github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

make well-known users and groups into constants

pull/6/head
deads2k 2016-09-29 16:27:14 -04:00
parent 4c8959df59
commit 57039cfdfa
11 changed files with 47 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cmd/kube-apiserver/app/server.go
View File

@ -279,15 +279,15 @@ func Run(s *options.APIServer) error {
var uid = uuid.NewRandom().String() var uid = uuid.NewRandom().String()
tokens := make(map[string]*user.DefaultInfo) tokens := make(map[string]*user.DefaultInfo)
tokens[privilegedLoopbackToken] = &user.DefaultInfo{ tokens[privilegedLoopbackToken] = &user.DefaultInfo{
Name: "system:apiserver", Name: user.APIServerUser,
UID: uid, UID: uid,
Groups: []string{"system:masters"}, Groups: []string{user.SystemPrivilegedGroup},
} }
tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens) tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator) apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)
tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters") tokenAuthorizer := authorizer.NewPrivilegedGroups(user.SystemPrivilegedGroup)
apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer) apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
} }

6
federation/cmd/federation-apiserver/app/server.go
View File

@ -187,15 +187,15 @@ func Run(s *options.ServerRunOptions) error {
var uid = uuid.NewRandom().String() var uid = uuid.NewRandom().String()
tokens := make(map[string]*user.DefaultInfo) tokens := make(map[string]*user.DefaultInfo)
tokens[privilegedLoopbackToken] = &user.DefaultInfo{ tokens[privilegedLoopbackToken] = &user.DefaultInfo{
Name: "system:apiserver", Name: user.APIServerUser,
UID: uid, UID: uid,
Groups: []string{"system:masters"}, Groups: []string{user.SystemPrivilegedGroup},
} }
tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens) tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator) apiAuthenticator = authenticatorunion.New(tokenAuthenticator, apiAuthenticator)
tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters") tokenAuthorizer := authorizer.NewPrivilegedGroups(user.SystemPrivilegedGroup)
apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer) apiAuthorizer = authorizerunion.New(tokenAuthorizer, apiAuthorizer)
} }

2
pkg/apiserver/authenticator/authn.go
View File

@ -141,7 +141,7 @@ func New(config AuthenticatorConfig) (authenticator.Request, error) {
authenticator := union.New(authenticators...) authenticator := union.New(authenticators...)
authenticator = group.NewGroupAdder(authenticator, []string{"system:authenticated"}) authenticator = group.NewGroupAdder(authenticator, []string{user.AllAuthenticated})
if config.Anonymous { if config.Anonymous {
// If the authenticator chain returns an error, return an error (don't consider a bad bearer token anonymous). // If the authenticator chain returns an error, return an error (don't consider a bad bearer token anonymous).

10
pkg/auth/user/user.go
View File

@ -65,3 +65,13 @@ func (i *DefaultInfo) GetGroups() []string {
func (i *DefaultInfo) GetExtra() map[string][]string { func (i *DefaultInfo) GetExtra() map[string][]string {
return i.Extra return i.Extra
} }
// well-known user and group names
const (
SystemPrivilegedGroup = "system:masters"
AllUnauthenticated = "system:unauthenticated"
AllAuthenticated = "system:authenticated"
Anonymous = "system:anonymous"
APIServerUser = "system:apiserver"
)

9
pkg/registry/rbac/clusterrole/policybased/storage.go
View File

@ -23,6 +23,7 @@ import (
"k8s.io/kubernetes/pkg/api/rest" "k8s.io/kubernetes/pkg/api/rest"
"k8s.io/kubernetes/pkg/apis/rbac" "k8s.io/kubernetes/pkg/apis/rbac"
"k8s.io/kubernetes/pkg/apis/rbac/validation" "k8s.io/kubernetes/pkg/apis/rbac/validation"
"k8s.io/kubernetes/pkg/auth/user"
"k8s.io/kubernetes/pkg/runtime" "k8s.io/kubernetes/pkg/runtime"
) )
@ -42,15 +43,15 @@ func NewStorage(s rest.StandardStorage, ruleResolver validation.AuthorizationRul
} }
func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) { func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) {
if user, ok := api.UserFrom(ctx); ok { if u, ok := api.UserFrom(ctx); ok {
if s.superUser != "" && user.GetName() == s.superUser { if s.superUser != "" && u.GetName() == s.superUser {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
// system:masters is special because the API server uses it for privileged loopback connections // system:masters is special because the API server uses it for privileged loopback connections
// therefore we know that a member of system:masters can always do anything // therefore we know that a member of system:masters can always do anything
for _, group := range user.GetGroups() { for _, group := range u.GetGroups() {
if group == "system:masters" { if group == user.SystemPrivilegedGroup {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
} }

9
pkg/registry/rbac/clusterrolebinding/policybased/storage.go
View File

@ -23,6 +23,7 @@ import (
"k8s.io/kubernetes/pkg/api/rest" "k8s.io/kubernetes/pkg/api/rest"
"k8s.io/kubernetes/pkg/apis/rbac" "k8s.io/kubernetes/pkg/apis/rbac"
"k8s.io/kubernetes/pkg/apis/rbac/validation" "k8s.io/kubernetes/pkg/apis/rbac/validation"
"k8s.io/kubernetes/pkg/auth/user"
"k8s.io/kubernetes/pkg/runtime" "k8s.io/kubernetes/pkg/runtime"
) )
@ -42,15 +43,15 @@ func NewStorage(s rest.StandardStorage, ruleResolver validation.AuthorizationRul
} }
func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) { func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) {
if user, ok := api.UserFrom(ctx); ok { if u, ok := api.UserFrom(ctx); ok {
if s.superUser != "" && user.GetName() == s.superUser { if s.superUser != "" && u.GetName() == s.superUser {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
// system:masters is special because the API server uses it for privileged loopback connections // system:masters is special because the API server uses it for privileged loopback connections
// therefore we know that a member of system:masters can always do anything // therefore we know that a member of system:masters can always do anything
for _, group := range user.GetGroups() { for _, group := range u.GetGroups() {
if group == "system:masters" { if group == user.SystemPrivilegedGroup {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
} }

9
pkg/registry/rbac/role/policybased/storage.go
View File

@ -23,6 +23,7 @@ import (
"k8s.io/kubernetes/pkg/api/rest" "k8s.io/kubernetes/pkg/api/rest"
"k8s.io/kubernetes/pkg/apis/rbac" "k8s.io/kubernetes/pkg/apis/rbac"
"k8s.io/kubernetes/pkg/apis/rbac/validation" "k8s.io/kubernetes/pkg/apis/rbac/validation"
"k8s.io/kubernetes/pkg/auth/user"
"k8s.io/kubernetes/pkg/runtime" "k8s.io/kubernetes/pkg/runtime"
) )
@ -42,15 +43,15 @@ func NewStorage(s rest.StandardStorage, ruleResolver validation.AuthorizationRul
} }
func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) { func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) {
if user, ok := api.UserFrom(ctx); ok { if u, ok := api.UserFrom(ctx); ok {
if s.superUser != "" && user.GetName() == s.superUser { if s.superUser != "" && u.GetName() == s.superUser {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
// system:masters is special because the API server uses it for privileged loopback connections // system:masters is special because the API server uses it for privileged loopback connections
// therefore we know that a member of system:masters can always do anything // therefore we know that a member of system:masters can always do anything
for _, group := range user.GetGroups() { for _, group := range u.GetGroups() {
if group == "system:masters" { if group == user.SystemPrivilegedGroup {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
} }

9
pkg/registry/rbac/rolebinding/policybased/storage.go
View File

@ -23,6 +23,7 @@ import (
"k8s.io/kubernetes/pkg/api/rest" "k8s.io/kubernetes/pkg/api/rest"
"k8s.io/kubernetes/pkg/apis/rbac" "k8s.io/kubernetes/pkg/apis/rbac"
"k8s.io/kubernetes/pkg/apis/rbac/validation" "k8s.io/kubernetes/pkg/apis/rbac/validation"
"k8s.io/kubernetes/pkg/auth/user"
"k8s.io/kubernetes/pkg/runtime" "k8s.io/kubernetes/pkg/runtime"
) )
@ -42,15 +43,15 @@ func NewStorage(s rest.StandardStorage, ruleResolver validation.AuthorizationRul
} }
func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) { func (s *Storage) Create(ctx api.Context, obj runtime.Object) (runtime.Object, error) {
if user, ok := api.UserFrom(ctx); ok { if u, ok := api.UserFrom(ctx); ok {
if s.superUser != "" && user.GetName() == s.superUser { if s.superUser != "" && u.GetName() == s.superUser {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
// system:masters is special because the API server uses it for privileged loopback connections // system:masters is special because the API server uses it for privileged loopback connections
// therefore we know that a member of system:masters can always do anything // therefore we know that a member of system:masters can always do anything
for _, group := range user.GetGroups() { for _, group := range u.GetGroups() {
if group == "system:masters" { if group == user.SystemPrivilegedGroup {
return s.StandardStorage.Create(ctx, obj) return s.StandardStorage.Create(ctx, obj)
} }
} }

4
plugin/pkg/auth/authenticator/request/anonymous/anonymous.go
View File

@ -24,9 +24,9 @@ import (
) )
const ( const (
anonymousUser = "system:anonymous" anonymousUser = user.Anonymous
unauthenticatedGroup = "system:unauthenticated" unauthenticatedGroup = user.AllUnauthenticated
) )
func NewAuthenticator() authenticator.Request { func NewAuthenticator() authenticator.Request {

9
plugin/pkg/auth/authenticator/request/anonymous/anonymous_test.go
View File

@ -20,6 +20,7 @@ import (
"testing" "testing"
"k8s.io/kubernetes/pkg/auth/authenticator" "k8s.io/kubernetes/pkg/auth/authenticator"
"k8s.io/kubernetes/pkg/auth/user"
"k8s.io/kubernetes/pkg/util/sets" "k8s.io/kubernetes/pkg/util/sets"
) )
@ -32,10 +33,10 @@ func TestAnonymous(t *testing.T) {
if !ok { if !ok {
t.Fatalf("Unexpectedly unauthenticated") t.Fatalf("Unexpectedly unauthenticated")
} }
if u.GetName() != "system:anonymous" { if u.GetName() != user.Anonymous {
t.Fatalf("Expected username %s, got %s", "system:anonymous", u.GetName()) t.Fatalf("Expected username %s, got %s", user.Anonymous, u.GetName())
} }
if !sets.NewString(u.GetGroups()...).Equal(sets.NewString("system:unauthenticated")) { if !sets.NewString(u.GetGroups()...).Equal(sets.NewString(user.AllUnauthenticated)) {
t.Fatalf("Expected group %s, got %v", "system:unauthenticated", u.GetGroups()) t.Fatalf("Expected group %s, got %v", user.AllUnauthenticated, u.GetGroups())
} }
} }

6
test/integration/framework/master_utils.go
View File

@ -165,15 +165,15 @@ func startMasterOrDie(masterConfig *master.Config) (*master.Master, *httptest.Se
if masterConfig.GenericConfig.Authenticator != nil { if masterConfig.GenericConfig.Authenticator != nil {
tokens := make(map[string]*user.DefaultInfo) tokens := make(map[string]*user.DefaultInfo)
tokens[privilegedLoopbackToken] = &user.DefaultInfo{ tokens[privilegedLoopbackToken] = &user.DefaultInfo{
Name: "system:apiserver", Name: user.APIServerUser,
UID: uuid.NewRandom().String(), UID: uuid.NewRandom().String(),
Groups: []string{"system:masters"}, Groups: []string{user.SystemPrivilegedGroup},
} }
tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens) tokenAuthenticator := authenticator.NewAuthenticatorFromTokens(tokens)
masterConfig.GenericConfig.Authenticator = authenticatorunion.New(tokenAuthenticator, masterConfig.GenericConfig.Authenticator) masterConfig.GenericConfig.Authenticator = authenticatorunion.New(tokenAuthenticator, masterConfig.GenericConfig.Authenticator)
tokenAuthorizer := authorizer.NewPrivilegedGroups("system:masters") tokenAuthorizer := authorizer.NewPrivilegedGroups(user.SystemPrivilegedGroup)
masterConfig.GenericConfig.Authorizer = authorizerunion.New(tokenAuthorizer, masterConfig.GenericConfig.Authorizer) masterConfig.GenericConfig.Authorizer = authorizerunion.New(tokenAuthorizer, masterConfig.GenericConfig.Authorizer)
masterConfig.GenericConfig.LoopbackClientConfig.BearerToken = privilegedLoopbackToken masterConfig.GenericConfig.LoopbackClientConfig.BearerToken = privilegedLoopbackToken