hongming
@@ -19,103 +19,81 @@ package am
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
"k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/labels"
|
||||
k8sinformers "k8s.io/client-go/informers"
|
||||
"k8s.io/klog"
|
||||
"kubesphere.io/kubesphere/pkg/api"
|
||||
iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
|
||||
kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
|
||||
informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
|
||||
tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
|
||||
"kubesphere.io/kubesphere/pkg/apiserver/query"
|
||||
ksinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
|
||||
"kubesphere.io/kubesphere/pkg/informers"
|
||||
resourcev1alpha3 "kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/resource"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
type AccessManagementInterface interface {
|
||||
ListRolesOfUser(scope iamv1alpha2.Scope, username string) ([]iamv1alpha2.Role, error)
|
||||
GetRoleOfUserInTargetScope(scope iamv1alpha2.Scope, target string, username string) (*iamv1alpha2.Role, error)
|
||||
GetPolicyRule(name string) (*iamv1alpha2.PolicyRule, error)
|
||||
GetGlobalRoleOfUser(username string) (*iamv1alpha2.GlobalRole, error)
|
||||
GetWorkspaceRoleOfUser(username, workspace string) (*iamv1alpha2.WorkspaceRole, error)
|
||||
GetClusterRoleOfUser(username, cluster string) (*rbacv1.ClusterRole, error)
|
||||
GetNamespaceRoleOfUser(username, namespace string) (*rbacv1.Role, error)
|
||||
ListRoles(username string, query *query.Query) (*api.ListResult, error)
|
||||
ListClusterRoles(query *query.Query) (*api.ListResult, error)
|
||||
ListWorkspaceRoles(query *query.Query) (*api.ListResult, error)
|
||||
ListGlobalRoles(query *query.Query) (*api.ListResult, error)
|
||||
|
||||
ListGlobalRoleBindings(username string) ([]*iamv1alpha2.GlobalRoleBinding, error)
|
||||
ListClusterRoleBindings(username string) ([]*rbacv1.ClusterRoleBinding, error)
|
||||
ListWorkspaceRoleBindings(username, workspace string) ([]*iamv1alpha2.WorkspaceRoleBinding, error)
|
||||
ListRoleBindings(username, namespace string) ([]*rbacv1.RoleBinding, error)
|
||||
|
||||
GetRoleReferenceRules(roleRef rbacv1.RoleRef, bindingNamespace string) ([]rbacv1.PolicyRule, error)
|
||||
}
|
||||
|
||||
type amOperator struct {
|
||||
informers informers.SharedInformerFactory
|
||||
ksClient kubesphere.Interface
|
||||
ksinformer ksinformers.SharedInformerFactory
|
||||
k8sinformer k8sinformers.SharedInformerFactory
|
||||
resourceGetter *resourcev1alpha3.ResourceGetter
|
||||
}
|
||||
|
||||
func NewAMOperator(ksClient kubesphere.Interface, informers informers.SharedInformerFactory) AccessManagementInterface {
|
||||
func NewAMOperator(factory informers.InformerFactory) AccessManagementInterface {
|
||||
return &amOperator{
|
||||
informers: informers,
|
||||
ksClient: ksClient,
|
||||
ksinformer: factory.KubeSphereSharedInformerFactory(),
|
||||
k8sinformer: factory.KubernetesSharedInformerFactory(),
|
||||
resourceGetter: resourcev1alpha3.NewResourceGetter(factory),
|
||||
}
|
||||
}
|
||||
|
||||
func containsUser(subjets []iamv1alpha2.Subject, username string) bool {
|
||||
for _, sub := range subjets {
|
||||
if sub.Kind == iamv1alpha2.UserKind && sub.Name == username {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
func (am *amOperator) GetGlobalRoleOfUser(username string) (*iamv1alpha2.GlobalRole, error) {
|
||||
|
||||
func (am *amOperator) ListRolesOfUser(scope iamv1alpha2.Scope, username string) ([]iamv1alpha2.Role, error) {
|
||||
|
||||
lister := am.informers.Iam().V1alpha2().RoleBindings().Lister()
|
||||
|
||||
roleBindings, err := lister.List(labels.Everything())
|
||||
roleBindings, err := am.ksinformer.Iam().V1alpha2().GlobalRoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
roleBindingsInScope := filterRoleBindingByScope(roleBindings, scope)
|
||||
userRoleBindings := make([]*iamv1alpha2.GlobalRoleBinding, 0)
|
||||
|
||||
roles := make([]iamv1alpha2.Role, 0)
|
||||
|
||||
for _, roleBinding := range roleBindingsInScope {
|
||||
if containsUser(roleBinding.Subjects, username) {
|
||||
role, err := am.informers.
|
||||
Iam().V1alpha2().Roles().Lister().Get(roleBinding.RoleRef.Name)
|
||||
|
||||
if err != nil {
|
||||
if errors.IsNotFound(err) {
|
||||
continue
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
roles = append(roles, *role)
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
userRoleBindings = append(userRoleBindings, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
return roles, nil
|
||||
}
|
||||
|
||||
func filterRoleBindingByScope(roles []*iamv1alpha2.RoleBinding, scope iamv1alpha2.Scope) []*iamv1alpha2.RoleBinding {
|
||||
result := make([]*iamv1alpha2.RoleBinding, 0)
|
||||
for _, role := range roles {
|
||||
if role.Scope == scope {
|
||||
result = append(result, role)
|
||||
if len(userRoleBindings) > 0 {
|
||||
role, err := am.ksinformer.Iam().V1alpha2().GlobalRoles().Lister().Get(userRoleBindings[0].RoleRef.Name)
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func (am *amOperator) GetPolicyRule(name string) (*iamv1alpha2.PolicyRule, error) {
|
||||
lister := am.informers.Iam().V1alpha2().PolicyRules().Lister()
|
||||
return lister.Get(name)
|
||||
}
|
||||
|
||||
// Users can only bind one role at each level
|
||||
func (am *amOperator) GetRoleOfUserInTargetScope(scope iamv1alpha2.Scope, target, username string) (*iamv1alpha2.Role, error) {
|
||||
roles, err := am.ListRolesOfUser(scope, username)
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
for _, role := range roles {
|
||||
if role.Target.Name == target {
|
||||
return &role, nil
|
||||
if len(roleBindings) > 1 {
|
||||
klog.Warningf("conflict global role binding, username: %s", username)
|
||||
}
|
||||
return role, nil
|
||||
}
|
||||
|
||||
err = &errors.StatusError{ErrStatus: metav1.Status{
|
||||
@@ -124,11 +102,274 @@ func (am *amOperator) GetRoleOfUserInTargetScope(scope iamv1alpha2.Scope, target
|
||||
Reason: metav1.StatusReasonNotFound,
|
||||
Details: &metav1.StatusDetails{
|
||||
Group: iamv1alpha2.SchemeGroupVersion.Group,
|
||||
Kind: iamv1alpha2.RoleBindingKind,
|
||||
Kind: iamv1alpha2.ResourceKindGlobalRoleBinding,
|
||||
},
|
||||
Message: fmt.Sprintf("role bind not found in %s %s scope", target, scope),
|
||||
Message: fmt.Sprintf("global role binding not found for %s", username),
|
||||
}}
|
||||
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (am *amOperator) GetWorkspaceRoleOfUser(username, workspace string) (*iamv1alpha2.WorkspaceRole, error) {
|
||||
|
||||
roleBindings, err := am.ksinformer.Iam().V1alpha2().WorkspaceRoleBindings().Lister().List(labels.SelectorFromValidatedSet(labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}))
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
userRoleBindings := make([]*iamv1alpha2.WorkspaceRoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
userRoleBindings = append(userRoleBindings, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
if len(userRoleBindings) > 0 {
|
||||
role, err := am.ksinformer.Iam().V1alpha2().WorkspaceRoles().Lister().Get(userRoleBindings[0].RoleRef.Name)
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(roleBindings) > 1 {
|
||||
klog.Warningf("conflict workspace role binding, username: %s", username)
|
||||
}
|
||||
|
||||
return role, nil
|
||||
}
|
||||
|
||||
err = &errors.StatusError{ErrStatus: metav1.Status{
|
||||
Status: metav1.StatusFailure,
|
||||
Code: http.StatusNotFound,
|
||||
Reason: metav1.StatusReasonNotFound,
|
||||
Details: &metav1.StatusDetails{
|
||||
Group: iamv1alpha2.SchemeGroupVersion.Group,
|
||||
Kind: iamv1alpha2.ResourceKindWorkspaceRoleBinding,
|
||||
},
|
||||
Message: fmt.Sprintf("workspace role binding not found for %s", username),
|
||||
}}
|
||||
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (am *amOperator) GetNamespaceRoleOfUser(username, namespace string) (*rbacv1.Role, error) {
|
||||
roleBindings, err := am.k8sinformer.Rbac().V1().RoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
userRoleBindings := make([]*rbacv1.RoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
userRoleBindings = append(userRoleBindings, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
if len(userRoleBindings) > 0 {
|
||||
role, err := am.k8sinformer.Rbac().V1().Roles().Lister().Roles(namespace).Get(userRoleBindings[0].RoleRef.Name)
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
if len(roleBindings) > 1 {
|
||||
klog.Warningf("conflict role binding, username: %s", username)
|
||||
}
|
||||
return role, nil
|
||||
}
|
||||
|
||||
err = &errors.StatusError{ErrStatus: metav1.Status{
|
||||
Status: metav1.StatusFailure,
|
||||
Code: http.StatusNotFound,
|
||||
Reason: metav1.StatusReasonNotFound,
|
||||
Details: &metav1.StatusDetails{
|
||||
Group: rbacv1.SchemeGroupVersion.Group,
|
||||
Kind: "RoleBinding",
|
||||
},
|
||||
Message: fmt.Sprintf("role binding not found for %s in %s", username, namespace),
|
||||
}}
|
||||
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Get federated clusterrole of user if cluster is not empty, if cluster is empty means current cluster
|
||||
func (am *amOperator) GetClusterRoleOfUser(username, cluster string) (*rbacv1.ClusterRole, error) {
|
||||
roleBindings, err := am.k8sinformer.Rbac().V1().ClusterRoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
userRoleBindings := make([]*rbacv1.ClusterRoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
userRoleBindings = append(userRoleBindings, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
if len(userRoleBindings) > 0 {
|
||||
role, err := am.k8sinformer.Rbac().V1().ClusterRoles().Lister().Get(userRoleBindings[0].RoleRef.Name)
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
if len(roleBindings) > 1 {
|
||||
klog.Warningf("conflict cluster role binding, username: %s", username)
|
||||
}
|
||||
return role, nil
|
||||
}
|
||||
err = &errors.StatusError{ErrStatus: metav1.Status{
|
||||
Status: metav1.StatusFailure,
|
||||
Code: http.StatusNotFound,
|
||||
Reason: metav1.StatusReasonNotFound,
|
||||
Details: &metav1.StatusDetails{
|
||||
Group: rbacv1.SchemeGroupVersion.Group,
|
||||
Kind: "ClusterRoleBinding",
|
||||
},
|
||||
Message: fmt.Sprintf("cluster role binding not found for %s in %s", username, cluster),
|
||||
}}
|
||||
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (am *amOperator) ListWorkspaceRoleBindings(username, workspace string) ([]*iamv1alpha2.WorkspaceRoleBinding, error) {
|
||||
roleBindings, err := am.ksinformer.Iam().V1alpha2().WorkspaceRoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result := make([]*iamv1alpha2.WorkspaceRoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
inSpecifiedWorkspace := workspace == "" || roleBinding.Labels[tenantv1alpha1.WorkspaceLabel] == workspace
|
||||
if contains(roleBinding.Subjects, username) && inSpecifiedWorkspace {
|
||||
result = append(result, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (am *amOperator) ListClusterRoleBindings(username string) ([]*rbacv1.ClusterRoleBinding, error) {
|
||||
|
||||
roleBindings, err := am.k8sinformer.Rbac().V1().ClusterRoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result := make([]*rbacv1.ClusterRoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
result = append(result, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (am *amOperator) ListGlobalRoleBindings(username string) ([]*iamv1alpha2.GlobalRoleBinding, error) {
|
||||
roleBindings, err := am.ksinformer.Iam().V1alpha2().GlobalRoleBindings().Lister().List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result := make([]*iamv1alpha2.GlobalRoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
result = append(result, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (am *amOperator) ListRoleBindings(username, namespace string) ([]*rbacv1.RoleBinding, error) {
|
||||
|
||||
roleBindings, err := am.k8sinformer.Rbac().V1().RoleBindings().Lister().RoleBindings(namespace).List(labels.Everything())
|
||||
|
||||
if err != nil {
|
||||
klog.Error(err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result := make([]*rbacv1.RoleBinding, 0)
|
||||
|
||||
for _, roleBinding := range roleBindings {
|
||||
if contains(roleBinding.Subjects, username) {
|
||||
result = append(result, roleBinding)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func contains(subjects []rbacv1.Subject, username string) bool {
|
||||
for _, subject := range subjects {
|
||||
if subject.Kind == rbacv1.UserKind && (username == "" || subject.Name == username) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (am *amOperator) ListRoles(namespace string, query *query.Query) (*api.ListResult, error) {
|
||||
return am.resourceGetter.List("roles", namespace, query)
|
||||
}
|
||||
|
||||
func (am *amOperator) ListClusterRoles(query *query.Query) (*api.ListResult, error) {
|
||||
return am.resourceGetter.List("clusterroles", "", query)
|
||||
}
|
||||
|
||||
func (am *amOperator) ListWorkspaceRoles(queryParam *query.Query) (*api.ListResult, error) {
|
||||
return am.resourceGetter.List(iamv1alpha2.ResourcesPluralWorkspaceRole, "", queryParam)
|
||||
}
|
||||
|
||||
func (am *amOperator) ListGlobalRoles(query *query.Query) (*api.ListResult, error) {
|
||||
return am.resourceGetter.List(iamv1alpha2.ResourcesPluralGlobalRole, "", query)
|
||||
}
|
||||
|
||||
// GetRoleReferenceRules attempts to resolve the RoleBinding or ClusterRoleBinding.
|
||||
func (am *amOperator) GetRoleReferenceRules(roleRef rbacv1.RoleRef, bindingNamespace string) ([]rbacv1.PolicyRule, error) {
|
||||
switch roleRef.Kind {
|
||||
case "Role":
|
||||
role, err := am.k8sinformer.Rbac().V1().Roles().Lister().Roles(bindingNamespace).Get(roleRef.Name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return role.Rules, nil
|
||||
|
||||
case "ClusterRole":
|
||||
clusterRole, err := am.k8sinformer.Rbac().V1().ClusterRoles().Lister().Get(roleRef.Name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return clusterRole.Rules, nil
|
||||
case iamv1alpha2.ResourceKindGlobalRole:
|
||||
globalRole, err := am.ksinformer.Iam().V1alpha2().GlobalRoles().Lister().Get(roleRef.Name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return globalRole.Rules, nil
|
||||
case iamv1alpha2.ResourceKindWorkspaceRole:
|
||||
workspaceRole, err := am.ksinformer.Iam().V1alpha2().WorkspaceRoles().Lister().Get(roleRef.Name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return workspaceRole.Rules, nil
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported role reference kind: %q", roleRef.Kind)
|
||||
}
|
||||
}
|
||||
|
||||
179
pkg/models/iam/am/rbac/evaluation_helpers.go
Normal file
179
pkg/models/iam/am/rbac/evaluation_helpers.go
Normal file
@@ -0,0 +1,179 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package authorizerfactory
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
func RoleRefGroupKind(roleRef rbacv1.RoleRef) schema.GroupKind {
|
||||
return schema.GroupKind{Group: roleRef.APIGroup, Kind: roleRef.Kind}
|
||||
}
|
||||
|
||||
func VerbMatches(rule *rbacv1.PolicyRule, requestedVerb string) bool {
|
||||
for _, ruleVerb := range rule.Verbs {
|
||||
if ruleVerb == rbacv1.VerbAll {
|
||||
return true
|
||||
}
|
||||
if ruleVerb == requestedVerb {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func APIGroupMatches(rule *rbacv1.PolicyRule, requestedGroup string) bool {
|
||||
for _, ruleGroup := range rule.APIGroups {
|
||||
if ruleGroup == rbacv1.APIGroupAll {
|
||||
return true
|
||||
}
|
||||
if ruleGroup == requestedGroup {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func ResourceMatches(rule *rbacv1.PolicyRule, combinedRequestedResource, requestedSubresource string) bool {
|
||||
for _, ruleResource := range rule.Resources {
|
||||
// if everything is allowed, we match
|
||||
if ruleResource == rbacv1.ResourceAll {
|
||||
return true
|
||||
}
|
||||
// if we have an exact match, we match
|
||||
if ruleResource == combinedRequestedResource {
|
||||
return true
|
||||
}
|
||||
|
||||
// We can also match a */subresource.
|
||||
// if there isn't a subresource, then continue
|
||||
if len(requestedSubresource) == 0 {
|
||||
continue
|
||||
}
|
||||
// if the rule isn't in the format */subresource, then we don't match, continue
|
||||
if len(ruleResource) == len(requestedSubresource)+2 &&
|
||||
strings.HasPrefix(ruleResource, "*/") &&
|
||||
strings.HasSuffix(ruleResource, requestedSubresource) {
|
||||
return true
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func ResourceNameMatches(rule *rbacv1.PolicyRule, requestedName string) bool {
|
||||
if len(rule.ResourceNames) == 0 {
|
||||
return true
|
||||
}
|
||||
|
||||
for _, ruleName := range rule.ResourceNames {
|
||||
if ruleName == requestedName {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func NonResourceURLMatches(rule *rbacv1.PolicyRule, requestedURL string) bool {
|
||||
for _, ruleURL := range rule.NonResourceURLs {
|
||||
if ruleURL == rbacv1.NonResourceAll {
|
||||
return true
|
||||
}
|
||||
if ruleURL == requestedURL {
|
||||
return true
|
||||
}
|
||||
if strings.HasSuffix(ruleURL, "*") && strings.HasPrefix(requestedURL, strings.TrimRight(ruleURL, "*")) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// subjectsStrings returns users, groups, serviceaccounts, unknown for display purposes.
|
||||
func SubjectsStrings(subjects []rbacv1.Subject) ([]string, []string, []string, []string) {
|
||||
users := []string{}
|
||||
groups := []string{}
|
||||
sas := []string{}
|
||||
others := []string{}
|
||||
|
||||
for _, subject := range subjects {
|
||||
switch subject.Kind {
|
||||
case rbacv1.ServiceAccountKind:
|
||||
sas = append(sas, fmt.Sprintf("%s/%s", subject.Namespace, subject.Name))
|
||||
|
||||
case rbacv1.UserKind:
|
||||
users = append(users, subject.Name)
|
||||
|
||||
case rbacv1.GroupKind:
|
||||
groups = append(groups, subject.Name)
|
||||
|
||||
default:
|
||||
others = append(others, fmt.Sprintf("%s/%s/%s", subject.Kind, subject.Namespace, subject.Name))
|
||||
}
|
||||
}
|
||||
|
||||
return users, groups, sas, others
|
||||
}
|
||||
|
||||
func String(r rbacv1.PolicyRule) string {
|
||||
return "PolicyRule" + CompactString(r)
|
||||
}
|
||||
|
||||
// CompactString exposes a compact string representation for use in escalation error messages
|
||||
func CompactString(r rbacv1.PolicyRule) string {
|
||||
formatStringParts := []string{}
|
||||
formatArgs := []interface{}{}
|
||||
if len(r.APIGroups) > 0 {
|
||||
formatStringParts = append(formatStringParts, "APIGroups:%q")
|
||||
formatArgs = append(formatArgs, r.APIGroups)
|
||||
}
|
||||
if len(r.Resources) > 0 {
|
||||
formatStringParts = append(formatStringParts, "Resources:%q")
|
||||
formatArgs = append(formatArgs, r.Resources)
|
||||
}
|
||||
if len(r.NonResourceURLs) > 0 {
|
||||
formatStringParts = append(formatStringParts, "NonResourceURLs:%q")
|
||||
formatArgs = append(formatArgs, r.NonResourceURLs)
|
||||
}
|
||||
if len(r.ResourceNames) > 0 {
|
||||
formatStringParts = append(formatStringParts, "ResourceNames:%q")
|
||||
formatArgs = append(formatArgs, r.ResourceNames)
|
||||
}
|
||||
if len(r.Verbs) > 0 {
|
||||
formatStringParts = append(formatStringParts, "Verbs:%q")
|
||||
formatArgs = append(formatArgs, r.Verbs)
|
||||
}
|
||||
formatString := "{" + strings.Join(formatStringParts, ", ") + "}"
|
||||
return fmt.Sprintf(formatString, formatArgs...)
|
||||
}
|
||||
|
||||
type SortableRuleSlice []rbacv1.PolicyRule
|
||||
|
||||
func (s SortableRuleSlice) Len() int { return len(s) }
|
||||
func (s SortableRuleSlice) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
|
||||
func (s SortableRuleSlice) Less(i, j int) bool {
|
||||
return strings.Compare(s[i].String(), s[j].String()) < 0
|
||||
}
|
||||
Reference in New Issue
Block a user