Merge pull request #2498 from wansir/federatednamespaces

add tenant federated namespaces API
2020-07-22 15:23:49 +08:00
parent 2a388ad493 3525fc5507
commit 1096eb8adb
30 changed files with 1374 additions and 1 deletions
--- a/pkg/models/resources/v1alpha3/federatednamespace/federatednamespaces.go
+++ b/pkg/models/resources/v1alpha3/federatednamespace/federatednamespaces.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package federatednamespace
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"kubesphere.io/kubesphere/pkg/api"
+	typesv1beta1 "kubesphere.io/kubesphere/pkg/apis/types/v1beta1"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
+)
+
+type federatedNamespacesGetter struct {
+	informers informers.SharedInformerFactory
+}
+
+func New(informers informers.SharedInformerFactory) v1alpha3.Interface {
+	return &federatedNamespacesGetter{informers: informers}
+}
+
+func (n federatedNamespacesGetter) Get(_, name string) (runtime.Object, error) {
+	return n.informers.Types().V1beta1().FederatedNamespaces().Lister().Get(name)
+}
+
+func (n federatedNamespacesGetter) List(_ string, query *query.Query) (*api.ListResult, error) {
+	ns, err := n.informers.Types().V1beta1().FederatedNamespaces().Lister().List(query.Selector())
+	if err != nil {
+		return nil, err
+	}
+
+	var result []runtime.Object
+	for _, item := range ns {
+		result = append(result, item)
+	}
+
+	return v1alpha3.DefaultList(result, query, n.compare, n.filter), nil
+}
+
+func (n federatedNamespacesGetter) filter(item runtime.Object, filter query.Filter) bool {
+	namespace, ok := item.(*typesv1beta1.FederatedNamespace)
+	if !ok {
+		return false
+	}
+	return v1alpha3.DefaultObjectMetaFilter(namespace.ObjectMeta, filter)
+}
+
+func (n federatedNamespacesGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
+	leftNs, ok := left.(*typesv1beta1.FederatedNamespace)
+	if !ok {
+		return false
+	}
+
+	rightNs, ok := right.(*typesv1beta1.FederatedNamespace)
+	if !ok {
+		return true
+	}
+	return v1alpha3.DefaultObjectMetaCompare(leftNs.ObjectMeta, rightNs.ObjectMeta, field)
+}
--- a/pkg/models/resources/v1alpha3/federatednamespace/federatednamespaces_test.go
+++ b/pkg/models/resources/v1alpha3/federatednamespace/federatednamespaces_test.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package federatednamespace
--- a/pkg/models/resources/v1alpha3/resource/resource.go
+++ b/pkg/models/resources/v1alpha3/resource/resource.go
@@ -27,6 +27,7 @@ import (
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
 	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
+	typesv1beta1 "kubesphere.io/kubesphere/pkg/apis/types/v1beta1"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	"kubesphere.io/kubesphere/pkg/informers"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
@@ -39,6 +40,7 @@ import (
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/daemonset"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/deployment"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/devops"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/federatednamespace"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrole"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrolebinding"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/namespace"
@@ -93,6 +95,9 @@ func NewResourceGetter(factory informers.InformerFactory) *ResourceGetter {
 	getters[snapshotv1beta1.SchemeGroupVersion.WithResource("volumesnapshots")] = volumesnapshot.New(factory.SnapshotSharedInformerFactory())
 	getters[schema.GroupVersionResource{Group: "cluster.kubesphere.io", Version: "v1alpha1", Resource: "clusters"}] = cluster.New(factory.KubeSphereSharedInformerFactory())
 	getters[schema.GroupVersionResource{Group: "apiextensions.k8s.io", Version: "v1", Resource: "customresourcedefinitions"}] = customresourcedefinition.New(factory.ApiExtensionSharedInformerFactory())
+
+	getters[typesv1beta1.SchemeGroupVersion.WithResource(typesv1beta1.ResourcesPluralFedNamespace)] = federatednamespace.New(factory.KubeSphereSharedInformerFactory())
+
 	return &ResourceGetter{
 		getters: getters,
 	}
--- a/pkg/models/tenant/tenant.go
+++ b/pkg/models/tenant/tenant.go
@@ -36,6 +36,7 @@ import (
 	clusterv1alpha1 "kubesphere.io/kubesphere/pkg/apis/cluster/v1alpha1"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
 	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
+	typesv1beta1 "kubesphere.io/kubesphere/pkg/apis/types/v1beta1"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizerfactory"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
@@ -59,6 +60,7 @@ import (
 type Interface interface {
 	ListWorkspaces(user user.Info, query *query.Query) (*api.ListResult, error)
 	ListNamespaces(user user.Info, workspace string, query *query.Query) (*api.ListResult, error)
+	ListFederatedNamespaces(info user.Info, workspace string, param *query.Query) (*api.ListResult, error)
 	CreateNamespace(workspace string, namespace *corev1.Namespace) (*corev1.Namespace, error)
 	CreateWorkspace(workspace *tenantv1alpha2.WorkspaceTemplate) (*tenantv1alpha2.WorkspaceTemplate, error)
 	DeleteWorkspace(workspace string) error
@@ -171,6 +173,85 @@ func (t *tenantOperator) ListWorkspaces(user user.Info, queryParam *query.Query)
 	return result, nil
 }

+func (t *tenantOperator) ListFederatedNamespaces(user user.Info, workspace string, queryParam *query.Query) (*api.ListResult, error) {
+	nsScope := request.ClusterScope
+	if workspace != "" {
+		nsScope = request.WorkspaceScope
+	}
+
+	listNS := authorizer.AttributesRecord{
+		User:            user,
+		Verb:            "list",
+		Workspace:       workspace,
+		Resource:        "namespaces",
+		ResourceRequest: true,
+		ResourceScope:   nsScope,
+	}
+
+	decision, _, err := t.authorizer.Authorize(listNS)
+
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+
+	if decision == authorizer.DecisionAllow {
+
+		if workspace != "" {
+			queryParam.Filters[query.FieldLabel] = query.Value(fmt.Sprintf("%s=%s", tenantv1alpha1.WorkspaceLabel, workspace))
+		}
+
+		result, err := t.resourceGetter.List(typesv1beta1.ResourcesPluralFedNamespace, "", queryParam)
+
+		if err != nil {
+			klog.Error(err)
+			return nil, err
+		}
+
+		return result, nil
+	}
+
+	roleBindings, err := t.am.ListRoleBindings(user.GetName(), "")
+
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+
+	namespaces := make([]runtime.Object, 0)
+
+	for _, roleBinding := range roleBindings {
+		namespace, err := t.resourceGetter.Get(typesv1beta1.ResourcesPluralFedNamespace, roleBinding.Namespace, roleBinding.Namespace)
+
+		if err != nil {
+			klog.Error(err)
+			return nil, err
+		}
+
+		// skip if not controlled by the specified workspace
+		if ns := namespace.(*typesv1beta1.FederatedNamespace); workspace != "" && ns.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+			continue
+		}
+
+		if !contains(namespaces, namespace) {
+			namespaces = append(namespaces, namespace)
+		}
+	}
+
+	result := resources.DefaultList(namespaces, queryParam, func(left runtime.Object, right runtime.Object, field query.Field) bool {
+		return resources.DefaultObjectMetaCompare(left.(*corev1.Namespace).ObjectMeta, right.(*corev1.Namespace).ObjectMeta, field)
+	}, func(object runtime.Object, filter query.Filter) bool {
+		namespace := object.(*typesv1beta1.FederatedNamespace).ObjectMeta
+		if workspace != "" {
+			if workspaceLabel, ok := namespace.Labels[tenantv1alpha1.WorkspaceLabel]; !ok || workspaceLabel != workspace {
+				return false
+			}
+		}
+		return resources.DefaultObjectMetaFilter(namespace, filter)
+	})
+	return result, nil
+}
+
 func (t *tenantOperator) ListNamespaces(user user.Info, workspace string, queryParam *query.Query) (*api.ListResult, error) {
 	nsScope := request.ClusterScope
 	if workspace != "" {