Skip to content

Commit 5743300

Browse files
mrajashreeAlena Prokharchyk
mrajashree
authored and
Alena Prokharchyk
committed
Create roles/rolebindings for global dns entries/providers
1 parent 0ce1865 commit 5743300

5 files changed

Lines changed: 132 additions & 12 deletions

File tree

‎pkg/controllers/management/globaldns/globaldns_handler.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ func (n *GDController) sync(key string, obj *v3.GlobalDNS) (runtime.Object, erro
6666
return nil, fmt.Errorf("GlobalDNS %v has no creatorId annotation", metaAccessor.GetName())
6767
}
6868

69+
if err := globalnamespacerbac.CreateRoleAndRoleBinding(globalnamespacerbac.GlobalDNSResource, obj.Name,
70+
obj.UID, obj.Spec.Members, creatorID, n.managementContext); err != nil {
71+
return nil, err
72+
}
6973
//check if status.endpoints is set, if yes create a dummy ingress if not already present
7074
//if ingress exists, update endpoints if different
7175

@@ -98,10 +102,6 @@ func (n *GDController) sync(key string, obj *v3.GlobalDNS) (runtime.Object, erro
98102
return nil, fmt.Errorf("GlobalDNSController: Error updating ingress for the GlobalDNS %v", err)
99103
}
100104

101-
if err := globalnamespacerbac.CreateRoleAndRoleBinding(globalnamespacerbac.GlobalDNSResource, obj.Name,
102-
obj.UID, obj.Spec.Members, creatorID, n.managementContext); err != nil {
103-
return nil, err
104-
}
105105
return nil, nil
106106
}
107107

‎pkg/controllers/management/globaldns/globaldns_provider.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,12 @@ func (n *ProviderLauncher) sync(key string, obj *v3.GlobalDNSProvider) (runtime.
6969
}
7070
creatorID, ok := metaAccessor.GetAnnotations()[globalnamespacerbac.CreatorIDAnn]
7171
if !ok {
72-
return nil, fmt.Errorf("GlobalDNS %v has no creatorId annotation", metaAccessor.GetName())
72+
return nil, fmt.Errorf("GlobalDNS provider %v has no creatorId annotation", metaAccessor.GetName())
73+
}
74+
75+
if err := globalnamespacerbac.CreateRoleAndRoleBinding(globalnamespacerbac.GlobalDNSProviderResource, obj.Name,
76+
obj.UID, obj.Spec.Members, creatorID, n.managementContext); err != nil {
77+
return nil, err
7378
}
7479
//check if provider already running for this GlobalDNSProvider.
7580
if n.isProviderAlreadyRunning(obj) {
@@ -106,10 +111,6 @@ func (n *ProviderLauncher) sync(key string, obj *v3.GlobalDNSProvider) (runtime.
106111
return n.handleAlidnsProvider(obj)
107112
}
108113

109-
if err := globalnamespacerbac.CreateRoleAndRoleBinding(globalnamespacerbac.GlobalDNSProviderResource, obj.Name,
110-
obj.UID, obj.Spec.Members, creatorID, n.managementContext); err != nil {
111-
return nil, err
112-
}
113114
return nil, nil
114115
}
115116

‎pkg/controllers/management/globalnamespacerbac/rbac_common.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,11 @@ func CreateRoleAndRoleBinding(resource string, name string, UID types.UID, membe
6060
case readOnlyAccess:
6161
readOnlyAccessSubjects = append(readOnlyAccessSubjects, s)
6262
default:
63-
readOnlyAccessSubjects = append(readOnlyAccessSubjects, s)
63+
if resource == GlobalDNSProviderResource || resource == GlobalDNSResource {
64+
ownerAccessSubjects = append(ownerAccessSubjects, s)
65+
} else {
66+
readOnlyAccessSubjects = append(readOnlyAccessSubjects, s)
67+
}
6468
}
6569
}
6670

‎tests/core/test_globaldns.py‎

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
from .common import random_str
22
from rancher import ApiError
33
import pytest
4+
import time
5+
import kubernetes
46

57

68
def test_dns_fqdn_unique(admin_mc):
@@ -42,12 +44,125 @@ def test_dns_provider_deletion(admin_mc):
4244
'rootDomain': "example.com"})
4345

4446
fqdn = random_str() + ".example.com"
47+
provider_id = "cattle-global-data:"+provider_name
4548
globaldns_entry = \
46-
client.create_global_dns(fqdn=fqdn, providerId=provider_name)
49+
client.create_global_dns(fqdn=fqdn, providerId=provider_id)
4750

4851
with pytest.raises(ApiError) as e:
4952
client.delete(globaldns_provider)
5053
assert e.value.error.status == 403
5154

5255
client.delete(globaldns_entry)
5356
client.delete(globaldns_provider)
57+
58+
59+
def test_share_globaldns_provider_entry(admin_mc, user_factory,
60+
remove_resource):
61+
client = admin_mc.client
62+
provider_name = random_str()
63+
access = random_str()
64+
secret = random_str()
65+
# Add regular user as member to gdns provider
66+
user_member = user_factory()
67+
remove_resource(user_member)
68+
user_client = user_member.client
69+
members = [{"userPrincipalId": "local://" + user_member.user.id,
70+
"accessType": "owner"}]
71+
globaldns_provider = \
72+
client.create_global_dns_provider(
73+
name=provider_name,
74+
route53ProviderConfig={
75+
'accessKey': access,
76+
'secretKey': secret,
77+
'rootDomain': "example.com"},
78+
members=members)
79+
80+
remove_resource(globaldns_provider)
81+
fqdn = random_str() + ".example.com"
82+
globaldns_entry = \
83+
client.create_global_dns(fqdn=fqdn, providerId=provider_name,
84+
members=members)
85+
remove_resource(globaldns_entry)
86+
# Make sure creator can access both, provider and entry
87+
gdns_provider_id = "cattle-global-data:" + provider_name
88+
gdns_provider = client.by_id_global_dns_provider(gdns_provider_id)
89+
assert gdns_provider is not None
90+
91+
gdns_entry_id = "cattle-global-data:" + globaldns_entry.name
92+
gdns = client.by_id_global_dns(gdns_entry_id)
93+
assert gdns is not None
94+
# user should be able to list this gdns provider
95+
api_instance = kubernetes.client.RbacAuthorizationV1Api(
96+
admin_mc.k8s_client)
97+
provider_rb_name = provider_name + "-gp-a"
98+
wait_to_ensure_user_in_rb_subject(api_instance, provider_rb_name,
99+
user_member.user.id)
100+
gdns_provider = user_client.by_id_global_dns_provider(gdns_provider_id)
101+
assert gdns_provider is not None
102+
103+
# user should be able to list this gdns entry
104+
entry_rb_name = globaldns_entry.name + "-g-a"
105+
wait_to_ensure_user_in_rb_subject(api_instance, entry_rb_name,
106+
user_member.user.id)
107+
gdns = user_client.by_id_global_dns(gdns_entry_id)
108+
assert gdns is not None
109+
110+
111+
def test_user_access_global_dns(admin_mc, user_factory, remove_resource):
112+
user1 = user_factory()
113+
remove_resource(user1)
114+
user_client = user1.client
115+
provider_name = random_str()
116+
access = random_str()
117+
secret = random_str()
118+
globaldns_provider = \
119+
user_client.create_global_dns_provider(
120+
name=provider_name,
121+
route53ProviderConfig={
122+
'accessKey': access,
123+
'secretKey': secret,
124+
'rootDomain': "example.com"})
125+
126+
remove_resource(globaldns_provider)
127+
fqdn = random_str() + ".example.com"
128+
globaldns_entry = \
129+
user_client.create_global_dns(fqdn=fqdn, providerId=provider_name)
130+
131+
remove_resource(globaldns_entry)
132+
# Make sure creator can access both, provider and entry
133+
api_instance = kubernetes.client.RbacAuthorizationV1Api(
134+
admin_mc.k8s_client)
135+
provider_rb_name = provider_name + "-gp-a"
136+
wait_to_ensure_user_in_rb_subject(api_instance, provider_rb_name,
137+
user1.user.id)
138+
139+
gdns_provider_id = "cattle-global-data:" + provider_name
140+
gdns_provider = user_client.by_id_global_dns_provider(gdns_provider_id)
141+
assert gdns_provider is not None
142+
143+
entry_rb_name = globaldns_entry.name + "-g-a"
144+
wait_to_ensure_user_in_rb_subject(api_instance, entry_rb_name,
145+
user1.user.id)
146+
gdns_entry_id = "cattle-global-data:" + globaldns_entry.name
147+
gdns = user_client.by_id_global_dns(gdns_entry_id)
148+
assert gdns is not None
149+
150+
151+
def wait_to_ensure_user_in_rb_subject(api, name,
152+
userId, timeout=60):
153+
found = False
154+
interval = 0.5
155+
start = time.time()
156+
while not found:
157+
time.sleep(interval)
158+
interval *= 2
159+
try:
160+
rb = api.read_namespaced_role_binding(name, "cattle-global-data")
161+
for i in range(0, len(rb.subjects)):
162+
if rb.subjects[i].name == userId:
163+
found = True
164+
except kubernetes.client.rest.ApiException:
165+
found = False
166+
if time.time() - start > timeout:
167+
raise AssertionError(
168+
"Timed out waiting for user to get added to rb")

‎vendor.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ github.com/rancher/rdns-server bf662911db6acce4d6a85d2878653f6841
4242
github.com/rancher/norman 362802224f64fd09a56be0d275f6ec1d7ecf2164
4343
github.com/rancher/kontainer-engine e4935301f7229ea869ca00aed54d67a20cc0ca17
4444
github.com/rancher/rke f8b6131dd2b30f06b55a3a0888dbadb16ce27101
45-
github.com/rancher/types dc275ce6bede7bd83f4085cb4706d283b8f07be6
45+
github.com/rancher/types d0b7740d2089fdf9befdec93ccc9211e67e49a03
4646

4747
gopkg.in/ldap.v2 v2.5.0
4848
gopkg.in/asn1-ber.v1 v1.1

0 commit comments

Comments
 (0)