forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
UPSTREAM: <carry>: openshift-kube-apiserver: add kube-apiserver patches
Origin-commit: 170dd7d25cca990fd7683eaf424d00bcd776c39c Origin-commit: 35ef039cb099dc609c576cf594aadd849212a00b UPSTREAM: <carry>: openshift-kube-apiserver: enabled conversion gen for admission configs
- Loading branch information
Showing
170 changed files
with
15,752 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
openshift-kube-apiserver/admission/admissionenablement/admission.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package admissionenablement | ||
|
|
||
| import ( | ||
| "k8s.io/kubernetes/cmd/kube-apiserver/app/options" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration" | ||
| ) | ||
|
|
||
| func InstallOpenShiftAdmissionPlugins(o *options.ServerRunOptions) { | ||
| existingAdmissionOrder := o.Admission.GenericAdmission.RecommendedPluginOrder | ||
| o.Admission.GenericAdmission.RecommendedPluginOrder = NewOrderedKubeAdmissionPlugins(existingAdmissionOrder) | ||
| RegisterOpenshiftKubeAdmissionPlugins(o.Admission.GenericAdmission.Plugins) | ||
| customresourcevalidationregistration.RegisterCustomResourceValidation(o.Admission.GenericAdmission.Plugins) | ||
| existingDefaultOff := o.Admission.GenericAdmission.DefaultOffPlugins | ||
| o.Admission.GenericAdmission.DefaultOffPlugins = NewDefaultOffPluginsFunc(existingDefaultOff)() | ||
| } |
30 changes: 30 additions & 0 deletions
30
openshift-kube-apiserver/admission/admissionenablement/admission_config.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package admissionenablement | ||
|
|
||
| import ( | ||
| "time" | ||
|
|
||
| "github.com/openshift/library-go/pkg/apiserver/admission/admissiontimeout" | ||
| "k8s.io/apiserver/pkg/admission" | ||
| "k8s.io/client-go/informers" | ||
| "k8s.io/client-go/kubernetes" | ||
| "k8s.io/kubernetes/cmd/kube-apiserver/app/options" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/namespaceconditions" | ||
| ) | ||
|
|
||
| func SetAdmissionDefaults(o *options.ServerRunOptions, informers informers.SharedInformerFactory, kubeClient kubernetes.Interface) { | ||
| // set up the decorators we need. This is done late and out of order because our decorators currently require informers which are not | ||
| // present until we start running | ||
| namespaceLabelDecorator := namespaceconditions.NamespaceLabelConditions{ | ||
| NamespaceClient: kubeClient.CoreV1(), | ||
| NamespaceLister: informers.Core().V1().Namespaces().Lister(), | ||
|
|
||
| SkipLevelZeroNames: SkipRunLevelZeroPlugins, | ||
| SkipLevelOneNames: SkipRunLevelOnePlugins, | ||
| } | ||
| o.Admission.GenericAdmission.Decorators = append(o.Admission.GenericAdmission.Decorators, | ||
| admission.Decorators{ | ||
| admission.DecoratorFunc(namespaceLabelDecorator.WithNamespaceLabelConditions), | ||
| admission.DecoratorFunc(admissiontimeout.AdmissionTimeout{Timeout: 13 * time.Second}.WithTimeout), | ||
| }, | ||
| ) | ||
| } |
111 changes: 111 additions & 0 deletions
111
openshift-kube-apiserver/admission/admissionenablement/register.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| package admissionenablement | ||
|
|
||
| import ( | ||
| "k8s.io/apimachinery/pkg/util/sets" | ||
| "k8s.io/apiserver/pkg/admission" | ||
| "k8s.io/apiserver/pkg/admission/plugin/resourcequota" | ||
| mutatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating" | ||
|
|
||
| "github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy" | ||
| imagepolicyapiv1 "github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy/apis/imagepolicy/v1" | ||
| quotaclusterresourcequota "github.com/openshift/apiserver-library-go/pkg/admission/quota/clusterresourcequota" | ||
| "github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccadmission" | ||
| authorizationrestrictusers "k8s.io/kubernetes/openshift-kube-apiserver/admission/authorization/restrictusers" | ||
| quotaclusterresourceoverride "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/clusterresourceoverride" | ||
| quotarunonceduration "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/runonceduration" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/network/externalipranger" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/network/restrictedendpoints" | ||
| ingressadmission "k8s.io/kubernetes/openshift-kube-apiserver/admission/route" | ||
| projectnodeenv "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeenv" | ||
| schedulerpodnodeconstraints "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/podnodeconstraints" | ||
| ) | ||
|
|
||
| func RegisterOpenshiftKubeAdmissionPlugins(plugins *admission.Plugins) { | ||
| authorizationrestrictusers.Register(plugins) | ||
| imagepolicy.Register(plugins) | ||
| ingressadmission.Register(plugins) | ||
| projectnodeenv.Register(plugins) | ||
| quotaclusterresourceoverride.Register(plugins) | ||
| quotaclusterresourcequota.Register(plugins) | ||
| quotarunonceduration.Register(plugins) | ||
| schedulerpodnodeconstraints.Register(plugins) | ||
| sccadmission.Register(plugins) | ||
| sccadmission.RegisterSCCExecRestrictions(plugins) | ||
| externalipranger.RegisterExternalIP(plugins) | ||
| restrictedendpoints.RegisterRestrictedEndpoints(plugins) | ||
| } | ||
|
|
||
| var ( | ||
|
|
||
| // these are admission plugins that cannot be applied until after the kubeapiserver starts. | ||
| // TODO if nothing comes to mind in 3.10, kill this | ||
| SkipRunLevelZeroPlugins = sets.NewString() | ||
| // these are admission plugins that cannot be applied until after the openshiftapiserver apiserver starts. | ||
| SkipRunLevelOnePlugins = sets.NewString( | ||
| imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy" | ||
| "quota.openshift.io/ClusterResourceQuota", | ||
| "security.openshift.io/SecurityContextConstraint", | ||
| "security.openshift.io/SCCExecRestrictions", | ||
| ) | ||
|
|
||
| // openshiftAdmissionPluginsForKubeBeforeMutating are the admission plugins to add after kube admission, before mutating webhooks | ||
| openshiftAdmissionPluginsForKubeBeforeMutating = []string{ | ||
| "autoscaling.openshift.io/ClusterResourceOverride", | ||
| "authorization.openshift.io/RestrictSubjectBindings", | ||
| "autoscaling.openshift.io/RunOnceDuration", | ||
| "scheduling.openshift.io/PodNodeConstraints", | ||
| "scheduling.openshift.io/OriginPodNodeEnvironment", | ||
| "network.openshift.io/ExternalIPRanger", | ||
| "network.openshift.io/RestrictedEndpointsAdmission", | ||
| imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy" | ||
| "security.openshift.io/SecurityContextConstraint", | ||
| "security.openshift.io/SCCExecRestrictions", | ||
| "route.openshift.io/IngressAdmission", | ||
| } | ||
|
|
||
| // openshiftAdmissionPluginsForKubeAfterResourceQuota are the plugins to add after ResourceQuota plugin | ||
| openshiftAdmissionPluginsForKubeAfterResourceQuota = []string{ | ||
| "quota.openshift.io/ClusterResourceQuota", | ||
| } | ||
|
|
||
| // additionalDefaultOnPlugins is a list of plugins we turn on by default that core kube does not. | ||
| additionalDefaultOnPlugins = sets.NewString( | ||
| "NodeRestriction", | ||
| "OwnerReferencesPermissionEnforcement", | ||
| "PersistentVolumeLabel", | ||
| "PodNodeSelector", | ||
| "PodTolerationRestriction", | ||
| "Priority", | ||
| imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy" | ||
| "StorageObjectInUseProtection", | ||
| ) | ||
| ) | ||
|
|
||
| func NewOrderedKubeAdmissionPlugins(kubeAdmissionOrder []string) []string { | ||
| ret := []string{} | ||
| for _, curr := range kubeAdmissionOrder { | ||
| if curr == mutatingwebhook.PluginName { | ||
| ret = append(ret, openshiftAdmissionPluginsForKubeBeforeMutating...) | ||
| ret = append(ret, customresourcevalidationregistration.AllCustomResourceValidators...) | ||
| } | ||
|
|
||
| ret = append(ret, curr) | ||
|
|
||
| if curr == resourcequota.PluginName { | ||
| ret = append(ret, openshiftAdmissionPluginsForKubeAfterResourceQuota...) | ||
| } | ||
| } | ||
| return ret | ||
| } | ||
|
|
||
| func NewDefaultOffPluginsFunc(kubeDefaultOffAdmission sets.String) func() sets.String { | ||
| return func() sets.String { | ||
| kubeOff := sets.NewString(kubeDefaultOffAdmission.UnsortedList()...) | ||
| kubeOff.Delete(additionalDefaultOnPlugins.List()...) | ||
| kubeOff.Delete(openshiftAdmissionPluginsForKubeBeforeMutating...) | ||
| kubeOff.Delete(openshiftAdmissionPluginsForKubeAfterResourceQuota...) | ||
| kubeOff.Delete(customresourcevalidationregistration.AllCustomResourceValidators...) | ||
| return kubeOff | ||
| } | ||
| } |
54 changes: 54 additions & 0 deletions
54
openshift-kube-apiserver/admission/admissionenablement/register_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| package admissionenablement | ||
|
|
||
| import ( | ||
| "reflect" | ||
| "testing" | ||
|
|
||
| "k8s.io/apiserver/pkg/admission" | ||
| genericapiserver "k8s.io/apiserver/pkg/server" | ||
| "k8s.io/kubernetes/pkg/kubeapiserver/options" | ||
|
|
||
| "github.com/openshift/library-go/pkg/apiserver/admission/admissionregistrationtesting" | ||
| "k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration" | ||
| ) | ||
|
|
||
| func TestAdmissionRegistration(t *testing.T) { | ||
| orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins) | ||
| defaultOffPlugins := NewDefaultOffPluginsFunc(options.DefaultOffAdmissionPlugins())() | ||
| registerAllAdmissionPlugins := func(plugins *admission.Plugins) { | ||
| genericapiserver.RegisterAllAdmissionPlugins(plugins) | ||
| options.RegisterAllAdmissionPlugins(plugins) | ||
| RegisterOpenshiftKubeAdmissionPlugins(plugins) | ||
| customresourcevalidationregistration.RegisterCustomResourceValidation(plugins) | ||
| } | ||
| plugins := admission.NewPlugins() | ||
| registerAllAdmissionPlugins(plugins) | ||
|
|
||
| err := admissionregistrationtesting.AdmissionRegistrationTest(plugins, orderedAdmissionChain, defaultOffPlugins) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| } | ||
|
|
||
| // TestResourceQuotaBeforeClusterResourceQuota simply test wheather ResourceQuota plugin is before ClusterResourceQuota plugin | ||
| func TestResourceQuotaBeforeClusterResourceQuota(t *testing.T) { | ||
| orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins) | ||
|
|
||
| expectedOrderedAdmissionSubChain := []string{"ResourceQuota", "quota.openshift.io/ClusterResourceQuota", "AlwaysDeny"} | ||
| actualOrderedAdmissionChain := extractSubChain(orderedAdmissionChain, expectedOrderedAdmissionSubChain[0]) | ||
|
|
||
| if !reflect.DeepEqual(actualOrderedAdmissionChain, expectedOrderedAdmissionSubChain) { | ||
| t.Fatalf("expected %v, got %v ", expectedOrderedAdmissionSubChain, actualOrderedAdmissionChain) | ||
| } | ||
| } | ||
|
|
||
| func extractSubChain(admissionChain []string, takeFrom string) []string { | ||
| indexOfTake := 0 | ||
| for index, admission := range admissionChain { | ||
| if admission == takeFrom { | ||
| indexOfTake = index | ||
| break | ||
| } | ||
| } | ||
| return admissionChain[indexOfTake:] | ||
| } |
28 changes: 28 additions & 0 deletions
28
openshift-kube-apiserver/admission/authorization/restrictusers/groupcache_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package restrictusers | ||
|
|
||
| import ( | ||
| userv1 "github.com/openshift/api/user/v1" | ||
| ) | ||
|
|
||
| type fakeGroupCache struct { | ||
| groups []userv1.Group | ||
| } | ||
|
|
||
| func (g fakeGroupCache) GroupsFor(user string) ([]*userv1.Group, error) { | ||
| ret := []*userv1.Group{} | ||
| for i := range g.groups { | ||
| group := &g.groups[i] | ||
| for _, currUser := range group.Users { | ||
| if user == currUser { | ||
| ret = append(ret, group) | ||
| break | ||
| } | ||
| } | ||
|
|
||
| } | ||
| return ret, nil | ||
| } | ||
|
|
||
| func (g fakeGroupCache) HasSynced() bool { | ||
| return true | ||
| } |
Oops, something went wrong.