@@ -22,16 +22,53 @@ import (
2222 userclient "github.com/openshift/client-go/user/clientset/versioned"
2323 userinformer "github.com/openshift/client-go/user/informers/externalversions"
2424 "github.com/openshift/library-go/pkg/apiserver/admission/admissionrestconfig"
25+ "github.com/openshift/library-go/pkg/config/helpers"
26+ "k8s.io/kubernetes/openshift-kube-apiserver/admission/authorization/apis/restrictusers/v1alpha1"
2527 "k8s.io/kubernetes/openshift-kube-apiserver/admission/authorization/restrictusers/usercache"
2628)
2729
2830func Register (plugins * admission.Plugins ) {
2931 plugins .Register ("authorization.openshift.io/RestrictSubjectBindings" ,
3032 func (config io.Reader ) (admission.Interface , error ) {
31- return NewRestrictUsersAdmission ()
33+ cfg , err := readConfig (config )
34+ if err != nil {
35+ return nil , err
36+ }
37+
38+ return NewRestrictUsersAdmission (cfg )
3239 })
3340}
3441
42+ func defaultConfig () * v1alpha1.RestrictSubjectBindingsAdmissionConfig {
43+ return & v1alpha1.RestrictSubjectBindingsAdmissionConfig {
44+ OpenShiftOAuthDesiredState : v1alpha1 .OpenShiftOAuthStateDesired ,
45+ }
46+ }
47+
48+ func readConfig (reader io.Reader ) (* v1alpha1.RestrictSubjectBindingsAdmissionConfig , error ) {
49+ obj , err := helpers .ReadYAMLToInternal (reader , v1alpha1 .Install )
50+ if err != nil {
51+ return nil , err
52+ }
53+ if obj == nil {
54+ return nil , nil
55+ }
56+ config , ok := obj .(* v1alpha1.RestrictSubjectBindingsAdmissionConfig )
57+ if ! ok {
58+ return nil , fmt .Errorf ("unexpected config object: %#v" , obj )
59+ }
60+
61+ // validate config
62+ switch config .OpenShiftOAuthDesiredState {
63+ case v1alpha1 .OpenShiftOAuthStateDesired , v1alpha1 .OpenShiftOAuthStateNotDesired :
64+ // valid, do nothing
65+ default :
66+ return nil , fmt .Errorf ("config is invalid, openshiftOAuthDesiredState must be one of Desired,NotDesired but was %s" , config .OpenShiftOAuthDesiredState )
67+ }
68+
69+ return config , nil
70+ }
71+
3572type GroupCache interface {
3673 GroupsFor (string ) ([]* userv1.Group , error )
3774 HasSynced () bool
@@ -46,8 +83,8 @@ type restrictUsersAdmission struct {
4683 roleBindingRestrictionsGetter authorizationtypedclient.RoleBindingRestrictionsGetter
4784 userClient userclient.Interface
4885 kubeClient kubernetes.Interface
49- groupCacheFunc func () (GroupCache , error )
5086 groupCache GroupCache
87+ oauthState v1alpha1.OpenShiftOAuthState
5188}
5289
5390var (
5996
6097// NewRestrictUsersAdmission configures an admission plugin that enforces
6198// restrictions on adding role bindings in a project.
62- func NewRestrictUsersAdmission () (admission.Interface , error ) {
99+ func NewRestrictUsersAdmission (cfg * v1alpha1. RestrictSubjectBindingsAdmissionConfig ) (admission.Interface , error ) {
63100 return & restrictUsersAdmission {
64101 Handler : admission .NewHandler (admission .Create , admission .Update ),
102+ oauthState : func () v1alpha1.OpenShiftOAuthState {
103+ if cfg != nil {
104+ return cfg .OpenShiftOAuthDesiredState
105+ }
106+ return v1alpha1 .OpenShiftOAuthStateDesired
107+ }(),
65108 }, nil
66109}
67110
@@ -91,18 +134,16 @@ func (q *restrictUsersAdmission) SetRESTClientConfig(restClientConfig rest.Confi
91134}
92135
93136func (q * restrictUsersAdmission ) SetUserInformer (userInformers userinformer.SharedInformerFactory ) {
94- // defer the allocation of the group cache until later in the process so we can
95- // ensure we aren't creating informers for the Group resources until this admission
96- // plugin actually runs. If authentication type is OIDC, this plugin should be disabled
97- // resulting in the Group informer never being configured and started.
98- q .groupCacheFunc = func () (GroupCache , error ) {
99- if err := userInformers .User ().V1 ().Groups ().Informer ().AddIndexers (cache.Indexers {
100- usercache .ByUserIndexName : usercache .ByUserIndexKeys ,
101- }); err != nil {
102- return nil , err
103- }
104- return usercache .NewGroupCache (userInformers .User ().V1 ().Groups ()), nil
137+ if q .oauthState == v1alpha1 .OpenShiftOAuthStateNotDesired {
138+ return
139+ }
140+
141+ if err := userInformers .User ().V1 ().Groups ().Informer ().AddIndexers (cache.Indexers {
142+ usercache .ByUserIndexName : usercache .ByUserIndexKeys ,
143+ }); err != nil {
144+ return
105145 }
146+ q .groupCache = usercache .NewGroupCache (userInformers .User ().V1 ().Groups ())
106147}
107148
108149// subjectsDelta returns the relative complement of elementsToIgnore in
@@ -201,13 +242,6 @@ func (q *restrictUsersAdmission) Validate(ctx context.Context, a admission.Attri
201242 checkers = append (checkers , checker )
202243 }
203244
204- if q .groupCache == nil && q .groupCacheFunc != nil {
205- q .groupCache , err = q .groupCacheFunc ()
206- if err != nil {
207- return admission .NewForbidden (a , fmt .Errorf ("could not create group cache: %v" , err ))
208- }
209- }
210-
211245 roleBindingRestrictionContext , err := newRoleBindingRestrictionContext (ns ,
212246 q .kubeClient , q .userClient .UserV1 (), q .groupCache )
213247 if err != nil {
@@ -247,7 +281,7 @@ func (q *restrictUsersAdmission) ValidateInitialization() error {
247281 if q .userClient == nil {
248282 return errors .New ("RestrictUsersAdmission plugin requires an OpenShift user client" )
249283 }
250- if q .groupCache == nil && q .groupCacheFunc == nil {
284+ if q .groupCache == nil && q .oauthState == v1alpha1 . OpenShiftOAuthStateDesired {
251285 return errors .New ("RestrictUsersAdmission plugin requires a group cache" )
252286 }
253287
0 commit comments