-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: yaroslavborbat <[email protected]>
- Loading branch information
1 parent
fb2423c
commit c3bcd08
Showing
6 changed files
with
260 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| ) | ||
|
|
||
| const ( | ||
| SACDIApiserver = "SA_CDI_APISERVER" | ||
| SACDICronjob = "SA_CDI_CRONJOB" | ||
| SACDIOperator = "SA_CDI_OPERATOR" | ||
| SACDISa = "SA_CDI_SA" | ||
| SACDIUploadProxy = "SA_CDI_UPLOAD_PROXY" | ||
| SAKubevirtApiserver = "SA_KUBEVIRT_APISERVER" | ||
| SAKubevirtController = "SA_KUBEVIRT_CONTROLLER" | ||
| SAKubevirtExportProxy = "SA_KUBEVIRT_EXPORT_PROXY" | ||
| SAKubevirtVirtHandler = "SA_KUBEVIRT_VIRT_HANDLER" | ||
| SAKubevirtOperator = "SA_KUBEVIRT_OPERATOR" | ||
| SAVirtualizationController = "SA_VIRTUALIZATION_CONTROLLER" | ||
| SAVirtualizationAPI = "SA_VIRTUALIZATION_API" | ||
| SAVirtualizationPpeDeleteHook = "SA_VIRTUALIZATION_PPE_DELETE_HOOK" | ||
| SAVmRouteForge = "SA_VM_ROUTE_FORGE" | ||
| ) | ||
|
|
||
| type ServiceAccounts struct { | ||
| SACDIApiserver string | ||
| SACDICronjob string | ||
| SACDIOperator string | ||
| SACDISa string | ||
| SACDIUploadProxy string | ||
| SAKubevirtApiserver string | ||
| SAKubevirtController string | ||
| SAKubevirtExportProxy string | ||
| SAKubevirtVirtHandler string | ||
| SAKubevirtOperator string | ||
| SAVirtualizationController string | ||
| SAVirtualizationAPI string | ||
| SAVirtualizationPpeDeleteHook string | ||
| SAVmRouteForge string | ||
| } | ||
|
|
||
| func (s *ServiceAccounts) ToList() []string { | ||
| return []string{ | ||
| s.SACDIApiserver, | ||
| s.SACDICronjob, | ||
| s.SACDIOperator, | ||
| s.SACDISa, | ||
| s.SACDIUploadProxy, | ||
| s.SAKubevirtApiserver, | ||
| s.SAKubevirtController, | ||
| s.SAKubevirtExportProxy, | ||
| s.SAKubevirtVirtHandler, | ||
| s.SAKubevirtOperator, | ||
| s.SAVirtualizationController, | ||
| s.SAVirtualizationAPI, | ||
| s.SAVirtualizationPpeDeleteHook, | ||
| s.SAVmRouteForge, | ||
| } | ||
| } | ||
|
|
||
| func (s *ServiceAccounts) Validate() error { | ||
| if s.SACDIApiserver == "" { | ||
| return fmt.Errorf("%q is required", SACDIApiserver) | ||
| } | ||
| if s.SACDICronjob == "" { | ||
| return fmt.Errorf("%q is required", SACDICronjob) | ||
| } | ||
| if s.SACDIOperator == "" { | ||
| return fmt.Errorf("%q is required", SACDIOperator) | ||
| } | ||
| if s.SACDISa == "" { | ||
| return fmt.Errorf("%q is required", SACDISa) | ||
| } | ||
| if s.SACDIUploadProxy == "" { | ||
| return fmt.Errorf("%q is required", SACDIUploadProxy) | ||
| } | ||
| if s.SAKubevirtApiserver == "" { | ||
| return fmt.Errorf("%q is required", SAKubevirtApiserver) | ||
| } | ||
| if s.SAKubevirtController == "" { | ||
| return fmt.Errorf("%q is required", SAKubevirtController) | ||
| } | ||
| if s.SAKubevirtExportProxy == "" { | ||
| return fmt.Errorf("%q is required", SAKubevirtExportProxy) | ||
| } | ||
| if s.SAKubevirtVirtHandler == "" { | ||
| return fmt.Errorf("%q is required", SAKubevirtVirtHandler) | ||
| } | ||
| if s.SAKubevirtOperator == "" { | ||
| return fmt.Errorf("%q is required", SAKubevirtOperator) | ||
| } | ||
| if s.SAVirtualizationController == "" { | ||
| return fmt.Errorf("%q is required", SAVirtualizationController) | ||
| } | ||
| if s.SAVirtualizationAPI == "" { | ||
| return fmt.Errorf("%q is required", SAVirtualizationAPI) | ||
| } | ||
| if s.SAVirtualizationPpeDeleteHook == "" { | ||
| return fmt.Errorf("%q is required", SAVirtualizationPpeDeleteHook) | ||
| } | ||
| if s.SAVmRouteForge == "" { | ||
| return fmt.Errorf("%q is required", SAVmRouteForge) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func LoadServiceAccounts() (ServiceAccounts, error) { | ||
| serviceAccounts := ServiceAccounts{ | ||
| SACDIApiserver: os.Getenv(SACDIApiserver), | ||
| SACDICronjob: os.Getenv(SACDICronjob), | ||
| SACDIOperator: os.Getenv(SACDIOperator), | ||
| SACDISa: os.Getenv(SACDISa), | ||
| SACDIUploadProxy: os.Getenv(SACDIUploadProxy), | ||
| SAKubevirtApiserver: os.Getenv(SAKubevirtApiserver), | ||
| SAKubevirtController: os.Getenv(SAKubevirtController), | ||
| SAKubevirtExportProxy: os.Getenv(SAKubevirtExportProxy), | ||
| SAKubevirtVirtHandler: os.Getenv(SAKubevirtVirtHandler), | ||
| SAKubevirtOperator: os.Getenv(SAKubevirtOperator), | ||
| SAVirtualizationController: os.Getenv(SAVirtualizationController), | ||
| SAVirtualizationAPI: os.Getenv(SAVirtualizationAPI), | ||
| SAVirtualizationPpeDeleteHook: os.Getenv(SAVirtualizationPpeDeleteHook), | ||
| SAVmRouteForge: os.Getenv(SAVmRouteForge), | ||
| } | ||
| if err := serviceAccounts.Validate(); err != nil { | ||
| return ServiceAccounts{}, err | ||
| } | ||
| return serviceAccounts, nil | ||
| } |
46 changes: 46 additions & 0 deletions
46
images/virtualization-artifact/pkg/controller/webhook/protect.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package webhook | ||
|
|
||
| import ( | ||
| "context" | ||
| "slices" | ||
|
|
||
| admissionv1 "k8s.io/api/admission/v1" | ||
| virtcore "kubevirt.io/api/core" | ||
| cdicore "kubevirt.io/containerized-data-importer-api/pkg/apis/core" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| ) | ||
|
|
||
| const ProtectResourcesPath = "/protect-resources" | ||
|
|
||
| var defaultProtectGroups = []string{ | ||
| virtcore.GroupName, | ||
| cdicore.GroupName, | ||
| } | ||
|
|
||
| func newProtectHook(allowSA []string, groups []string) *protectHook { | ||
| return &protectHook{ | ||
| allowSA: allowSA, | ||
| groups: groups, | ||
| operations: []admissionv1.Operation{ | ||
| admissionv1.Create, | ||
| admissionv1.Update, | ||
| admissionv1.Delete, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| type protectHook struct { | ||
| allowSA []string | ||
| groups []string | ||
| operations []admissionv1.Operation | ||
| } | ||
|
|
||
| func (p protectHook) Handle(_ context.Context, req admission.Request) admission.Response { | ||
| if slices.Contains(p.groups, req.Resource.Group) && | ||
| !slices.Contains(p.allowSA, req.UserInfo.Username) && | ||
| slices.Contains(p.operations, req.Operation) { | ||
| return admission.Denied("Operation forbidden for this service account.") | ||
| } | ||
|
|
||
| return admission.Allowed("") | ||
| } |
24 changes: 24 additions & 0 deletions
24
images/virtualization-artifact/pkg/controller/webhook/webhook.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package webhook | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "sigs.k8s.io/controller-runtime/pkg/manager" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook" | ||
|
|
||
| appconfig "github.com/deckhouse/virtualization-controller/pkg/config" | ||
| ) | ||
|
|
||
| func SetupHTTPHooks(mgr manager.Manager, serviceAccounts appconfig.ServiceAccounts) { | ||
| saNames := serviceAccounts.ToList() | ||
|
|
||
| var hooks = map[string]http.Handler{ | ||
| ProtectResourcesPath: &webhook.Admission{Handler: newProtectHook(saNames, defaultProtectGroups)}, | ||
| } | ||
|
|
||
| ws := mgr.GetWebhookServer() | ||
|
|
||
| for path, hook := range hooks { | ||
| ws.Register(path, hook) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters