-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
115 additions
and
44 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,14 @@ | ||
| package bootstrappolicy | ||
|
|
||
| import ( | ||
| "k8s.io/kubernetes/pkg/apis/rbac" | ||
| rbacrest "k8s.io/kubernetes/pkg/registry/rbac/rest" | ||
| ) | ||
|
|
||
| func Policy() *rbacrest.PolicyData { | ||
| return &rbacrest.PolicyData{ | ||
| ClusterRoles: GetBootstrapClusterRoles(), | ||
| ClusterRoleBindings: GetBootstrapClusterRoleBindings(), | ||
| Roles: map[string][]rbac.Role{ | ||
| DefaultOpenShiftSharedResourcesNamespace: GetBootstrapOpenshiftRoles(DefaultOpenShiftSharedResourcesNamespace), | ||
| }, | ||
| RoleBindings: map[string][]rbac.RoleBinding{ | ||
| DefaultOpenShiftSharedResourcesNamespace: GetBootstrapOpenshiftRoleBindings(DefaultOpenShiftSharedResourcesNamespace), | ||
| }, | ||
| Roles: NamespaceRoles(), | ||
| RoleBindings: NamespaceRoleBindings(), | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| package bootstrappolicy | ||
|
|
||
| import ( | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/kubernetes/pkg/apis/rbac" | ||
| "k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy" | ||
| ) | ||
|
|
||
| var ( | ||
| // namespaceRoles is a map of namespace to slice of roles to create | ||
| namespaceRoles = map[string][]rbac.Role{} | ||
|
|
||
| // namespaceRoleBindings is a map of namespace to slice of roleBindings to create | ||
| namespaceRoleBindings = map[string][]rbac.RoleBinding{} | ||
| ) | ||
|
|
||
| func init() { | ||
| namespaceRoles[DefaultOpenShiftSharedResourcesNamespace] = GetBootstrapOpenshiftRoles(DefaultOpenShiftSharedResourcesNamespace) | ||
| namespaceRoleBindings[DefaultOpenShiftSharedResourcesNamespace] = GetBootstrapOpenshiftRoleBindings(DefaultOpenShiftSharedResourcesNamespace) | ||
| } | ||
|
|
||
| func GetBootstrapOpenshiftRoles(openshiftNamespace string) []rbac.Role { | ||
| return []rbac.Role{ | ||
| { | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: OpenshiftSharedResourceViewRoleName, | ||
| Namespace: openshiftNamespace, | ||
| }, | ||
| Rules: []rbac.PolicyRule{ | ||
| rbac.NewRule(read...). | ||
| Groups(templateGroup, legacyTemplateGroup). | ||
| Resources("templates"). | ||
| RuleOrDie(), | ||
| rbac.NewRule(read...). | ||
| Groups(imageGroup, legacyImageGroup). | ||
| Resources("imagestreams", "imagestreamtags", "imagestreamimages"). | ||
| RuleOrDie(), | ||
| // so anyone can pull from openshift/* image streams | ||
| rbac.NewRule("get"). | ||
| Groups(imageGroup, legacyImageGroup). | ||
| Resources("imagestreams/layers"). | ||
| RuleOrDie(), | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| // NamespaceRoles returns a map of namespace to slice of roles to create | ||
| func NamespaceRoles() map[string][]rbac.Role { | ||
| ret := map[string][]rbac.Role{} | ||
| for k, v := range namespaceRoles { | ||
| ret[k] = v | ||
| } | ||
| for k, v := range bootstrappolicy.NamespaceRoles() { | ||
| ret[k] = v | ||
| } | ||
| return ret | ||
| } | ||
|
|
||
| // NamespaceRoleBindings returns a map of namespace to slice of roles to create | ||
| func NamespaceRoleBindings() map[string][]rbac.RoleBinding { | ||
| ret := map[string][]rbac.RoleBinding{} | ||
| for k, v := range bootstrappolicy.NamespaceRoleBindings() { | ||
| ret[k] = v | ||
| } | ||
| return ret | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package bootstrappolicy | ||
|
|
||
| import ( | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy" | ||
| ) | ||
|
|
||
| func TestOpenshiftNamespacePolicyNamespaces(t *testing.T) { | ||
| for ns := range namespaceRoles { | ||
| if ns == DefaultOpenShiftSharedResourcesNamespace { | ||
| continue | ||
| } | ||
| if strings.HasPrefix(ns, "openshift-") { | ||
| continue | ||
| } | ||
| t.Errorf("bootstrap role in %q,but must be under %q", ns, "openshift-") | ||
| } | ||
|
|
||
| for ns := range namespaceRoleBindings { | ||
| if ns == DefaultOpenShiftSharedResourcesNamespace { | ||
| continue | ||
| } | ||
| if strings.HasPrefix(ns, "openshift-") { | ||
| continue | ||
| } | ||
| t.Errorf("bootstrap rolebinding in %q,but must be under %q", ns, "openshift-") | ||
| } | ||
| } | ||
|
|
||
| func TestKubeNamespacePolicyNamespaces(t *testing.T) { | ||
| for ns := range bootstrappolicy.NamespaceRoles() { | ||
| if strings.HasPrefix(ns, "kube-") { | ||
| continue | ||
| } | ||
| t.Errorf("bootstrap role in %q,but must be under %q", ns, "kube-") | ||
| } | ||
|
|
||
| for ns := range bootstrappolicy.NamespaceRoles() { | ||
| if strings.HasPrefix(ns, "kube-") { | ||
| continue | ||
| } | ||
| t.Errorf("bootstrap rolebinding in %q,but must be under %q", ns, "kube-") | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters