improve IAM module

Signed-off-by: hongming <talonwan@yunify.com>

pkg/kapis/config/v1alpha2/register.go

@@ -20,7 +20,11 @@ package v1alpha2
 
 import (
 	"github.com/emicklei/go-restful"
+	"gopkg.in/yaml.v3"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 	kubesphereconfig "kubesphere.io/kubesphere/pkg/apiserver/config"
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
 )
@@ -37,7 +41,20 @@ func AddToContainer(c *restful.Container, config *kubesphereconfig.Config) error
 	webservice.Route(webservice.GET("/configs/oauth").
 		Doc("Information about the authorization server are published.").
 		To(func(request *restful.Request, response *restful.Response) {
-			response.WriteEntity(config.AuthenticationOptions.OAuthOptions)
+			// workaround for this issue https://github.com/go-yaml/yaml/issues/139
+			// fixed in gopkg.in/yaml.v3
+			yamlData, err := yaml.Marshal(config.AuthenticationOptions.OAuthOptions)
+			if err != nil {
+				klog.Error(err)
+				api.HandleInternalError(response, request, err)
+			}
+			var options oauth.Options
+			err = yaml.Unmarshal(yamlData, &options)
+			if err != nil {
+				klog.Error(err)
+				api.HandleInternalError(response, request, err)
+			}
+			response.WriteEntity(options)
 		}))
 
 	webservice.Route(webservice.GET("/configs/configz").

pkg/kapis/iam/v1alpha2/register.go

@@ -20,15 +20,16 @@ package v1alpha2
 import (
 	"github.com/emicklei/go-restful"
 	"github.com/emicklei/go-restful-openapi"
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"kubesphere.io/kubesphere/pkg/api"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
 	"kubesphere.io/kubesphere/pkg/constants"
-	"kubesphere.io/kubesphere/pkg/models"
 	"kubesphere.io/kubesphere/pkg/models/iam/am"
 	"kubesphere.io/kubesphere/pkg/models/iam/im"
+	"kubesphere.io/kubesphere/pkg/server/errors"
 	"net/http"
 )
 
@@ -40,58 +41,328 @@ var GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha2"}
 
 func AddToContainer(container *restful.Container, im im.IdentityManagementInterface, am am.AccessManagementInterface, options *authoptions.AuthenticationOptions) error {
 	ws := runtime.NewWebService(GroupVersion)
-
 	handler := newIAMHandler(im, am, options)
 
-	// global resource
-	ws.Route(ws.GET("/users").
-		To(handler.ListUsers).
-		Doc("List all users.").
-		Returns(http.StatusOK, api.StatusOK, api.ListResult{}).
+	// users
+	ws.Route(ws.POST("/users").
+		To(handler.CreateUserOrClusterMembers).
+		Doc("Create user in global scope.").
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.User{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/users/{user}").
+		To(handler.DeleteUserOrClusterMember).
+		Doc("Delete user.").
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/users/{user}").
+		To(handler.UpdateUserOrClusterMember).
+		Doc("Update user info.").
+		Reads(iamv1alpha2.User{}).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.User{}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
-	// global resource
 	ws.Route(ws.GET("/users/{user}").
-		To(handler.DescribeUser).
+		To(handler.DescribeUserOrClusterMember).
 		Doc("Retrieve user details.").
 		Param(ws.PathParameter("user", "username")).
-		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.UserDetail{}).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.User{}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
-	// global resource
-	ws.Route(ws.GET("/globalroles").
-		To(handler.ListGlobalRoles).
-		Doc("List all cluster roles.").
-		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
-		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
-
-	ws.Route(ws.GET("/clusterroles").
-		To(handler.ListClusterRoles).
-		Doc("List cluster roles.").
-		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
+	ws.Route(ws.GET("/users").
+		To(handler.ListUsersOrClusterMembers).
+		Doc("List all users.").
+		Returns(http.StatusOK, api.StatusOK, api.ListResult{Items: []interface{}{iamv1alpha2.User{}}}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 
 	ws.Route(ws.GET("/workspaces/{workspace}/users").
-		To(handler.ListWorkspaceUsers).
+		To(handler.ListWorkspaceMembers).
 		Doc("List all members in the specified workspace.").
 		Param(ws.PathParameter("workspace", "workspace name")).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/workspaces/{workspace}/users/{user}").
+		To(handler.DescribeWorkspaceMember).
+		Doc("Retrieve workspace member details.").
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.POST("/workspaces/{workspace}/users").
+		To(handler.CreateWorkspaceMembers).
+		Doc("Batch add workspace members.").
+		Reads([]Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/workspaces/{workspace}/users/{user}").
+		To(handler.UpdateWorkspaceMember).
+		Doc("Update member in workspace.").
+		Reads(Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/workspaces/{workspace}/users/{user}").
+		To(handler.RemoveWorkspaceMember).
+		Doc("Remove member in workspace.").
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 
+	ws.Route(ws.GET("/namespaces/{namespace}/users").
+		To(handler.ListNamespaceMembers).
+		Doc("List all members in the specified namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/namespaces/{namespace}/users/{user}").
+		To(handler.DescribeNamespaceMember).
+		Doc("Retrieve namespace member details.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.POST("/namespaces/{namespace}/users").
+		To(handler.CreateNamespaceMembers).
+		Doc("Batch add namespace members.").
+		Reads([]Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/namespaces/{namespace}/users/{user}").
+		To(handler.UpdateNamespaceMember).
+		Doc("Update member in namespace.").
+		Reads(Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/namespaces/{namespace}/users/{user}").
+		To(handler.RemoveNamespaceMember).
+		Doc("Remove member in namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	ws.Route(ws.GET("/devops/{devops}/users").
+		To(handler.ListNamespaceMembers).
+		Doc("List all members in the specified namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/devops/{devops}/users/{user}").
+		To(handler.DescribeNamespaceMember).
+		Doc("Retrieve namespace member details.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.POST("/devops/{devops}/users").
+		To(handler.CreateNamespaceMembers).
+		Doc("Batch add namespace members.").
+		Reads([]Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/devops/{devops}/users/{user}").
+		To(handler.UpdateNamespaceMember).
+		Doc("Update member in namespace.").
+		Reads(Member{}).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/devops/{devops}/users/{user}").
+		To(handler.RemoveNamespaceMember).
+		Doc("Remove member in namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	// globalroles
+	ws.Route(ws.POST("/globalroles").
+		To(handler.CreateGlobalRole).
+		Doc("Create global role.").
+		Reads(iamv1alpha2.GlobalRole{}).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.GlobalRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/globalroles/{globalrole}").
+		To(handler.DeleteGlobalRole).
+		Doc("Delete global role.").
+		Param(ws.PathParameter("globalrole", "global role name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/globalroles/{globalrole}").
+		To(handler.UpdateGlobalRole).
+		Doc("Update global role.").
+		Param(ws.PathParameter("globalrole", "global role name")).
+		Reads(iamv1alpha2.GlobalRole{}).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.GlobalRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/globalroles").
+		To(handler.ListGlobalRoles).
+		Doc("List all global roles.").
+		Returns(http.StatusOK, api.StatusOK, api.ListResult{Items: []interface{}{iamv1alpha2.GlobalRole{}}}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/globalroles/{globalrole}").
+		To(handler.DescribeGlobalRole).
+		Doc("Retrieve global role details.").
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.GlobalRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	// clusterroles
+	ws.Route(ws.POST("/clusterroles").
+		To(handler.CreateClusterRole).
+		Doc("Create cluster role.").
+		Reads(rbacv1.ClusterRole{}).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/clusterroles/{clusterrole}").
+		To(handler.DeleteClusterRole).
+		Doc("Delete cluster role.").
+		Param(ws.PathParameter("clusterrole", "cluster role name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/clusterroles/{clusterrole}").
+		To(handler.UpdateClusterRole).
+		Doc("Update cluster role.").
+		Param(ws.PathParameter("clusterrole", "cluster role name")).
+		Reads(rbacv1.ClusterRole{}).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/clusterroles").
+		To(handler.ListClusterRoles).
+		Doc("List all cluster roles.").
+		Returns(http.StatusOK, api.StatusOK, api.ListResult{Items: []interface{}{rbacv1.ClusterRole{}}}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/clusterroles/{clusterrole}").
+		To(handler.DescribeClusterRole).
+		Doc("Retrieve cluster role details.").
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	// workspaceroles
+	ws.Route(ws.POST("/workspaces/{workspace}/workspaceroles").
+		To(handler.CreateWorkspaceRole).
+		Doc("Create workspace role.").
+		Reads(iamv1alpha2.WorkspaceRole{}).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/workspaces/{workspace}/workspaceroles/{workspacerole}").
+		To(handler.DeleteWorkspaceRole).
+		Doc("Delete workspace role.").
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/workspaces/{workspace}/workspaceroles/{workspacerole}").
+		To(handler.UpdateWorkspaceRole).
+		Doc("Update workspace role.").
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("workspacerole", "workspace role name")).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 	ws.Route(ws.GET("/workspaces/{workspace}/workspaceroles").
 		To(handler.ListWorkspaceRoles).
 		Doc("List all workspace roles.").
 		Param(ws.PathParameter("workspace", "workspace name")).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
-
-	ws.Route(ws.GET("/namespaces/{namespace}/users").
-		To(handler.ListNamespaceUsers).
-		Doc("List all users in the specified namespace.").
-		Param(ws.PathParameter("namespace", "kubernetes namespace")).
+	ws.Route(ws.GET("/workspaces/{workspace}/workspaceroles/{workspacerole}").
+		To(handler.DescribeWorkspaceRole).
+		Doc("Retrieve workspace role details.").
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("workspacerole", "workspace role name")).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 
+	// roles
+	ws.Route(ws.POST("/namespaces/{namespace}/roles").
+		To(handler.CreateNamespaceRole).
+		Doc("Create role in the specified namespace.").
+		Reads(rbacv1.Role{}).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.Role{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/namespaces/{namespace}/roles/{role}").
+		To(handler.DeleteNamespaceRole).
+		Doc("Delete role in the specified namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/namespaces/{namespace}/roles/{role}").
+		To(handler.UpdateNamespaceRole).
+		Doc("Update namespace role.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Reads(rbacv1.ClusterRole{}).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 	ws.Route(ws.GET("/namespaces/{namespace}/roles").
 		To(handler.ListRoles).
 		Doc("List all roles in the specified namespace.").
 		Param(ws.PathParameter("namespace", "namespace")).
-		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
+		Returns(http.StatusOK, api.StatusOK, api.ListResult{Items: []interface{}{rbacv1.Role{}}}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/namespaces/{namespace}/roles/{role}").
+		To(handler.DescribeNamespaceRole).
+		Doc("Retrieve role details.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	// roles
+	ws.Route(ws.POST("/devops/{devops}/roles").
+		To(handler.CreateNamespaceRole).
+		Doc("Create role in the specified  devops project.").
+		Reads(rbacv1.Role{}).
+		Param(ws.PathParameter("namespace", "namespace")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.Role{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.DELETE("/devops/{devops}/roles/{role}").
+		To(handler.DeleteNamespaceRole).
+		Doc("Delete role in the specified devops project.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.PUT("/devops/{devops}/roles/{role}").
+		To(handler.UpdateNamespaceRole).
+		Doc("Update devops project role.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Reads(rbacv1.ClusterRole{}).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/devops/{devops}/roles").
+		To(handler.ListRoles).
+		Doc("List all roles in the specified namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Returns(http.StatusOK, api.StatusOK, api.ListResult{Items: []interface{}{rbacv1.Role{}}}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/devops/{devops}/roles/{role}").
+		To(handler.DescribeNamespaceRole).
+		Doc("Retrieve role details.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("role", "role name")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+
+	ws.Route(ws.GET("/users/{user}/globalrole").
+		To(handler.RetrieveMemberRole).
+		Doc("Retrieve user's global role.").
+		Param(ws.PathParameter("user", "username")).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.GlobalRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/users/{user}/clusterrole").
+		To(handler.RetrieveMemberRole).
+		Doc("Retrieve user's role in cluster.").
+		Param(ws.PathParameter("user", "username")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.ClusterRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/workspaces/{workspace}/users/{user}/workspacerole").
+		To(handler.RetrieveMemberRole).
+		Doc("Retrieve member's role in workspace.").
+		Param(ws.PathParameter("workspace", "workspace")).
+		Param(ws.PathParameter("user", "username")).
+		Returns(http.StatusOK, api.StatusOK, iamv1alpha2.WorkspaceRole{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
+	ws.Route(ws.GET("/namespaces/{namespace}/users/{user}/role").
+		To(handler.RetrieveMemberRole).
+		Doc("Retrieve member's role in namespace.").
+		Param(ws.PathParameter("namespace", "namespace")).
+		Param(ws.PathParameter("user", "username")).
+		Returns(http.StatusOK, api.StatusOK, rbacv1.Role{}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.AccessManagementTag}))
 
 	container.Add(ws)

pkg/kapis/oauth/handler.go

@@ -22,24 +22,29 @@ import (
 	"fmt"
 	"github.com/emicklei/go-restful"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	authuser "k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/klog"
 	"kubesphere.io/kubesphere/pkg/api"
 	"kubesphere.io/kubesphere/pkg/api/auth"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/token"
 	"kubesphere.io/kubesphere/pkg/apiserver/request"
+	"kubesphere.io/kubesphere/pkg/models/iam/im"
 	"net/http"
 )
 
 type oauthHandler struct {
 	issuer  token.Issuer
+	im      im.IdentityManagementInterface
 	options *authoptions.AuthenticationOptions
 }
 
-func newOAUTHHandler(issuer token.Issuer, options *authoptions.AuthenticationOptions) *oauthHandler {
-	return &oauthHandler{issuer: issuer, options: options}
+func newOAUTHHandler(im im.IdentityManagementInterface, issuer token.Issuer, options *authoptions.AuthenticationOptions) *oauthHandler {
+	return &oauthHandler{im: im, issuer: issuer, options: options}
 }
 
 // Implement webhook authentication interface
@@ -148,18 +153,19 @@ func (h *oauthHandler) OAuthCallBackHandler(req *restful.Request, resp *restful.
 		resp.WriteError(http.StatusUnauthorized, err)
 	}
 
-	idP, err := h.options.OAuthOptions.IdentityProviderOptions(name)
+	providerOptions, err := h.options.OAuthOptions.IdentityProviderOptions(name)
 
 	if err != nil {
 		err := apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err))
 		resp.WriteError(http.StatusUnauthorized, err)
 	}
 
-	oauthIdentityProvider, err := identityprovider.ResolveOAuthProvider(idP.Type, idP.Provider)
+	oauthIdentityProvider, err := identityprovider.GetOAuthProvider(providerOptions.Type, providerOptions.Provider)
 
 	if err != nil {
 		err := apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err))
 		resp.WriteError(http.StatusUnauthorized, err)
+		return
 	}
 
 	user, err := oauthIdentityProvider.IdentityExchange(code)
@@ -167,11 +173,52 @@ func (h *oauthHandler) OAuthCallBackHandler(req *restful.Request, resp *restful.
 	if err != nil {
 		err := apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err))
 		resp.WriteError(http.StatusUnauthorized, err)
+		return
+	}
+
+	existed, err := h.im.DescribeUser(user.GetName())
+	if err != nil {
+		// create user if not exist
+		if apierrors.IsNotFound(err) && oauth.MappingMethodAuto == providerOptions.MappingMethod {
+			create := &iamv1alpha2.User{
+				ObjectMeta: v1.ObjectMeta{Name: user.GetName(),
+					Annotations: map[string]string{iamv1alpha2.IdentifyProviderLabel: providerOptions.Name}},
+				Spec: iamv1alpha2.UserSpec{Email: user.GetEmail()},
+			}
+			if existed, err = h.im.CreateUser(create); err != nil {
+				klog.Error(err)
+				api.HandleInternalError(resp, req, err)
+				return
+			}
+		} else {
+			klog.Error(err)
+			api.HandleInternalError(resp, req, err)
+			return
+		}
+	}
+
+	// oauth.MappingMethodLookup
+	if existed == nil {
+		err := apierrors.NewUnauthorized(fmt.Sprintf("user %s cannot bound to this identify provider", user.GetName()))
+		klog.Error(err)
+		resp.WriteError(http.StatusUnauthorized, err)
+		return
+	}
+
+	// oauth.MappingMethodAuto
+	// Fails if a user with that user name is already mapped to another identity.
+	if providerOptions.MappingMethod == oauth.MappingMethodMixed || existed.Annotations[iamv1alpha2.IdentifyProviderLabel] != providerOptions.Name {
+		err := apierrors.NewUnauthorized(fmt.Sprintf("user %s is already bound to other identify provider", user.GetName()))
+		klog.Error(err)
+		resp.WriteError(http.StatusUnauthorized, err)
+		return
 	}
 
 	expiresIn := h.options.OAuthOptions.AccessTokenMaxAge
 
-	accessToken, err := h.issuer.IssueTo(user, expiresIn)
+	accessToken, err := h.issuer.IssueTo(&authuser.DefaultInfo{
+		Name: user.GetName(),
+	}, expiresIn)
 
 	if err != nil {
 		err := apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err))
@@ -186,5 +233,4 @@ func (h *oauthHandler) OAuthCallBackHandler(req *restful.Request, resp *restful.
 	}
 
 	resp.WriteEntity(result)
-	return
 }

pkg/kapis/oauth/register.go

@@ -27,6 +27,7 @@ import (
 	authoptions "kubesphere.io/kubesphere/pkg/apiserver/authentication/options"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/token"
 	"kubesphere.io/kubesphere/pkg/constants"
+	"kubesphere.io/kubesphere/pkg/models/iam/im"
 	"net/http"
 )
 
@@ -36,13 +37,13 @@ import (
 // Most authentication integrations place an authenticating proxy in front of this endpoint, or configure ks-apiserver
 // to validate credentials against a backing identity provider.
 // Requests to <ks-apiserver>/oauth/authorize can come from user-agents that cannot display interactive login pages, such as the CLI.
-func AddToContainer(c *restful.Container, issuer token.Issuer, options *authoptions.AuthenticationOptions) error {
+func AddToContainer(c *restful.Container, im im.IdentityManagementInterface, issuer token.Issuer, options *authoptions.AuthenticationOptions) error {
 	ws := &restful.WebService{}
 	ws.Path("/oauth").
 		Consumes(restful.MIME_JSON).
 		Produces(restful.MIME_JSON)
 
-	handler := newOAUTHHandler(issuer, options)
+	handler := newOAUTHHandler(im, issuer, options)
 
 	// Implement webhook authentication interface
 	// https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication

pkg/kapis/resources/v1alpha2/handler.go

@@ -38,18 +38,18 @@ type resourceHandler struct {
 	kubectlOperator     kubectl.Interface
 }
 
-func newResourceHandler(client kubernetes.Interface, factory informers.InformerFactory) *resourceHandler {
+func newResourceHandler(k8sClient kubernetes.Interface, factory informers.InformerFactory, masterURL string) *resourceHandler {
 
 	return &resourceHandler{
 		resourcesGetter:     resource.NewResourceGetter(factory),
 		componentsGetter:    components.NewComponentsGetter(factory.KubernetesSharedInformerFactory()),
 		resourceQuotaGetter: quotas.NewResourceQuotaGetter(factory.KubernetesSharedInformerFactory()),
 		revisionGetter:      revisions.NewRevisionGetter(factory.KubernetesSharedInformerFactory()),
-		routerOperator:      routers.NewRouterOperator(client, factory.KubernetesSharedInformerFactory()),
+		routerOperator:      routers.NewRouterOperator(k8sClient, factory.KubernetesSharedInformerFactory()),
 		gitVerifier:         git.NewGitVerifier(factory.KubernetesSharedInformerFactory()),
 		registryGetter:      registries.NewRegistryGetter(factory.KubernetesSharedInformerFactory()),
-		kubeconfigOperator:  kubeconfig.NewKubeconfigOperator(),
-		kubectlOperator:     kubectl.NewKubectlOperator(client, factory.KubernetesSharedInformerFactory()),
+		kubeconfigOperator:  kubeconfig.NewOperator(k8sClient, nil, masterURL),
+		kubectlOperator:     kubectl.NewOperator(k8sClient, factory.KubernetesSharedInformerFactory()),
 	}
 }
 

pkg/kapis/resources/v1alpha2/register.go

@@ -43,9 +43,9 @@ const (
 
 var GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha2"}
 
-func AddToContainer(c *restful.Container, client kubernetes.Interface, factory informers.InformerFactory) error {
+func AddToContainer(c *restful.Container, k8sClient kubernetes.Interface, factory informers.InformerFactory, masterURL string) error {
 	webservice := runtime.NewWebService(GroupVersion)
-	handler := newResourceHandler(client, factory)
+	handler := newResourceHandler(k8sClient, factory, masterURL)
 
 	webservice.Route(webservice.GET("/namespaces/{namespace}/{resources}").
 		To(handler.handleListNamespaceResources).

pkg/kapis/resources/v1alpha3/handler.go

@@ -40,7 +40,7 @@ func (h *Handler) handleGetResources(request *restful.Request, response *restful
 	}
 
 	if err != resource.ErrResourceNotSupported {
-		klog.Error(err)
+		klog.Error(err, resourceType)
 		api.HandleInternalError(response, nil, err)
 		return
 	}
@@ -72,7 +72,7 @@ func (h *Handler) handleListResources(request *restful.Request, response *restfu
 	}
 
 	if err != resource.ErrResourceNotSupported {
-		klog.Error(err)
+		klog.Error(err, resourceType)
 		api.HandleInternalError(response, nil, err)
 		return
 	}
@@ -99,6 +99,9 @@ func (h *Handler) fallback(resourceType string, namespace string, q *query.Query
 		case query.FieldName:
 			conditions.Fuzzy[v1alpha2.Name] = string(value)
 			break
+		case query.FieldNames:
+			conditions.Match[v1alpha2.Name] = string(value)
+			break
 		case query.FieldCreationTimeStamp:
 			conditions.Match[v1alpha2.CreateTime] = string(value)
 			break

pkg/kapis/tenant/v1alpha2/handler.go

@@ -1,15 +1,21 @@
 package v1alpha2
 
 import (
-	"errors"
+	"fmt"
 	"github.com/emicklei/go-restful"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/klog"
 	"kubesphere.io/kubesphere/pkg/api"
 	eventsv1alpha1 "kubesphere.io/kubesphere/pkg/api/events/v1alpha1"
+	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	"kubesphere.io/kubesphere/pkg/apiserver/request"
+	kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 	"kubesphere.io/kubesphere/pkg/informers"
 	"kubesphere.io/kubesphere/pkg/models/tenant"
+	servererr "kubesphere.io/kubesphere/pkg/server/errors"
 	"kubesphere.io/kubesphere/pkg/simple/client/events"
 )
 
@@ -17,10 +23,10 @@ type tenantHandler struct {
 	tenant tenant.Interface
 }
 
-func newTenantHandler(factory informers.InformerFactory, evtsClient events.Client) *tenantHandler {
+func newTenantHandler(factory informers.InformerFactory, k8sclient kubernetes.Interface, ksclient kubesphere.Interface, evtsClient events.Client) *tenantHandler {
 
 	return &tenantHandler{
-		tenant: tenant.New(factory, evtsClient),
+		tenant: tenant.New(factory, k8sclient, ksclient, evtsClient),
 	}
 }
 
@@ -29,7 +35,7 @@ func (h *tenantHandler) ListWorkspaces(req *restful.Request, resp *restful.Respo
 	queryParam := query.ParseQueryParameter(req)
 
 	if !ok {
-		err := errors.New("cannot obtain user info")
+		err := fmt.Errorf("cannot obtain user info")
 		klog.Errorln(err)
 		api.HandleForbidden(resp, nil, err)
 		return
@@ -50,7 +56,7 @@ func (h *tenantHandler) ListNamespaces(req *restful.Request, resp *restful.Respo
 	queryParam := query.ParseQueryParameter(req)
 
 	if !ok {
-		err := errors.New("cannot obtain user info")
+		err := fmt.Errorf("cannot obtain user info")
 		klog.Errorln(err)
 		api.HandleForbidden(resp, nil, err)
 		return
@@ -68,10 +74,156 @@ func (h *tenantHandler) ListNamespaces(req *restful.Request, resp *restful.Respo
 	resp.WriteEntity(result)
 }
 
+func (h *tenantHandler) CreateNamespace(request *restful.Request, response *restful.Response) {
+	workspace := request.PathParameter("workspace")
+	var namespace corev1.Namespace
+
+	err := request.ReadEntity(&namespace)
+
+	if err != nil {
+		klog.Error(err)
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	created, err := h.tenant.CreateNamespace(workspace, &namespace)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	response.WriteEntity(created)
+}
+
+func (h *tenantHandler) CreateWorkspace(request *restful.Request, response *restful.Response) {
+	var workspace tenantv1alpha2.WorkspaceTemplate
+
+	err := request.ReadEntity(&workspace)
+
+	if err != nil {
+		klog.Error(err)
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	created, err := h.tenant.CreateWorkspace(&workspace)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	response.WriteEntity(created)
+}
+
+func (h *tenantHandler) DeleteWorkspace(request *restful.Request, response *restful.Response) {
+	workspace := request.PathParameter("workspace")
+
+	err := h.tenant.DeleteWorkspace(workspace)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	response.WriteEntity(servererr.None)
+}
+
+func (h *tenantHandler) UpdateWorkspace(request *restful.Request, response *restful.Response) {
+	workspaceName := request.PathParameter("workspace")
+	var workspace tenantv1alpha2.WorkspaceTemplate
+
+	err := request.ReadEntity(&workspace)
+
+	if err != nil {
+		klog.Error(err)
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	if workspaceName != workspace.Name {
+		err := fmt.Errorf("the name of the object (%s) does not match the name on the URL (%s)", workspace.Name, workspaceName)
+		klog.Errorf("%+v", err)
+		api.HandleBadRequest(response, request, err)
+		return
+	}
+
+	updated, err := h.tenant.UpdateWorkspace(&workspace)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		if errors.IsBadRequest(err) {
+			api.HandleBadRequest(response, request, err)
+			return
+		}
+		api.HandleInternalError(response, request, err)
+		return
+	}
+
+	response.WriteEntity(updated)
+
+}
+
+func (h *tenantHandler) DescribeWorkspace(request *restful.Request, response *restful.Response) {
+	workspaceName := request.PathParameter("workspace")
+
+	workspace, err := h.tenant.DescribeWorkspace(workspaceName)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		api.HandleInternalError(response, request, err)
+		return
+	}
+
+	response.WriteEntity(workspace)
+}
+
+func (h *tenantHandler) ListWorkspaceClusters(request *restful.Request, response *restful.Response) {
+	workspaceName := request.PathParameter("workspace")
+
+	result, err := h.tenant.ListWorkspaceClusters(workspaceName)
+
+	if err != nil {
+		klog.Error(err)
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, request, err)
+			return
+		}
+		api.HandleInternalError(response, request, err)
+		return
+	}
+
+	response.WriteEntity(result)
+}
+
 func (h *tenantHandler) Events(req *restful.Request, resp *restful.Response) {
 	user, ok := request.UserFrom(req.Request.Context())
 	if !ok {
-		err := errors.New("cannot obtain user info")
+		err := fmt.Errorf("cannot obtain user info")
 		klog.Errorln(err)
 		api.HandleForbidden(resp, req, err)
 		return

pkg/kapis/tenant/v1alpha2/register.go

@@ -20,14 +20,18 @@ package v1alpha2
 import (
 	"github.com/emicklei/go-restful"
 	"github.com/emicklei/go-restful-openapi"
-	"k8s.io/api/core/v1"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/kubernetes"
 	"kubesphere.io/kubesphere/pkg/api"
 	eventsv1alpha1 "kubesphere.io/kubesphere/pkg/api/events/v1alpha1"
+	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
+	kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 	"kubesphere.io/kubesphere/pkg/constants"
 	"kubesphere.io/kubesphere/pkg/informers"
 	"kubesphere.io/kubesphere/pkg/models"
+	"kubesphere.io/kubesphere/pkg/server/errors"
 	"kubesphere.io/kubesphere/pkg/simple/client/events"
 	"net/http"
 )
@@ -38,20 +42,55 @@ const (
 
 var GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha2"}
 
-func AddToContainer(c *restful.Container, factory informers.InformerFactory, evtsClient events.Client) error {
+func AddToContainer(c *restful.Container, factory informers.InformerFactory, k8sclient kubernetes.Interface, ksclient kubesphere.Interface, evtsClient events.Client) error {
 	ws := runtime.NewWebService(GroupVersion)
-	handler := newTenantHandler(factory, evtsClient)
+	handler := newTenantHandler(factory, k8sclient, ksclient, evtsClient)
 
+	ws.Route(ws.POST("/workspaces").
+		To(handler.CreateWorkspace).
+		Reads(tenantv1alpha2.WorkspaceTemplate{}).
+		Returns(http.StatusOK, api.StatusOK, tenantv1alpha2.WorkspaceTemplate{}).
+		Doc("Create workspace.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+	ws.Route(ws.DELETE("/workspaces/{workspace}").
+		To(handler.DeleteWorkspace).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Doc("Delete workspace.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+	ws.Route(ws.PUT("/workspaces/{workspace}").
+		To(handler.UpdateWorkspace).
+		Reads(tenantv1alpha2.WorkspaceTemplate{}).
+		Returns(http.StatusOK, api.StatusOK, tenantv1alpha2.WorkspaceTemplate{}).
+		Doc("Update workspace.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
 	ws.Route(ws.GET("/workspaces").
 		To(handler.ListWorkspaces).
 		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
 		Doc("List all workspaces that belongs to the current user").
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+	ws.Route(ws.GET("/workspaces/{workspace}").
+		To(handler.DescribeWorkspace).
+		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
+		Doc("Describe workspace.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+	ws.Route(ws.GET("/workspaces/{workspace}/clusters").
+		To(handler.ListWorkspaceClusters).
+		Returns(http.StatusOK, api.StatusOK, models.PageableResponse{}).
+		Doc("List clusters authorized to the specified workspace.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+
 	ws.Route(ws.GET("/workspaces/{workspace}/namespaces").
 		To(handler.ListNamespaces).
 		Param(ws.PathParameter("workspace", "workspace name")).
 		Doc("List the namespaces of the specified workspace for the current user").
-		Returns(http.StatusOK, api.StatusOK, []v1.Namespace{}).
+		Returns(http.StatusOK, api.StatusOK, []corev1.Namespace{}).
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
+	ws.Route(ws.POST("/workspaces/{workspace}/namespaces").
+		To(handler.CreateNamespace).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Doc("List the namespaces of the specified workspace for the current user").
+		Reads(corev1.Namespace{}).
+		Returns(http.StatusOK, api.StatusOK, []corev1.Namespace{}).
 		Metadata(restfulspec.KeyOpenAPITags, []string{constants.TenantResourcesTag}))
 
 	ws.Route(ws.GET("/events").
@@ -80,6 +119,5 @@ func AddToContainer(c *restful.Container, factory informers.InformerFactory, evt
 		Returns(http.StatusOK, api.StatusOK, eventsv1alpha1.APIResponse{}))
 
 	c.Add(ws)
-
 	return nil
 }