hendrik/lens
1
0
Fork 0
mirror of https://github.com/lensapp/lens.git synced 2025-05-20 05:10:56 +00:00
Code Issues Projects Releases Wiki Activity

Refactoring of AuthorizationNamespaceReview

Browse Source 
Signed-off-by: Sebastian Malton <sebastian@malton.name>
This commit is contained in:
Sebastian Malton 2022-11-25 12:24:29 -05:00
parent 420bbfd23f
commit 78a4177621
1 changed files with 57 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
src/common/cluster/authorization-namespace-review.injectable.ts
View File

@ -6,7 +6,6 @@
import type { KubeConfig } from "@kubernetes/client-node"; import type { KubeConfig } from "@kubernetes/client-node";
import { AuthorizationV1Api } from "@kubernetes/client-node"; import { AuthorizationV1Api } from "@kubernetes/client-node";
import { getInjectable } from "@ogre-tools/injectable"; import { getInjectable } from "@ogre-tools/injectable";
import type { Logger } from "../logger";
import loggerInjectable from "../logger.injectable"; import loggerInjectable from "../logger.injectable";
import type { KubeApiResource } from "../rbac"; import type { KubeApiResource } from "../rbac";
@ -23,54 +22,60 @@ export type RequestNamespaceResources = (namespace: string, availableResources:
*/ */
export type AuthorizationNamespaceReview = (proxyConfig: KubeConfig) => RequestNamespaceResources; export type AuthorizationNamespaceReview = (proxyConfig: KubeConfig) => RequestNamespaceResources;
interface Dependencies { const authorizationNamespaceReviewInjectable = getInjectable({
logger: Logger; id: "authorization-namespace-review",
} instantiate: (di): AuthorizationNamespaceReview => {
const logger = di.inject(loggerInjectable);
const authorizationNamespaceReview = ({ logger }: Dependencies): AuthorizationNamespaceReview => {
return (proxyConfig) => { return (proxyConfig) => {
const api = proxyConfig.makeApiClient(AuthorizationV1Api); const api = proxyConfig.makeApiClient(AuthorizationV1Api);
return async (namespace, availableResources) => { return async (namespace, availableResources) => {
try { try {
const { body } = await api.createSelfSubjectRulesReview({ const { body: { status }} = await api.createSelfSubjectRulesReview({
apiVersion: "authorization.k8s.io/v1", apiVersion: "authorization.k8s.io/v1",
kind: "SelfSubjectRulesReview", kind: "SelfSubjectRulesReview",
spec: { namespace }, spec: { namespace },
}); });
const resources = new Set<string>(); const allowedResources = new Set<string>();
if (!body.status || body.status.incomplete) { if (!status || status.incomplete) {
logger.warn(`[AUTHORIZATION-NAMESPACE-REVIEW]: allowing all resources in namespace="${namespace}" due to incomplete SelfSubjectRulesReview: ${body.status?.evaluationError}`); logger.warn(`[AUTHORIZATION-NAMESPACE-REVIEW]: allowing all resources in namespace="${namespace}" due to incomplete SelfSubjectRulesReview: ${status?.evaluationError}`);
return availableResources.map(r => r.apiName); return availableResources.map(r => r.apiName);
} }
body.status.resourceRules.forEach(resourceRule => { for (const { verbs, resources, apiGroups } of status.resourceRules) {
if (!resourceRule.verbs.some(verb => ["*", "list"].includes(verb)) || !resourceRule.resources) { if (
return; !resources
|| (!verbs.includes("*") && !verbs.includes("list"))
) {
continue;
} }
const apiGroups = resourceRule.apiGroups; if (resources[0] !== "*" || !apiGroups) {
for (const resource of resources) {
allowedResources.add(resource);
}
continue;
}
if (resourceRule.resources.length === 1 && resourceRule.resources[0] === "*" && apiGroups) {
if (apiGroups[0] === "*") { if (apiGroups[0] === "*") {
availableResources.forEach(resource => resources.add(resource.apiName)); for (const resource of availableResources) {
} else { allowedResources.add(resource.apiName);
availableResources.forEach((apiResource)=> {
if (apiGroups.includes(apiResource.group || "")) {
resources.add(apiResource.apiName);
} }
}); continue;
} }
} else {
resourceRule.resources.forEach(resource => resources.add(resource));
}
});
return [...resources]; for (const resource of availableResources) {
if (apiGroups.includes(resource.group || "")) {
allowedResources.add(resource.apiName);
}
}
}
return [...allowedResources];
} catch (error) { } catch (error) {
logger.error(`[AUTHORIZATION-NAMESPACE-REVIEW]: failed to create subject rules review: ${error}`, { namespace }); logger.error(`[AUTHORIZATION-NAMESPACE-REVIEW]: failed to create subject rules review: ${error}`, { namespace });
@ -78,14 +83,6 @@ const authorizationNamespaceReview = ({ logger }: Dependencies): AuthorizationNa
} }
}; };
}; };
};
const authorizationNamespaceReviewInjectable = getInjectable({
id: "authorization-namespace-review",
instantiate: (di) => {
const logger = di.inject(loggerInjectable);
return authorizationNamespaceReview({ logger });
}, },
}); });