admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

load data from lister

Browse Source 
Signed-off-by: hongming <talonwan@yunify.com>
This commit is contained in:
hongming
2018-12-02 21:07:51 +08:00
parent 3041d90e22
commit 1df7185112
4 changed files with 164 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/models/controllers/clusterrole_bindings.go
View File

@@ -45,12 +45,7 @@ func (ctl *ClusterRoleBindingCtl) sync(stopChan chan struct{}) {
}
func (ctl *ClusterRoleBindingCtl) total() int {
list, err := ctl.lister.List(labels.Everything())
if err != nil {
glog.Errorf("count %s failed, reason:%s", ctl.Name(), err)
return 0
}
return len(list)
return 0
}
func (ctl *ClusterRoleBindingCtl) handleWorkspaceRoleChange(clusterRole *rbac.ClusterRoleBinding) {

9
pkg/models/controllers/role_bindings.go
View File

@@ -19,9 +19,7 @@ package controllers
import (
"time"
"github.com/golang/glog"
"github.com/pkg/errors"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/client-go/informers"
)
@@ -35,12 +33,7 @@ func (ctl *RoleBindingCtl) sync(stopChan chan struct{}) {
}
func (ctl *RoleBindingCtl) total() int {
list, err := ctl.lister.List(labels.Everything())
if err != nil {
glog.Errorf("count %s falied, reason:%s", err, ctl.Name())
return 0
}
return len(list)
return 0
}
func (ctl *RoleBindingCtl) initListerAndInformer() {

177
pkg/models/iam/iam.go
View File

@@ -27,9 +27,15 @@ const ClusterRoleKind = "ClusterRole"
// Get user list based on workspace role
func WorkspaceRoleUsers(workspace string, roleName string) ([]User, error) {
k8sClient := client.NewK8sClient()
lister, err := controllers.GetLister(controllers.ClusterRoleBindings)
roleBinding, err := k8sClient.RbacV1().ClusterRoleBindings().Get(fmt.Sprintf("system:%s:%s", workspace, roleName), meta_v1.GetOptions{})
if err != nil {
return nil, err
}
clusterRoleBindingLister := lister.(v12.ClusterRoleBindingLister)
workspaceRoleBinding, err := clusterRoleBindingLister.Get(fmt.Sprintf("system:%s:%s", workspace, roleName))
if err != nil {
return nil, err
@@ -37,7 +43,7 @@ func WorkspaceRoleUsers(workspace string, roleName string) ([]User, error) {
names := make([]string, 0)
for _, subject := range roleBinding.Subjects {
for _, subject := range workspaceRoleBinding.Subjects {
if subject.Kind == v1.UserKind {
names = append(names, subject.Name)
}
@@ -121,16 +127,23 @@ func GetUser(name string) (*User, error) {
// Get rules
func WorkspaceRoleRules(workspace string, roleName string) (*v1.ClusterRole, []Rule, error) {
k8sClient := client.NewK8sClient()
role, err := k8sClient.RbacV1().ClusterRoles().Get(fmt.Sprintf("system:%s:%s", workspace, roleName), meta_v1.GetOptions{})
lister, err := controllers.GetLister(controllers.ClusterRoles)
if err != nil {
return nil, nil, err
}
for i := 0; i < len(role.Rules); i++ {
role.Rules[i].ResourceNames = nil
clusterRoleLister := lister.(v12.ClusterRoleLister)
workspaceRole, err := clusterRoleLister.Get(fmt.Sprintf("system:%s:%s", workspace, roleName))
if err != nil {
return nil, nil, err
}
for i := 0; i < len(workspaceRole.Rules); i++ {
workspaceRole.Rules[i].ResourceNames = nil
}
rules := make([]Rule, 0)
@@ -138,7 +151,7 @@ func WorkspaceRoleRules(workspace string, roleName string) (*v1.ClusterRole, []R
rule := Rule{Name: WorkspaceRoleRuleMapping[i].Name}
rule.Actions = make([]Action, 0)
for j := 0; j < len(WorkspaceRoleRuleMapping[i].Actions); j++ {
if rulesMatchesAction(role.Rules, WorkspaceRoleRuleMapping[i].Actions[j]) {
if rulesMatchesAction(workspaceRole.Rules, WorkspaceRoleRuleMapping[i].Actions[j]) {
rule.Actions = append(rule.Actions, WorkspaceRoleRuleMapping[i].Actions[j])
}
}
@@ -147,9 +160,9 @@ func WorkspaceRoleRules(workspace string, roleName string) (*v1.ClusterRole, []R
}
}
role.Name = roleName
workspaceRole.Name = roleName
return role, rules, nil
return workspaceRole, rules, nil
}
func GetUserNamespaces(username string, requiredRule v1.PolicyRule) (allNamespace bool, namespaces []string, err error) {
@@ -210,15 +223,22 @@ func GetUserNamespaces(username string, requiredRule v1.PolicyRule) (allNamespac
}
func DeleteRoleBindings(username string) error {
k8s := client.NewK8sClient()
roleBindings, err := k8s.RbacV1().RoleBindings("").List(meta_v1.ListOptions{})
lister, err := controllers.GetLister(controllers.RoleBindings)
if err != nil {
return err
}
for _, roleBinding := range roleBindings.Items {
roleBindingLister := lister.(v12.RoleBindingLister)
roleBindings, err := roleBindingLister.List(labels.Everything())
if err != nil {
return err
}
for _, roleBinding := range roleBindings {
length1 := len(roleBinding.Subjects)
@@ -233,30 +253,38 @@ func DeleteRoleBindings(username string) error {
if length2 == 0 {
deletePolicy := meta_v1.DeletePropagationForeground
k8s.RbacV1().RoleBindings(roleBinding.Namespace).Delete(roleBinding.Name, &meta_v1.DeleteOptions{PropagationPolicy: &deletePolicy})
client.NewK8sClient().RbacV1().RoleBindings(roleBinding.Namespace).Delete(roleBinding.Name, &meta_v1.DeleteOptions{PropagationPolicy: &deletePolicy})
} else if length2 < length1 {
k8s.RbacV1().RoleBindings(roleBinding.Namespace).Update(&roleBinding)
client.NewK8sClient().RbacV1().RoleBindings(roleBinding.Namespace).Update(roleBinding)
}
}
clusterRoleBindingList, err := k8s.RbacV1().ClusterRoleBindings().List(meta_v1.ListOptions{})
lister, err = controllers.GetLister(controllers.ClusterRoleBindings)
for _, roleBinding := range clusterRoleBindingList.Items {
length1 := len(roleBinding.Subjects)
if err != nil {
return err
}
for index, subject := range roleBinding.Subjects {
clusterRoleBindingLister := lister.(v12.ClusterRoleBindingLister)
clusterRoleBindings, err := clusterRoleBindingLister.List(labels.Everything())
for _, clusterRoleBinding := range clusterRoleBindings {
length1 := len(clusterRoleBinding.Subjects)
for index, subject := range clusterRoleBinding.Subjects {
if subject.Kind == v1.UserKind && subject.Name == username {
roleBinding.Subjects = append(roleBinding.Subjects[:index], roleBinding.Subjects[index+1:]...)
clusterRoleBinding.Subjects = append(clusterRoleBinding.Subjects[:index], clusterRoleBinding.Subjects[index+1:]...)
index--
}
}
length2 := len(roleBinding.Subjects)
length2 := len(clusterRoleBinding.Subjects)
if length2 == 0 {
deletePolicy := meta_v1.DeletePropagationForeground
k8s.RbacV1().ClusterRoleBindings().Delete(roleBinding.Name, &meta_v1.DeleteOptions{PropagationPolicy: &deletePolicy})
client.NewK8sClient().RbacV1().ClusterRoleBindings().Delete(clusterRoleBinding.Name, &meta_v1.DeleteOptions{PropagationPolicy: &deletePolicy})
} else if length2 < length1 {
k8s.RbacV1().ClusterRoleBindings().Update(&roleBinding)
client.NewK8sClient().RbacV1().ClusterRoleBindings().Update(clusterRoleBinding)
}
}
@@ -264,27 +292,42 @@ func DeleteRoleBindings(username string) error {
}
func GetRole(namespace string, name string) (*v1.Role, error) {
k8s := client.NewK8sClient()
role, err := k8s.RbacV1().Roles(namespace).Get(name, meta_v1.GetOptions{})
lister, err := controllers.GetLister(controllers.Roles)
if err != nil {
return nil, err
}
roleLister := lister.(v12.RoleLister)
role, err := roleLister.Roles(namespace).Get(name)
if err != nil {
return nil, err
}
return role, nil
}
func GetWorkspaceUsers(workspace string, role string) []string {
users := make([]string, 0)
clusterRoleBindingLister := controllers.ResourceControllers.Controllers[controllers.ClusterRoleBindings].Lister().(v12.ClusterRoleBindingLister)
clusterRoleBinding, err := clusterRoleBindingLister.Get(fmt.Sprintf("system:%s:%s", workspace, role))
func GetWorkspaceUsers(workspace string, workspaceRole string) ([]string, error) {
lister, err := controllers.GetLister(controllers.ClusterRoleBindings)
if err != nil {
return users
return nil, err
}
clusterRoleBindingLister := lister.(v12.ClusterRoleBindingLister)
clusterRoleBinding, err := clusterRoleBindingLister.Get(fmt.Sprintf("system:%s:%s", workspace, workspaceRole))
if err != nil {
return nil, err
}
users := make([]string, 0)
for _, s := range clusterRoleBinding.Subjects {
if s.Kind == v1.UserKind && !slice.ContainsString(users, s.Name, nil) {
users = append(users, s.Name)
}
}
return users
return users, nil
}
func GetClusterRoleBindings(name string) ([]v1.ClusterRoleBinding, error) {
@@ -307,9 +350,15 @@ func GetClusterRoleBindings(name string) ([]v1.ClusterRoleBinding, error) {
}
func GetRoleBindings(namespace string, name string) ([]v1.RoleBinding, error) {
k8s := client.NewK8sClient()
lister, err := controllers.GetLister(controllers.RoleBindings)
roleBindingList, err := k8s.RbacV1().RoleBindings(namespace).List(meta_v1.ListOptions{})
if err != nil {
return nil, err
}
roleBindingLister := lister.(v12.RoleBindingLister)
roleBindings, err := roleBindingLister.RoleBindings(namespace).List(labels.Everything())
if err != nil {
return nil, err
@@ -317,9 +366,9 @@ func GetRoleBindings(namespace string, name string) ([]v1.RoleBinding, error) {
items := make([]v1.RoleBinding, 0)
for _, roleBinding := range roleBindingList.Items {
for _, roleBinding := range roleBindings {
if roleBinding.RoleRef.Name == name {
items = append(items, roleBinding)
items = append(items, *roleBinding)
}
}
@@ -327,8 +376,16 @@ func GetRoleBindings(namespace string, name string) ([]v1.RoleBinding, error) {
}
func GetClusterRole(name string) (*v1.ClusterRole, error) {
k8s := client.NewK8sClient()
role, err := k8s.RbacV1().ClusterRoles().Get(name, meta_v1.GetOptions{})
lister, err := controllers.GetLister(controllers.ClusterRoles)
if err != nil {
return nil, err
}
clusterRoleLister := lister.(v12.ClusterRoleLister)
role, err := clusterRoleLister.Get(name)
if err != nil {
return nil, err
}
@@ -336,15 +393,36 @@ func GetClusterRole(name string) (*v1.ClusterRole, error) {
}
func GetRoles(namespace string, username string) ([]v1.Role, error) {
roleBindingLister := controllers.ResourceControllers.Controllers[controllers.RoleBindings].Lister().(v12.RoleBindingLister)
roleLister := controllers.ResourceControllers.Controllers[controllers.Roles].Lister().(v12.RoleLister)
clusterRoleLister := controllers.ResourceControllers.Controllers[controllers.ClusterRoles].Lister().(v12.ClusterRoleLister)
lister, err := controllers.GetLister(controllers.RoleBindings)
if err != nil {
return nil, err
}
roleBindingLister := lister.(v12.RoleBindingLister)
lister, err = controllers.GetLister(controllers.Roles)
if err != nil {
return nil, err
}
roleLister := lister.(v12.RoleLister)
lister, err = controllers.GetLister(controllers.ClusterRoles)
if err != nil {
return nil, err
}
clusterRoleLister := lister.(v12.ClusterRoleLister)
roleBindings, err := roleBindingLister.RoleBindings(namespace).List(labels.Everything())
if err != nil {
return nil, err
}
roles := make([]v1.Role, 0)
for _, roleBinding := range roleBindings {
@@ -391,8 +469,23 @@ func GetRoles(namespace string, username string) ([]v1.Role, error) {
// Get cluster roles by username
func GetClusterRoles(username string) ([]v1.ClusterRole, error) {
clusterRoleBindingLister := controllers.ResourceControllers.Controllers[controllers.ClusterRoleBindings].Lister().(v12.ClusterRoleBindingLister)
clusterRoleLister := controllers.ResourceControllers.Controllers[controllers.ClusterRoles].Lister().(v12.ClusterRoleLister)
lister, err := controllers.GetLister(controllers.ClusterRoleBindings)
if err != nil {
return nil, err
}
clusterRoleBindingLister := lister.(v12.ClusterRoleBindingLister)
lister, err = controllers.GetLister(controllers.ClusterRoles)
if err != nil {
return nil, err
}
clusterRoleLister := lister.(v12.ClusterRoleLister)
clusterRoleBindings, err := clusterRoleBindingLister.List(labels.Everything())
if err != nil {

36
pkg/models/workspaces/workspaces.go
View File

@@ -28,6 +28,8 @@ import (
"sort"
v12 "k8s.io/client-go/listers/rbac/v1"
"kubesphere.io/kubesphere/pkg/client"
"kubesphere.io/kubesphere/pkg/constants"
"kubesphere.io/kubesphere/pkg/models/controllers"
@@ -109,18 +111,28 @@ func CreateDevopsProject(username string, workspace string, devops DevopsProject
return &project, nil
}
func createDefaultDevopsRoleBinding(workspace string, project DevopsProject) {
admins := iam.GetWorkspaceUsers(workspace, constants.WorkspaceAdmin)
func createDefaultDevopsRoleBinding(workspace string, project DevopsProject) error {
admins, err := iam.GetWorkspaceUsers(workspace, constants.WorkspaceAdmin)
if err != nil {
return err
}
for _, admin := range admins {
createDevopsRoleBinding(workspace, *project.ProjectId, admin, constants.DevopsOwner)
}
viewers := iam.GetWorkspaceUsers(workspace, constants.WorkspaceViewer)
viewers, err := iam.GetWorkspaceUsers(workspace, constants.WorkspaceViewer)
if err != nil {
return err
}
for _, viewer := range viewers {
createDevopsRoleBinding(workspace, *project.ProjectId, viewer, constants.DevopsReporter)
}
return nil
}
func deleteDevopsRoleBinding(workspace string, projectId string, user string) {
@@ -489,7 +501,6 @@ func Detail(name string) (*Workspace, error) {
// List all workspaces for the current user
func ListWorkspaceByUser(username string, keyword string) ([]*Workspace, error) {
clusterRoles, err := iam.GetClusterRoles(username)
if err != nil {
@@ -527,7 +538,6 @@ func ListWorkspaceByUser(username string, keyword string) ([]*Workspace, error)
}
}
}
return workspaces, err
}
@@ -760,6 +770,7 @@ func Invite(workspaceName string, users []UserInvite) error {
}
func NamespaceExistCheck(namespaceName string) (bool, error) {
_, err := client.NewK8sClient().CoreV1().Namespaces().Get(namespaceName, meta_v1.GetOptions{})
if err != nil {
@@ -805,10 +816,17 @@ func RemoveMembers(workspaceName string, users []string) error {
func Roles(workspace *Workspace) ([]*v1.ClusterRole, error) {
roles := make([]*v1.ClusterRole, 0)
k8sClient := client.NewK8sClient()
lister, err := controllers.GetLister(controllers.ClusterRoles)
if err != nil {
return nil, err
}
clusterRoleLister := lister.(v12.ClusterRoleLister)
for _, name := range constants.WorkSpaceRoles {
role, err := k8sClient.RbacV1().ClusterRoles().Get(fmt.Sprintf("system:%s:%s", workspace.Name, name), meta_v1.GetOptions{})
clusterRole, err := clusterRoleLister.Get(fmt.Sprintf("system:%s:%s", workspace.Name, name))
if err != nil {
if apierrors.IsNotFound(err) {
@@ -817,8 +835,8 @@ func Roles(workspace *Workspace) ([]*v1.ClusterRole, error) {
return nil, err
}
role.Name = name
roles = append(roles, role)
clusterRole.Name = name
roles = append(roles, clusterRole)
}
return roles, nil