WebhookCacheAuthorizedTTL: o.WebhookCacheAuthorizedTTL,
|
|
|
|
WebhookCacheUnauthorizedTTL: o.WebhookCacheUnauthorizedTTL,
|
2019-01-12 04:58:27 +00:00
|
|
|
VersionedInformerFactory: versionedInformerFactory,
|
2020-12-01 01:06:26 +00:00
|
|
|
WebhookRetryBackoff: o.WebhookRetryBackoff,
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
}
|