mirror of https://github.com/k3s-io/k3s
113 lines
4.3 KiB
Go
113 lines
4.3 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package authorizer
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"k8s.io/apiserver/pkg/authorization/authorizer"
|
|
"k8s.io/apiserver/pkg/authorization/authorizerfactory"
|
|
"k8s.io/apiserver/pkg/authorization/union"
|
|
"k8s.io/apiserver/plugin/pkg/authorizer/webhook"
|
|
versionedinformers "k8s.io/client-go/informers"
|
|
"k8s.io/kubernetes/pkg/auth/nodeidentifier"
|
|
"k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
|
|
"k8s.io/kubernetes/plugin/pkg/auth/authorizer/node"
|
|
"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac"
|
|
"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy"
|
|
)
|
|
|
|
// Config contains the data on how to authorize a request to the Kube API Server
|
|
type Config struct {
|
|
AuthorizationModes []string
|
|
|
|
// Options for ModeABAC
|
|
|
|
// Options for ModeWebhook
|
|
|
|
// Kubeconfig file for Webhook authorization plugin.
|
|
WebhookConfigFile string
|
|
// TTL for caching of authorized responses from the webhook server.
|
|
WebhookCacheAuthorizedTTL time.Duration
|
|
// TTL for caching of unauthorized responses from the webhook server.
|
|
WebhookCacheUnauthorizedTTL time.Duration
|
|
|
|
VersionedInformerFactory versionedinformers.SharedInformerFactory
|
|
}
|
|
|
|
// New returns the right sort of union of multiple authorizer.Authorizer objects
|
|
// based on the authorizationMode or an error.
|
|
func (config Config) New() (authorizer.Authorizer, authorizer.RuleResolver, error) {
|
|
if len(config.AuthorizationModes) == 0 {
|
|
return nil, nil, fmt.Errorf("at least one authorization mode must be passed")
|
|
}
|
|
|
|
var (
|
|
authorizers []authorizer.Authorizer
|
|
ruleResolvers []authorizer.RuleResolver
|
|
)
|
|
|
|
for _, authorizationMode := range config.AuthorizationModes {
|
|
// Keep cases in sync with constant list in k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes/modes.go.
|
|
switch authorizationMode {
|
|
case modes.ModeNode:
|
|
graph := node.NewGraph()
|
|
node.AddGraphEventHandlers(
|
|
graph,
|
|
config.VersionedInformerFactory.Core().V1().Nodes(),
|
|
config.VersionedInformerFactory.Core().V1().Pods(),
|
|
config.VersionedInformerFactory.Core().V1().PersistentVolumes(),
|
|
config.VersionedInformerFactory.Storage().V1beta1().VolumeAttachments(),
|
|
)
|
|
nodeAuthorizer := node.NewAuthorizer(graph, nodeidentifier.NewDefaultNodeIdentifier(), bootstrappolicy.NodeRules())
|
|
authorizers = append(authorizers, nodeAuthorizer)
|
|
|
|
case modes.ModeAlwaysAllow:
|
|
alwaysAllowAuthorizer := authorizerfactory.NewAlwaysAllowAuthorizer()
|
|
authorizers = append(authorizers, alwaysAllowAuthorizer)
|
|
ruleResolvers = append(ruleResolvers, alwaysAllowAuthorizer)
|
|
case modes.ModeAlwaysDeny:
|
|
alwaysDenyAuthorizer := authorizerfactory.NewAlwaysDenyAuthorizer()
|
|
authorizers = append(authorizers, alwaysDenyAuthorizer)
|
|
ruleResolvers = append(ruleResolvers, alwaysDenyAuthorizer)
|
|
case modes.ModeWebhook:
|
|
webhookAuthorizer, err := webhook.New(config.WebhookConfigFile,
|
|
config.WebhookCacheAuthorizedTTL,
|
|
config.WebhookCacheUnauthorizedTTL)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
authorizers = append(authorizers, webhookAuthorizer)
|
|
ruleResolvers = append(ruleResolvers, webhookAuthorizer)
|
|
case modes.ModeRBAC:
|
|
rbacAuthorizer := rbac.New(
|
|
&rbac.RoleGetter{Lister: config.VersionedInformerFactory.Rbac().V1().Roles().Lister()},
|
|
&rbac.RoleBindingLister{Lister: config.VersionedInformerFactory.Rbac().V1().RoleBindings().Lister()},
|
|
&rbac.ClusterRoleGetter{Lister: config.VersionedInformerFactory.Rbac().V1().ClusterRoles().Lister()},
|
|
&rbac.ClusterRoleBindingLister{Lister: config.VersionedInformerFactory.Rbac().V1().ClusterRoleBindings().Lister()},
|
|
)
|
|
authorizers = append(authorizers, rbacAuthorizer)
|
|
ruleResolvers = append(ruleResolvers, rbacAuthorizer)
|
|
default:
|
|
return nil, nil, fmt.Errorf("unknown authorization mode %s specified", authorizationMode)
|
|
}
|
|
}
|
|
|
|
return union.New(authorizers...), union.NewRuleResolvers(ruleResolvers...), nil
|
|
}
|