improve IAM module

Signed-off-by: hongming <talonwan@yunify.com>

pkg/models/resources/v1alpha3/clusterrole/clusterroles.go

@@ -18,57 +18,70 @@
 package clusterrole
 
 import (
+	"encoding/json"
 	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/informers"
+	"k8s.io/klog"
 	"kubesphere.io/kubesphere/pkg/api"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
 )
 
-type rolesGetter struct {
+type clusterrolesGetter struct {
 	sharedInformers informers.SharedInformerFactory
 }
 
 func New(sharedInformers informers.SharedInformerFactory) v1alpha3.Interface {
-	return &rolesGetter{sharedInformers: sharedInformers}
+	return &clusterrolesGetter{sharedInformers: sharedInformers}
 }
 
-func (d *rolesGetter) Get(namespace, name string) (runtime.Object, error) {
+func (d *clusterrolesGetter) Get(namespace, name string) (runtime.Object, error) {
 	return d.sharedInformers.Rbac().V1().ClusterRoles().Lister().Get(name)
 }
 
-func (d *rolesGetter) List(namespace string, query *query.Query) (*api.ListResult, error) {
+func (d *clusterrolesGetter) List(namespace string, query *query.Query) (*api.ListResult, error) {
+
+	var roles []*rbacv1.ClusterRole
+	var err error
+
+	if aggregateTo := query.Filters[iamv1alpha2.AggregateTo]; aggregateTo != "" {
+		roles, err = d.fetchAggregationRoles(string(aggregateTo))
+		delete(query.Filters, iamv1alpha2.AggregateTo)
+	} else {
+		roles, err = d.sharedInformers.Rbac().V1().ClusterRoles().Lister().List(query.Selector())
+	}
 
-	all, err := d.sharedInformers.Rbac().V1().ClusterRoles().Lister().List(query.Selector())
 	if err != nil {
 		return nil, err
 	}
 
 	var result []runtime.Object
-	for _, deploy := range all {
-		result = append(result, deploy)
+	for _, clusterrole := range roles {
+		result = append(result, clusterrole)
 	}
 
 	return v1alpha3.DefaultList(result, query, d.compare, d.filter), nil
 }
 
-func (d *rolesGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
+func (d *clusterrolesGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
 
-	leftRole, ok := left.(*rbacv1.ClusterRole)
+	leftClusterRole, ok := left.(*rbacv1.ClusterRole)
 	if !ok {
 		return false
 	}
 
-	rightRole, ok := right.(*rbacv1.ClusterRole)
+	rightClusterRole, ok := right.(*rbacv1.ClusterRole)
 	if !ok {
 		return false
 	}
 
-	return v1alpha3.DefaultObjectMetaCompare(leftRole.ObjectMeta, rightRole.ObjectMeta, field)
+	return v1alpha3.DefaultObjectMetaCompare(leftClusterRole.ObjectMeta, rightClusterRole.ObjectMeta, field)
 }
 
-func (d *rolesGetter) filter(object runtime.Object, filter query.Filter) bool {
+func (d *clusterrolesGetter) filter(object runtime.Object, filter query.Filter) bool {
 	role, ok := object.(*rbacv1.ClusterRole)
 
 	if !ok {
@@ -77,3 +90,38 @@ func (d *rolesGetter) filter(object runtime.Object, filter query.Filter) bool {
 
 	return v1alpha3.DefaultObjectMetaFilter(role.ObjectMeta, filter)
 }
+
+func (d *clusterrolesGetter) fetchAggregationRoles(name string) ([]*rbacv1.ClusterRole, error) {
+	roles := make([]*rbacv1.ClusterRole, 0)
+
+	obj, err := d.Get("", name)
+
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return roles, nil
+		}
+		return nil, err
+	}
+
+	if annotation := obj.(*rbacv1.ClusterRole).Annotations[iamv1alpha2.AggregationRolesAnnotation]; annotation != "" {
+		var roleNames []string
+		if err = json.Unmarshal([]byte(annotation), &roleNames); err == nil {
+
+			for _, roleName := range roleNames {
+				role, err := d.Get("", roleName)
+
+				if err != nil {
+					if errors.IsNotFound(err) {
+						klog.Warningf("invalid aggregation role found: %s, %s", name, roleName)
+						continue
+					}
+					return nil, err
+				}
+
+				roles = append(roles, role.(*rbacv1.ClusterRole))
+			}
+		}
+	}
+
+	return roles, nil
+}