feat: group auth, add group & groupbinding api

Signed-off-by: Roland.Ma <rolandma@yunify.com>

pkg/models/iam/group/group.go

@@ -0,0 +1,196 @@
+/*
+Copyright 2020 KubeSphere Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package group
+
+import (
+	"encoding/json"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/klog"
+	"kubesphere.io/kubesphere/pkg/api"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	"kubesphere.io/kubesphere/pkg/informers"
+	resourcesv1alpha3 "kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/resource"
+)
+
+type GroupOperator interface {
+	ListGroups(workspace string, queryParam *query.Query) (*api.ListResult, error)
+	CreateGroup(workspace string, namespace *iamv1alpha2.Group) (*iamv1alpha2.Group, error)
+	DescribeGroup(workspace, group string) (*iamv1alpha2.Group, error)
+	DeleteGroup(workspace, group string) error
+	UpdateGroup(workspace string, group *iamv1alpha2.Group) (*iamv1alpha2.Group, error)
+	PatchGroup(workspace string, group *iamv1alpha2.Group) (*iamv1alpha2.Group, error)
+	DeleteGroupBinding(workspace, name string) error
+	CreateGroupBinding(workspace, groupName, userName string) error
+	ListGroupBindings(workspace, group string, queryParam *query.Query) (*api.ListResult, error)
+}
+
+type groupOperator struct {
+	k8sclient      kubernetes.Interface
+	ksclient       kubesphere.Interface
+	resourceGetter *resourcesv1alpha3.ResourceGetter
+}
+
+func New(informers informers.InformerFactory, ksclient kubesphere.Interface, k8sclient kubernetes.Interface) GroupOperator {
+	return &groupOperator{
+		resourceGetter: resourcesv1alpha3.NewResourceGetter(informers),
+		k8sclient:      k8sclient,
+		ksclient:       ksclient,
+	}
+}
+
+func (t *groupOperator) ListGroups(workspace string, queryParam *query.Query) (*api.ListResult, error) {
+
+	if workspace != "" {
+		// filter by workspace
+		queryParam.Filters[query.FieldLabel] = query.Value(fmt.Sprintf("%s=%s", tenantv1alpha1.WorkspaceLabel, workspace))
+	}
+
+	result, err := t.resourceGetter.List("groups", "", queryParam)
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+	return result, nil
+}
+
+// CreateGroup adds a workspace label to group which indicates group is under the workspace
+func (t *groupOperator) CreateGroup(workspace string, namespace *iamv1alpha2.Group) (*iamv1alpha2.Group, error) {
+	return t.ksclient.IamV1alpha2().Groups().Create(labelGroupWithWorkspaceName(namespace, workspace))
+}
+
+func (t *groupOperator) DescribeGroup(workspace, group string) (*iamv1alpha2.Group, error) {
+	obj, err := t.resourceGetter.Get("groups", "", group)
+	if err != nil {
+		return nil, err
+	}
+	ns := obj.(*iamv1alpha2.Group)
+	if ns.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+		err := errors.NewNotFound(corev1.Resource("group"), group)
+		klog.Error(err)
+		return nil, err
+	}
+	return ns, nil
+}
+
+func (t *groupOperator) DeleteGroup(workspace, group string) error {
+	_, err := t.DescribeGroup(workspace, group)
+	if err != nil {
+		return err
+	}
+	return t.ksclient.IamV1alpha2().Groups().Delete(group, metav1.NewDeleteOptions(0))
+}
+
+func (t *groupOperator) UpdateGroup(workspace string, group *iamv1alpha2.Group) (*iamv1alpha2.Group, error) {
+	_, err := t.DescribeGroup(workspace, group.Name)
+	if err != nil {
+		return nil, err
+	}
+	group = labelGroupWithWorkspaceName(group, workspace)
+	return t.ksclient.IamV1alpha2().Groups().Update(group)
+}
+
+func (t *groupOperator) PatchGroup(workspace string, group *iamv1alpha2.Group) (*iamv1alpha2.Group, error) {
+	_, err := t.DescribeGroup(workspace, group.Name)
+	if err != nil {
+		return nil, err
+	}
+	if group.Labels != nil {
+		group.Labels[tenantv1alpha1.WorkspaceLabel] = workspace
+	}
+	data, err := json.Marshal(group)
+	if err != nil {
+		return nil, err
+	}
+	return t.ksclient.IamV1alpha2().Groups().Patch(group.Name, types.MergePatchType, data)
+}
+
+func (t *groupOperator) DeleteGroupBinding(workspace, name string) error {
+	obj, err := t.resourceGetter.Get("groupbindings", "", name)
+	if err != nil {
+		return err
+	}
+	ns := obj.(*iamv1alpha2.GroupBinding)
+	if ns.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+		err := errors.NewNotFound(corev1.Resource("groupbinding"), name)
+		klog.Error(err)
+		return err
+	}
+
+	return t.ksclient.IamV1alpha2().GroupBindings().Delete(name, metav1.NewDeleteOptions(0))
+}
+
+func (t *groupOperator) CreateGroupBinding(workspace, groupName, userName string) error {
+
+	groupBinding := iamv1alpha2.GroupBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: fmt.Sprintf("%s-%s", groupName, userName),
+			Labels: map[string]string{
+				iamv1alpha2.UserReferenceLabel:  userName,
+				iamv1alpha2.GroupReferenceLabel: groupName,
+				tenantv1alpha1.WorkspaceLabel:   workspace,
+			},
+		},
+		Users: []string{userName},
+		GroupRef: iamv1alpha2.GroupRef{
+			APIGroup: iamv1alpha2.SchemeGroupVersion.Group,
+			Kind:     iamv1alpha2.ResourcePluralGroup,
+			Name:     groupName,
+		},
+	}
+
+	if _, err := t.ksclient.IamV1alpha2().GroupBindings().Create(&groupBinding); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (t *groupOperator) ListGroupBindings(workspace, group string, queryParam *query.Query) (*api.ListResult, error) {
+
+	if group != "" && workspace != "" {
+		// filter by group
+		queryParam.Filters[query.FieldLabel] = query.Value(fmt.Sprintf("%s=%s", iamv1alpha2.GroupReferenceLabel, group))
+	}
+
+	result, err := t.resourceGetter.List("groupbindings", "", queryParam)
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+	return result, nil
+}
+
+// labelGroupWithWorkspaceName adds a kubesphere.io/workspace=[workspaceName] label to namespace which
+// indicates namespace is under the workspace
+func labelGroupWithWorkspaceName(namespace *iamv1alpha2.Group, workspaceName string) *iamv1alpha2.Group {
+	if namespace.Labels == nil {
+		namespace.Labels = make(map[string]string, 0)
+	}
+
+	namespace.Labels[tenantv1alpha1.WorkspaceLabel] = workspaceName // label namespace with workspace name
+
+	return namespace
+}

pkg/models/resources/v1alpha3/group/group.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2020 KubeSphere Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package group
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
+)
+
+type groupGetter struct {
+	sharedInformers informers.SharedInformerFactory
+}
+
+func New(sharedInformers informers.SharedInformerFactory) v1alpha3.Interface {
+	return &groupGetter{sharedInformers: sharedInformers}
+}
+
+func (d *groupGetter) Get(_, name string) (runtime.Object, error) {
+	return d.sharedInformers.Iam().V1alpha2().Groups().Lister().Get(name)
+}
+
+func (d *groupGetter) List(_ string, query *query.Query) (*api.ListResult, error) {
+
+	groups, err := d.sharedInformers.Iam().V1alpha2().Groups().Lister().List(query.Selector())
+	if err != nil {
+		return nil, err
+	}
+
+	var result []runtime.Object
+	for _, group := range groups {
+		result = append(result, group)
+	}
+
+	return v1alpha3.DefaultList(result, query, d.compare, d.filter), nil
+}
+
+func (d *groupGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
+
+	leftGroup, ok := left.(*v1alpha2.Group)
+	if !ok {
+		return false
+	}
+
+	rightGroup, ok := right.(*v1alpha2.Group)
+	if !ok {
+		return false
+	}
+
+	return v1alpha3.DefaultObjectMetaCompare(leftGroup.ObjectMeta, rightGroup.ObjectMeta, field)
+}
+
+func (d *groupGetter) filter(object runtime.Object, filter query.Filter) bool {
+	group, ok := object.(*v1alpha2.Group)
+
+	if !ok {
+		return false
+	}
+
+	return v1alpha3.DefaultObjectMetaFilter(group.ObjectMeta, filter)
+}

pkg/models/resources/v1alpha3/group/group_test.go

@@ -0,0 +1,111 @@
+/*
+Copyright 2020 KubeSphere Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package group
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	"kubesphere.io/kubesphere/pkg/client/clientset/versioned/fake"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
+)
+
+func TestListWorkspaces(t *testing.T) {
+	tests := []struct {
+		description string
+		namespace   string
+		query       *query.Query
+		expected    *api.ListResult
+		expectedErr error
+	}{
+		{
+			"test name filter",
+			"bar",
+			&query.Query{
+				Pagination: &query.Pagination{
+					Limit:  1,
+					Offset: 0,
+				},
+				SortBy:    query.FieldName,
+				Ascending: false,
+				Filters:   map[query.Field]query.Value{query.FieldName: query.Value("foo2")},
+			},
+			&api.ListResult{
+				Items: []interface{}{
+					foo2,
+				},
+				TotalItems: 1,
+			},
+			nil,
+		},
+	}
+
+	getter := prepare()
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+
+			got, err := getter.List(test.namespace, test.query)
+
+			if test.expectedErr != nil && err != test.expectedErr {
+				t.Errorf("expected error, got nothing")
+			} else if err != nil {
+				t.Fatal(err)
+			}
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("%T differ (-got, +want): %s", test.expected, diff)
+			}
+		})
+	}
+}
+
+var (
+	foo1 = &v1alpha2.Group{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo1",
+		},
+	}
+
+	foo2 = &v1alpha2.Group{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo2",
+		},
+	}
+	bar1 = &v1alpha2.Group{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "bar1",
+		},
+	}
+
+	groups = []interface{}{foo1, foo2, bar1}
+)
+
+func prepare() v1alpha3.Interface {
+	client := fake.NewSimpleClientset()
+	informer := informers.NewSharedInformerFactory(client, 0)
+
+	for _, group := range groups {
+		informer.Iam().V1alpha2().Groups().Informer().GetIndexer().Add(group)
+	}
+	return New(informer)
+}

pkg/models/resources/v1alpha3/groupbinding/groupbinding.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2020 KubeSphere Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package groupbinding
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
+)
+
+type groupBindingGetter struct {
+	sharedInformers informers.SharedInformerFactory
+}
+
+func New(sharedInformers informers.SharedInformerFactory) v1alpha3.Interface {
+	return &groupBindingGetter{sharedInformers: sharedInformers}
+}
+
+func (d *groupBindingGetter) Get(_, name string) (runtime.Object, error) {
+	return d.sharedInformers.Iam().V1alpha2().GroupBindings().Lister().Get(name)
+}
+
+func (d *groupBindingGetter) List(_ string, query *query.Query) (*api.ListResult, error) {
+
+	groupBindings, err := d.sharedInformers.Iam().V1alpha2().GroupBindings().Lister().List(query.Selector())
+	if err != nil {
+		return nil, err
+	}
+
+	var result []runtime.Object
+	for _, groupBinding := range groupBindings {
+		result = append(result, groupBinding)
+	}
+
+	return v1alpha3.DefaultList(result, query, d.compare, d.filter), nil
+}
+
+func (d *groupBindingGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
+
+	leftGroupBinding, ok := left.(*v1alpha2.GroupBinding)
+	if !ok {
+		return false
+	}
+
+	rightGroupBinding, ok := right.(*v1alpha2.GroupBinding)
+	if !ok {
+		return false
+	}
+
+	return v1alpha3.DefaultObjectMetaCompare(leftGroupBinding.ObjectMeta, rightGroupBinding.ObjectMeta, field)
+}
+
+func (d *groupBindingGetter) filter(object runtime.Object, filter query.Filter) bool {
+	groupbinding, ok := object.(*v1alpha2.GroupBinding)
+
+	if !ok {
+		return false
+	}
+
+	return v1alpha3.DefaultObjectMetaFilter(groupbinding.ObjectMeta, filter)
+}

pkg/models/resources/v1alpha3/groupbinding/groupbinding_test.go

@@ -0,0 +1,111 @@
+/*
+Copyright 2020 KubeSphere Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package groupbinding
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/query"
+	"kubesphere.io/kubesphere/pkg/client/clientset/versioned/fake"
+	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
+)
+
+func TestListWorkspaces(t *testing.T) {
+	tests := []struct {
+		description string
+		namespace   string
+		query       *query.Query
+		expected    *api.ListResult
+		expectedErr error
+	}{
+		{
+			"test name filter",
+			"bar",
+			&query.Query{
+				Pagination: &query.Pagination{
+					Limit:  1,
+					Offset: 0,
+				},
+				SortBy:    query.FieldName,
+				Ascending: false,
+				Filters:   map[query.Field]query.Value{query.FieldName: query.Value("foo2")},
+			},
+			&api.ListResult{
+				Items: []interface{}{
+					foo2,
+				},
+				TotalItems: 1,
+			},
+			nil,
+		},
+	}
+
+	getter := prepare()
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+
+			got, err := getter.List(test.namespace, test.query)
+
+			if test.expectedErr != nil && err != test.expectedErr {
+				t.Errorf("expected error, got nothing")
+			} else if err != nil {
+				t.Fatal(err)
+			}
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("%T differ (-got, +want): %s", test.expected, diff)
+			}
+		})
+	}
+}
+
+var (
+	foo1 = &v1alpha2.GroupBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo1",
+		},
+	}
+
+	foo2 = &v1alpha2.GroupBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo2",
+		},
+	}
+	bar1 = &v1alpha2.GroupBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "bar1",
+		},
+	}
+
+	groupBindings = []interface{}{foo1, foo2, bar1}
+)
+
+func prepare() v1alpha3.Interface {
+	client := fake.NewSimpleClientset()
+	informer := informers.NewSharedInformerFactory(client, 0)
+
+	for _, groupBinding := range groupBindings {
+		informer.Iam().V1alpha2().GroupBindings().Informer().GetIndexer().Add(groupBinding)
+	}
+	return New(informer)
+}

pkg/models/resources/v1alpha3/resource/resource.go

@@ -18,6 +18,7 @@ package resource
 
 import (
 	"errors"
+
 	snapshotv1beta1 "github.com/kubernetes-csi/external-snapshotter/v2/pkg/apis/volumesnapshot/v1beta1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -51,6 +52,8 @@ import (
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/federatedstatefulset"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrole"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrolebinding"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/group"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/groupbinding"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/ingress"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/job"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/loginrecord"
@@ -103,6 +106,8 @@ func NewResourceGetter(factory informers.InformerFactory) *ResourceGetter {
 	getters[iamv1alpha2.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralGlobalRoleBinding)] = globalrolebinding.New(factory.KubeSphereSharedInformerFactory())
 	getters[iamv1alpha2.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralWorkspaceRoleBinding)] = workspacerolebinding.New(factory.KubeSphereSharedInformerFactory())
 	getters[iamv1alpha2.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralLoginRecord)] = loginrecord.New(factory.KubeSphereSharedInformerFactory())
+	getters[iamv1alpha2.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcePluralGroup)] = group.New(factory.KubeSphereSharedInformerFactory())
+	getters[iamv1alpha2.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcePluralGroupBinding)] = groupbinding.New(factory.KubeSphereSharedInformerFactory())
 	getters[rbacv1.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralRole)] = role.New(factory.KubernetesSharedInformerFactory())
 	getters[rbacv1.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralClusterRole)] = clusterrole.New(factory.KubernetesSharedInformerFactory())
 	getters[rbacv1.SchemeGroupVersion.WithResource(iamv1alpha2.ResourcesPluralRoleBinding)] = rolebinding.New(factory.KubernetesSharedInformerFactory())