This is an automated email from the ASF dual-hosted git repository.
albumenj pushed a commit to branch refactor-with-go
in repository https://gitbox.apache.org/repos/asf/dubbo-admin.git
The following commit(s) were added to refs/heads/refactor-with-go by this push:
new bf819cb6 Support authorization type (#1018)
bf819cb6 is described below
commit bf819cb6c00f017819a798c3da0c6adde36e4ba6
Author: Albumen Kevin <[email protected]>
AuthorDate: Tue Mar 7 17:43:21 2023 +0800
Support authorization type (#1018)
---
deploy/docker/authority/Dockerfile | 4 ++++
pkg/authority/k8s/client.go | 29 ++++++++++++++++++---------
pkg/authority/patch/javasdk.go | 10 +++++++++
pkg/authority/patch/javasdk_test.go | 10 ++++++++-
pkg/authority/rule/authorization/rule_test.go | 20 +++++++++++++-----
pkg/authority/security/server.go | 20 +++++++++---------
pkg/authority/v1alpha1/certificate_test.go | 2 +-
pkg/authority/v1alpha1/tools.go | 9 ++++++++-
8 files changed, 77 insertions(+), 27 deletions(-)
diff --git a/deploy/docker/authority/Dockerfile
b/deploy/docker/authority/Dockerfile
index 184c02e2..bda56999 100644
--- a/deploy/docker/authority/Dockerfile
+++ b/deploy/docker/authority/Dockerfile
@@ -25,6 +25,8 @@ WORKDIR /workspace/cmd/authority
# go build -buildmode=pie -ldflags "-linkmode external -extldflags -static
-w" \
# -o /workspace/ca
+RUN go install github.com/go-delve/delve/cmd/dlv@latest
+
RUN --mount=type=cache,target=/go \
go build \
-o /workspace/cmd/authority/authority
@@ -35,5 +37,7 @@ EXPOSE 30060
EXPOSE 30062
COPY --from=builder /workspace/cmd/authority/authority /authority
+COPY --from=builder /go/bin/dlv /
CMD ["/authority"]
+#CMD ["/dlv", "--listen=:40000", "--headless=true", "--api-version=2",
"--accept-multiclient", "exec", "/authority"]
diff --git a/pkg/authority/k8s/client.go b/pkg/authority/k8s/client.go
index a960006a..18f8785a 100644
--- a/pkg/authority/k8s/client.go
+++ b/pkg/authority/k8s/client.go
@@ -48,7 +48,7 @@ type Client interface {
GetAuthorityCert(namespace string) (string, string)
UpdateAuthorityCert(cert string, pri string, namespace string)
UpdateAuthorityPublicKey(cert string) bool
- VerifyServiceAccount(token string) (*rule.Endpoint, bool)
+ VerifyServiceAccount(token string, authorizationType string)
(*rule.Endpoint, bool)
UpdateWebhookConfig(options *config.Options, storage cert.Storage)
GetNamespaceLabels(namespace string) map[string]string
InitController(paHandler authentication.Handler, apHandler
authorization.Handler)
@@ -198,19 +198,30 @@ func (c *ClientImpl) GetNamespaceLabels(namespace string)
map[string]string {
return map[string]string{}
}
-func (c *ClientImpl) VerifyServiceAccount(token string) (*rule.Endpoint, bool)
{
- tokenReview := &k8sauth.TokenReview{
- Spec: k8sauth.TokenReviewSpec{
- Token: token,
- // Audiences: []string{"dubbo-ca"},
- },
+func (c *ClientImpl) VerifyServiceAccount(token string, authorizationType
string) (*rule.Endpoint, bool) {
+ var tokenReview *k8sauth.TokenReview
+ if authorizationType == "dubbo-ca-token" {
+ tokenReview = &k8sauth.TokenReview{
+ Spec: k8sauth.TokenReviewSpec{
+ Token: token,
+ Audiences: []string{"dubbo-ca"},
+ },
+ }
+ } else {
+ tokenReview = &k8sauth.TokenReview{
+ Spec: k8sauth.TokenReviewSpec{
+ Token: token,
+ },
+ }
}
- reviewRes, err :=
c.kubeClient.AuthenticationV1().TokenReviews().Create(context.TODO(),
tokenReview, metav1.CreateOptions{})
+
+ reviewRes, err := c.kubeClient.AuthenticationV1().TokenReviews().Create(
+ context.TODO(), tokenReview, metav1.CreateOptions{})
if err != nil {
logger.Sugar().Warnf("Failed to validate token. " + err.Error())
return nil, false
}
- // TODO support aud
+
if reviewRes.Status.Error != "" {
logger.Sugar().Warnf("Failed to validate token. " +
reviewRes.Status.Error)
return nil, false
diff --git a/pkg/authority/patch/javasdk.go b/pkg/authority/patch/javasdk.go
index 3e57f6f3..5f3a00aa 100644
--- a/pkg/authority/patch/javasdk.go
+++ b/pkg/authority/patch/javasdk.go
@@ -90,14 +90,20 @@ func (s *JavaSdk) injectContainers(c *v1.Container) {
Name: "DUBBO_OIDC_TOKEN",
Value: "/var/run/secrets/dubbo-ca-token/token",
})
+ c.Env = append(c.Env, v1.EnvVar{
+ Name: "DUBBO_OIDC_TOKEN_TYPE",
+ Value: "dubbo-ca-token",
+ })
c.VolumeMounts = append(c.VolumeMounts, v1.VolumeMount{
Name: "dubbo-ca-token",
MountPath: "/var/run/secrets/dubbo-ca-token",
+ ReadOnly: true,
})
c.VolumeMounts = append(c.VolumeMounts, v1.VolumeMount{
Name: "dubbo-ca-cert",
MountPath: "/var/run/secrets/dubbo-ca-cert",
+ ReadOnly: true,
})
}
@@ -156,6 +162,10 @@ func (s *JavaSdk) checkContainers(c v1.Container,
shouldInject bool) bool {
shouldInject = false
break
}
+ if e.Name == "DUBBO_OIDC_TOKEN_TYPE" {
+ shouldInject = false
+ break
+ }
}
for _, m := range c.VolumeMounts {
diff --git a/pkg/authority/patch/javasdk_test.go
b/pkg/authority/patch/javasdk_test.go
index f9500946..4fd7662f 100644
--- a/pkg/authority/patch/javasdk_test.go
+++ b/pkg/authority/patch/javasdk_test.go
@@ -282,7 +282,7 @@ func checkContainer(t *testing.T, container v1.Container) {
t.Error("should have test container")
}
- if len(container.Env) != 3 {
+ if len(container.Env) != 4 {
t.Error("should have 3 env")
}
@@ -310,6 +310,14 @@ func checkContainer(t *testing.T, container v1.Container) {
t.Error("should have /var/run/secrets/dubbo-ca-token/token
value")
}
+ if container.Env[3].Name != "DUBBO_OIDC_TOKEN_TYPE" {
+ t.Error("should have DUBBO_OIDC_TOKEN_TYPE env")
+ }
+
+ if container.Env[3].Value != "dubbo-ca-token" {
+ t.Error("should have dubbo-ca-token value")
+ }
+
if len(container.VolumeMounts) != 2 {
t.Error("should have 2 volume mounts")
}
diff --git a/pkg/authority/rule/authorization/rule_test.go
b/pkg/authority/rule/authorization/rule_test.go
index 9f79ecc9..c336b464 100644
--- a/pkg/authority/rule/authorization/rule_test.go
+++ b/pkg/authority/rule/authorization/rule_test.go
@@ -16,8 +16,11 @@
package authorization_test
import (
+ "encoding/json"
"testing"
+ "github.com/stretchr/testify/assert"
+
"github.com/apache/dubbo-admin/pkg/authority/rule"
"github.com/apache/dubbo-admin/pkg/authority/rule/authorization"
"github.com/apache/dubbo-admin/pkg/authority/rule/connection"
@@ -65,12 +68,14 @@ func TestRule(t *testing.T) {
t.Error("expected toClient data to be [{\"spec\":null}], got "
+ toClient.Data())
}
- handler.Add("test2", &authorization.Policy{
+ policy := &authorization.Policy{
Name: "test2",
Spec: &authorization.PolicySpec{
Action: "ALLOW",
},
- })
+ }
+
+ handler.Add("test2", policy)
originRule = storage.LatestRules[authorization.RuleType]
@@ -103,7 +108,12 @@ func TestRule(t *testing.T) {
t.Error("expected toClient revision to be 2")
}
- if toClient.Data() !=
`[{"spec":null},{"name":"test2","spec":{"action":"ALLOW"}}]` {
- t.Error("expected toClient data to be
[{\"spec\":null},{\"name\":\"test2\",\"spec\":{\"action\":\"ALLOW\"}}], got " +
toClient.Data())
- }
+ target := []*authorization.Policy{}
+
+ err = json.Unmarshal([]byte(toClient.Data()), &target)
+ assert.Nil(t, err)
+ assert.Equal(t, 2, len(target))
+
+ assert.Contains(t, target, &authorization.Policy{})
+ assert.Contains(t, target, policy)
}
diff --git a/pkg/authority/security/server.go b/pkg/authority/security/server.go
index 771f3313..f1b5b937 100644
--- a/pkg/authority/security/server.go
+++ b/pkg/authority/security/server.go
@@ -222,22 +222,22 @@ func (s *Server) RefreshAuthorityCert() {
}
func (s *Server) Start() {
- lis, err := net.Listen("tcp",
":"+strconv.Itoa(s.Options.PlainServerPort))
- if err != nil {
- log.Fatal(err)
- }
go func() {
- err := s.PlainServer.Serve(lis)
+ lis, err := net.Listen("tcp",
":"+strconv.Itoa(s.Options.PlainServerPort))
+ if err != nil {
+ log.Fatal(err)
+ }
+ err = s.PlainServer.Serve(lis)
if err != nil {
log.Fatal(err)
}
}()
- lis, err = net.Listen("tcp",
":"+strconv.Itoa(s.Options.SecureServerPort))
- if err != nil {
- log.Fatal(err)
- }
go func() {
- err := s.SecureServer.Serve(lis)
+ lis, err := net.Listen("tcp",
":"+strconv.Itoa(s.Options.SecureServerPort))
+ if err != nil {
+ log.Fatal(err)
+ }
+ err = s.SecureServer.Serve(lis)
if err != nil {
log.Fatal(err)
}
diff --git a/pkg/authority/v1alpha1/certificate_test.go
b/pkg/authority/v1alpha1/certificate_test.go
index 9fe71375..086cb00c 100644
--- a/pkg/authority/v1alpha1/certificate_test.go
+++ b/pkg/authority/v1alpha1/certificate_test.go
@@ -33,7 +33,7 @@ type MockKubeClient struct {
k8s.Client
}
-func (c MockKubeClient) VerifyServiceAccount(token string) (*rule.Endpoint,
bool) {
+func (c MockKubeClient) VerifyServiceAccount(token string, authorizationType
string) (*rule.Endpoint, bool) {
return nil, "expceted-token" == token
}
diff --git a/pkg/authority/v1alpha1/tools.go b/pkg/authority/v1alpha1/tools.go
index 272a0668..3b2ce8a6 100644
--- a/pkg/authority/v1alpha1/tools.go
+++ b/pkg/authority/v1alpha1/tools.go
@@ -45,7 +45,14 @@ func exactEndpoint(c context.Context, options
*config.Options, kubeClient k8s.Cl
token := strings.ReplaceAll(authorization[0], "Bearer ", "")
- endpoint, ok := kubeClient.VerifyServiceAccount(token)
+ authorizationTypes, ok := md["authorization-type"]
+ authorizationType := "kubernetes"
+
+ if ok && len(authorizationTypes) == 1 {
+ authorizationType = authorizationTypes[0]
+ }
+
+ endpoint, ok := kubeClient.VerifyServiceAccount(token,
authorizationType)
if !ok {
return nil, fmt.Errorf("failed to verify Authorization
header from kubernetes")
}
