migrate legacy API

Signed-off-by: hongming <talonwan@yunify.com>

pkg/apiserver/authorization/authorizerfactory/opa_test.go

@@ -20,209 +20,22 @@ package authorizerfactory
 
 import (
 	"fmt"
+	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apiserver/pkg/authentication/user"
+	fakek8s "k8s.io/client-go/kubernetes/fake"
 	iamvealpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
 	"kubesphere.io/kubesphere/pkg/client/clientset/versioned/fake"
-	"kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	factory "kubesphere.io/kubesphere/pkg/informers"
 	"kubesphere.io/kubesphere/pkg/models/iam/am"
 	"testing"
 )
 
-func prepare() (am.AccessManagementInterface, error) {
-	rules := []*iamvealpha2.PolicyRule{
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.PolicyRuleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "always-allow",
-			},
-			Rego: "package authz\ndefault allow = true",
-		}, {
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.PolicyRuleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String(),
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "always-deny",
-			},
-			Rego: "package authz\ndefault allow = false",
-		}, {
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.PolicyRuleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "manage-cluster1-resources",
-			},
-			Rego: `package authz
-default allow = false
-allow {
-  resources_in_cluster1
-}
-resources_in_cluster1 {
-	input.Cluster == "cluster1"
-}`,
-		},
-	}
-
-	roles := []*iamvealpha2.Role{
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "global-admin",
-			},
-			Target: iamvealpha2.Target{
-				Scope: iamvealpha2.GlobalScope,
-				Name:  "",
-			},
-			Rules: []iamvealpha2.RuleRef{
-				{
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Kind:     iamvealpha2.PolicyRuleKind,
-					Name:     "always-allow",
-				},
-			},
-		},
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "anonymous",
-			},
-			Target: iamvealpha2.Target{
-				Scope: iamvealpha2.GlobalScope,
-				Name:  "",
-			},
-			Rules: []iamvealpha2.RuleRef{
-				{
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Kind:     iamvealpha2.PolicyRuleKind,
-					Name:     "always-deny",
-				},
-			},
-		},
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "cluster1-admin",
-			},
-			Target: iamvealpha2.Target{
-				Scope: iamvealpha2.GlobalScope,
-				Name:  "",
-			},
-			Rules: []iamvealpha2.RuleRef{
-				{
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Kind:     iamvealpha2.PolicyRuleKind,
-					Name:     "manage-cluster1-resources",
-				},
-			},
-		},
-	}
-
-	roleBindings := []*iamvealpha2.RoleBinding{
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleBindingKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "global-admin",
-			},
-			Scope: iamvealpha2.GlobalScope,
-			RoleRef: iamvealpha2.RoleRef{
-				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-				Kind:     iamvealpha2.RoleKind,
-				Name:     "global-admin",
-			},
-			Subjects: []iamvealpha2.Subject{
-				{
-					Kind:     iamvealpha2.UserKind,
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Name:     "admin",
-				},
-			},
-		},
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleBindingKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "anonymous",
-			},
-			Scope: iamvealpha2.GlobalScope,
-			RoleRef: iamvealpha2.RoleRef{
-				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-				Kind:     iamvealpha2.RoleKind,
-				Name:     "anonymous",
-			},
-			Subjects: []iamvealpha2.Subject{
-				{
-					Kind:     iamvealpha2.UserKind,
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Name:     user.Anonymous,
-				},
-			},
-		},
-		{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       iamvealpha2.RoleBindingKind,
-				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "cluster1-admin",
-			},
-			Scope: iamvealpha2.GlobalScope,
-			RoleRef: iamvealpha2.RoleRef{
-				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-				Kind:     iamvealpha2.RoleKind,
-				Name:     "cluster1-admin",
-			},
-			Subjects: []iamvealpha2.Subject{
-				{
-					Kind:     iamvealpha2.UserKind,
-					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
-					Name:     "tom",
-				},
-			},
-		},
-	}
-
-	ksClient := fake.NewSimpleClientset()
-	informerFactory := externalversions.NewSharedInformerFactory(ksClient, 0)
-
-	for _, rule := range rules {
-		err := informerFactory.Iam().V1alpha2().PolicyRules().Informer().GetIndexer().Add(rule)
-		if err != nil {
-			return nil, fmt.Errorf("add rule:%s", err)
-		}
-	}
-	for _, role := range roles {
-		err := informerFactory.Iam().V1alpha2().Roles().Informer().GetIndexer().Add(role)
-		if err != nil {
-			return nil, fmt.Errorf("add role:%s", err)
-		}
-	}
-	for _, roleBinding := range roleBindings {
-		err := informerFactory.Iam().V1alpha2().RoleBindings().Informer().GetIndexer().Add(roleBinding)
-		if err != nil {
-			return nil, fmt.Errorf("add role binding:%s", err)
-		}
-	}
-
-	operator := am.NewAMOperator(ksClient, informerFactory)
-
-	return operator, nil
-}
-
 func TestGlobalRole(t *testing.T) {
 
 	operator, err := prepare()
+
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -244,14 +57,8 @@ func TestGlobalRole(t *testing.T) {
 					Extra:  nil,
 				},
 				Verb:              "list",
-				Cluster:           "",
-				Workspace:         "",
-				Namespace:         "",
-				APIGroup:          "",
 				APIVersion:        "v1",
 				Resource:          "nodes",
-				Subresource:       "",
-				Name:              "",
 				KubernetesRequest: true,
 				ResourceRequest:   true,
 				Path:              "/api/v1/nodes",
@@ -268,19 +75,13 @@ func TestGlobalRole(t *testing.T) {
 					Extra:  nil,
 				},
 				Verb:              "list",
-				Cluster:           "",
-				Workspace:         "",
-				Namespace:         "",
-				APIGroup:          "",
 				APIVersion:        "v1",
 				Resource:          "nodes",
-				Subresource:       "",
-				Name:              "",
 				KubernetesRequest: true,
 				ResourceRequest:   true,
 				Path:              "/api/v1/nodes",
 			},
-			expectedDecision: authorizer.DecisionDeny,
+			expectedDecision: authorizer.DecisionNoOpinion,
 		}, {
 			name: "tom can list nodes in cluster1",
 			request: authorizer.AttributesRecord{
@@ -289,13 +90,8 @@ func TestGlobalRole(t *testing.T) {
 				},
 				Verb:              "list",
 				Cluster:           "cluster1",
-				Workspace:         "",
-				Namespace:         "",
-				APIGroup:          "",
 				APIVersion:        "v1",
 				Resource:          "nodes",
-				Subresource:       "",
-				Name:              "",
 				KubernetesRequest: true,
 				ResourceRequest:   true,
 				Path:              "/api/v1/clusters/cluster1/nodes",
@@ -310,18 +106,13 @@ func TestGlobalRole(t *testing.T) {
 				},
 				Verb:              "list",
 				Cluster:           "cluster2",
-				Workspace:         "",
-				Namespace:         "",
-				APIGroup:          "",
 				APIVersion:        "v1",
 				Resource:          "nodes",
-				Subresource:       "",
-				Name:              "",
 				KubernetesRequest: true,
 				ResourceRequest:   true,
 				Path:              "/api/v1/clusters/cluster2/nodes",
 			},
-			expectedDecision: authorizer.DecisionDeny,
+			expectedDecision: authorizer.DecisionNoOpinion,
 		},
 	}
 
@@ -335,3 +126,127 @@ func TestGlobalRole(t *testing.T) {
 		}
 	}
 }
+
+func prepare() (am.AccessManagementInterface, error) {
+	globalRoles := []*iamvealpha2.GlobalRole{
+		{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRole,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String(),
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        "global-admin",
+				Annotations: map[string]string{iamvealpha2.RegoOverrideAnnotation: "package authz\ndefault allow = true"},
+			},
+		}, {
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRole,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String(),
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        "anonymous",
+				Annotations: map[string]string{iamvealpha2.RegoOverrideAnnotation: "package authz\ndefault allow = false"},
+			},
+		}, {
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRole,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String(),
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "cluster1-admin",
+				Annotations: map[string]string{iamvealpha2.RegoOverrideAnnotation: `package authz
+default allow = false
+allow {
+  resources_in_cluster1
+}
+resources_in_cluster1 {
+	input.Cluster == "cluster1"
+}`},
+			},
+		},
+	}
+
+	roleBindings := []*iamvealpha2.GlobalRoleBinding{
+		{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRoleBinding,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "global-admin",
+			},
+			RoleRef: rbacv1.RoleRef{
+				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+				Kind:     iamvealpha2.ResourceKindGlobalRole,
+				Name:     "global-admin",
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:     iamvealpha2.ResourceKindUser,
+					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+					Name:     "admin",
+				},
+			},
+		},
+		{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRoleBinding,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "anonymous",
+			},
+			RoleRef: rbacv1.RoleRef{
+				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+				Kind:     iamvealpha2.ResourceKindGlobalRole,
+				Name:     "anonymous",
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:     iamvealpha2.ResourceKindUser,
+					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+					Name:     user.Anonymous,
+				},
+			},
+		},
+		{
+			TypeMeta: metav1.TypeMeta{
+				Kind:       iamvealpha2.ResourceKindGlobalRoleBinding,
+				APIVersion: iamvealpha2.SchemeGroupVersion.String()},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "cluster1-admin",
+			},
+			RoleRef: rbacv1.RoleRef{
+				APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+				Kind:     iamvealpha2.ResourceKindGlobalRole,
+				Name:     "cluster1-admin",
+			},
+			Subjects: []rbacv1.Subject{
+				{
+					Kind:     iamvealpha2.ResourceKindUser,
+					APIGroup: iamvealpha2.SchemeGroupVersion.String(),
+					Name:     "tom",
+				},
+			},
+		},
+	}
+
+	ksClient := fake.NewSimpleClientset()
+	k8sClient := fakek8s.NewSimpleClientset()
+	factory := factory.NewInformerFactories(k8sClient, ksClient, nil, nil)
+	for _, role := range globalRoles {
+		err := factory.KubeSphereSharedInformerFactory().Iam().V1alpha2().GlobalRoles().Informer().GetIndexer().Add(role)
+		if err != nil {
+			return nil, fmt.Errorf("add role:%s", err)
+		}
+	}
+
+	for _, roleBinding := range roleBindings {
+		err := factory.KubeSphereSharedInformerFactory().Iam().V1alpha2().GlobalRoleBindings().Informer().GetIndexer().Add(roleBinding)
+		if err != nil {
+			return nil, fmt.Errorf("add role binding:%s", err)
+		}
+	}
+
+	operator := am.NewAMOperator(factory)
+
+	return operator, nil
+}