Skip to content
This repository has been archived by the owner on Oct 12, 2023. It is now read-only.

Whitelisting #310

Merged
merged 7 commits into from
Jul 26, 2019
Merged

Whitelisting #310

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
00a44f6
generate deepcopy functions + define new crd
aramase Jul 25, 2019
ee46dd5
add crd to known types
aramase Jul 25, 2019
c36a46a
changes to proxy if label in exception
aramase Jul 25, 2019
c0f9e6c
remove image changes
aramase Jul 25, 2019
a8e2e1b
add e2e tests
aramase Jul 26, 2019
46325a8
update fn name
aramase Jul 26, 2019
ee03e9a
fix typo in fn name
aramase Jul 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ build: clean build-nmi build-mic build-demo build-identity-validator

.PHONY: deepcopy-gen
deepcopy-gen:
deepcopy-gen -i ./pkg/apis/aadpodidentity/v1/ -o ../../../ -O aadpodidentity_deepcopy_generated -p aadpodidentity
deepcopy-gen -i ./pkg/apis/aadpodidentity/v1/ -o . -O aadpodidentity_deepcopy_generated -p aadpodidentity

.PHONY: image-nmi
image-nmi:
Expand Down
2 changes: 1 addition & 1 deletion deploy/infra/deployment-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,4 +203,4 @@ spec:
hostPath:
path: /etc/kubernetes/azure.json
nodeSelector:
beta.kubernetes.io/os: linux
beta.kubernetes.io/os: linux
134 changes: 110 additions & 24 deletions pkg/apis/aadpodidentity/v1/aadpodidentity_deepcopy_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

41 changes: 38 additions & 3 deletions pkg/apis/aadpodidentity/v1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,18 @@ type AzureAssignedIdentity struct {
Status AzureAssignedIdentityStatus `json:"Status"`
}

//AzurePodIdentityException contains the pod selectors for all pods that don't require
// NMI to process and request token on their behalf.

//+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add a README under the readme directory on how ExceptionList can be used.

type AzurePodIdentityException struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`

Spec AzurePodIdentityExceptionSpec `json:"spec"`
Status AzurePodIdentityExceptionStatus `json:"Status"`
}

/*** Lists ***/
//+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
type AzureIdentityList struct {
Expand All @@ -95,6 +107,14 @@ type AzureAssignedIdentityList struct {
Items []AzureAssignedIdentity `json:"items"`
}

//+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
type AzurePodIdentityExceptionList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata"`

Items []AzurePodIdentityException `json:"items"`
}

/*** AzureIdentity ***/
//+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
type IdentityType int
Expand Down Expand Up @@ -150,9 +170,10 @@ const (
)

const (
AzureIDResource = "azureidentities"
AzureIDBindingResource = "azureidentitybindings"
AzureAssignedIDResource = "azureassignedidentities"
AzureIDResource = "azureidentities"
AzureIDBindingResource = "azureidentitybindings"
AzureAssignedIDResource = "azureassignedidentities"
AzureIdentityExceptionResource = "azurepodidentityexceptions"
)

// AzureIdentityBindingSpec matches the pod with the Identity.
Expand Down Expand Up @@ -191,3 +212,17 @@ type AzureAssignedIdentityStatus struct {
Status string `json:"status"`
AvailableReplicas int32 `json:"availableReplicas"`
}

// AzurePodIdentityExceptionSpec matches pods with the selector defined.
// If request originates from a pod that matches the selector, nmi will
// proxy the request and send response back without any validation.
type AzurePodIdentityExceptionSpec struct {
metav1.ObjectMeta `json:"metadata,omitempty"`
PodLabels map[string]string `json:"podLabels"`
}

// AzurePodIdentityExceptionStatus ...
type AzurePodIdentityExceptionStatus struct {
metav1.ObjectMeta `json:"metadata,omitempty"`
Status string `json:"status"`
}
58 changes: 49 additions & 9 deletions pkg/crd/crd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,18 @@ import (
"k8s.io/client-go/tools/cache"
)

// Client represents all the watchers and informers
type Client struct {
rest *rest.RESTClient
BindingListWatch *cache.ListWatch
BindingInformer cache.SharedInformer
IDListWatch *cache.ListWatch
IDInformer cache.SharedInformer
AssignedIDListWatch *cache.ListWatch
rest *rest.RESTClient
BindingListWatch *cache.ListWatch
BindingInformer cache.SharedInformer
IDListWatch *cache.ListWatch
IDInformer cache.SharedInformer
AssignedIDListWatch *cache.ListWatch
PodIdentityExceptionListWatch *cache.ListWatch
}

// ClientInt ...
type ClientInt interface {
Start(exit <-chan struct{})
SyncCache(exit <-chan struct{})
Expand All @@ -39,8 +42,10 @@ type ClientInt interface {
ListAssignedIDs() (res *[]aadpodid.AzureAssignedIdentity, err error)
ListIds() (res *[]aadpodid.AzureIdentity, err error)
ListPodIds(podns, podname string) (map[string][]aadpodid.AzureIdentity, error)
ListPodIdentityExceptions(ns string) (res *[]aadpodid.AzurePodIdentityException, err error)
}

// NewCRDClientLite ...
func NewCRDClientLite(config *rest.Config) (crdClient *Client, err error) {
restClient, err := newRestClient(config)
if err != nil {
Expand All @@ -49,13 +54,16 @@ func NewCRDClientLite(config *rest.Config) (crdClient *Client, err error) {
}

assignedIDListWatch := newAssignedIDListWatch(restClient)
podIdentityExceptionListWatch := newPodIdentityExceptionListWatch(restClient)

return &Client{
AssignedIDListWatch: assignedIDListWatch,
rest: restClient,
AssignedIDListWatch: assignedIDListWatch,
PodIdentityExceptionListWatch: podIdentityExceptionListWatch,
rest: restClient,
}, nil
}

// NewCRDClient returns a new crd client and error if any
func NewCRDClient(config *rest.Config, eventCh chan aadpodid.EventType) (crdClient *Client, err error) {
restClient, err := newRestClient(config)
if err != nil {
Expand Down Expand Up @@ -103,7 +111,10 @@ func newRestClient(config *rest.Config) (r *rest.RESTClient, err error) {
&aadpodid.AzureIdentityBinding{},
&aadpodid.AzureIdentityBindingList{},
&aadpodid.AzureAssignedIdentity{},
&aadpodid.AzureAssignedIdentityList{})
&aadpodid.AzureAssignedIdentityList{},
&aadpodid.AzurePodIdentityException{},
&aadpodid.AzurePodIdentityExceptionList{},
)
crdconfig.NegotiatedSerializer = serializer.DirectCodecFactory{
CodecFactory: serializer.NewCodecFactory(s)}

Expand Down Expand Up @@ -182,12 +193,24 @@ func newAssignedIDListWatch(r *rest.RESTClient) *cache.ListWatch {
return cache.NewListWatchFromClient(r, aadpodid.AzureAssignedIDResource, v1.NamespaceAll, fields.Everything())
}

func newPodIdentityExceptionListWatch(r *rest.RESTClient) *cache.ListWatch {
optionsModifier := func(options *v1.ListOptions) {}
return cache.NewFilteredListWatchFromClient(
r,
aadpodid.AzureIdentityExceptionResource,
v1.NamespaceAll,
optionsModifier,
)
}

// Start ...
func (c *Client) Start(exit <-chan struct{}) {
go c.BindingInformer.Run(exit)
go c.IDInformer.Run(exit)
glog.Info("CRD watchers started")
}

// SyncCache synchronizes cache
func (c *Client) SyncCache(exit <-chan struct{}) {
if !cache.WaitForCacheSync(exit) {
panic("Cache could not be synchronized")
Expand Down Expand Up @@ -223,6 +246,7 @@ func (c *Client) CreateAssignedIdentity(assignedIdentity *aadpodid.AzureAssigned
return nil
}

// ListBindings returns a list of azureidentitybindings
func (c *Client) ListBindings() (res *[]aadpodid.AzureIdentityBinding, err error) {
begin := time.Now()

Expand All @@ -235,6 +259,7 @@ func (c *Client) ListBindings() (res *[]aadpodid.AzureIdentityBinding, err error
return &ret.(*aadpodid.AzureIdentityBindingList).Items, nil
}

// ListAssignedIDs returns a list of azureassignedidentities
func (c *Client) ListAssignedIDs() (res *[]aadpodid.AzureAssignedIdentity, err error) {
begin := time.Now()
ret, err := c.AssignedIDListWatch.List(v1.ListOptions{})
Expand All @@ -246,6 +271,7 @@ func (c *Client) ListAssignedIDs() (res *[]aadpodid.AzureAssignedIdentity, err e
return &ret.(*aadpodid.AzureAssignedIdentityList).Items, nil
}

// ListIds returns a list of azureidentities
func (c *Client) ListIds() (res *[]aadpodid.AzureIdentity, err error) {
begin := time.Now()
ret, err := c.IDListWatch.List(v1.ListOptions{})
Expand All @@ -257,6 +283,20 @@ func (c *Client) ListIds() (res *[]aadpodid.AzureIdentity, err error) {
return &ret.(*aadpodid.AzureIdentityList).Items, nil
}

// ListPodIdentityExceptions returns list of azurepodidentityexceptions
func (c *Client) ListPodIdentityExceptions(ns string) (res *[]aadpodid.AzurePodIdentityException, err error) {
begin := time.Now()
ret, err := c.PodIdentityExceptionListWatch.List(v1.ListOptions{
FieldSelector: "metadata.namespace=" + ns,
})
if err != nil {
glog.Error(err)
return nil, err
}
stats.Update(stats.ExceptionList, time.Since(begin))
return &ret.(*aadpodid.AzurePodIdentityExceptionList).Items, nil
}

// ListPodIds - given a pod with pod name space
// returns a map with list of azure identities in each state
func (c *Client) ListPodIds(podns, podname string) (map[string][]aadpodid.AzureIdentity, error) {
Expand Down
Loading