openshift
diff --git a/‎openshift-kube-apiserver/admission/admissionenablement/admission.go
+15 b/‎openshift-kube-apiserver/admission/admissionenablement/admission.go
+15
diff --git a/‎openshift-kube-apiserver/admission/admissionenablement/admission_config.go
+51 b/‎openshift-kube-apiserver/admission/admissionenablement/admission_config.go
+51
diff --git a/‎openshift-kube-apiserver/admission/admissionenablement/register.go
+122 b/‎openshift-kube-apiserver/admission/admissionenablement/register.go
+122
diff --git a/‎openshift-kube-apiserver/admission/admissionenablement/register_test.go
+55 b/‎openshift-kube-apiserver/admission/admissionenablement/register_test.go
+55
diff --git a/‎openshift-kube-apiserver/admission/authorization/restrictusers/groupcache_test.go
+28 b/‎openshift-kube-apiserver/admission/authorization/restrictusers/groupcache_test.go
+28
diff --git a/‎openshift-kube-apiserver/admission/authorization/restrictusers/intializers.go
+28 b/‎openshift-kube-apiserver/admission/authorization/restrictusers/intializers.go
+28
@@ -0,0 +1,15 @@
+package admissionenablement
+
+import (
+	"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
+)
+
+func InstallOpenShiftAdmissionPlugins(o *options.ServerRunOptions) {
+	existingAdmissionOrder := o.Admission.GenericAdmission.RecommendedPluginOrder
+	o.Admission.GenericAdmission.RecommendedPluginOrder = NewOrderedKubeAdmissionPlugins(existingAdmissionOrder)
+	RegisterOpenshiftKubeAdmissionPlugins(o.Admission.GenericAdmission.Plugins)
+	customresourcevalidationregistration.RegisterCustomResourceValidation(o.Admission.GenericAdmission.Plugins)
+	existingDefaultOff := o.Admission.GenericAdmission.DefaultOffPlugins
+	o.Admission.GenericAdmission.DefaultOffPlugins = NewDefaultOffPluginsFunc(existingDefaultOff)()
+}
@@ -0,0 +1,51 @@
+package admissionenablement
+
+import (
+	"time"
+
+	"github.com/openshift/library-go/pkg/apiserver/admission/admissiontimeout"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/namespaceconditions"
+	controlplaneapiserver "k8s.io/kubernetes/pkg/controlplane/apiserver/options"
+)
+
+const disableSCCLevelLabel = "security.openshift.io/disable-securitycontextconstraints"
+
+var enforceSCCSelector labels.Selector
+
+func init() {
+	var err error
+	enforceSCCSelector, err = labels.Parse(disableSCCLevelLabel + " != true")
+	if err != nil {
+		panic(err)
+	}
+}
+
+func SetAdmissionDefaults(o *controlplaneapiserver.CompletedOptions, informers informers.SharedInformerFactory, kubeClient kubernetes.Interface) {
+	// set up the decorators we need.  This is done late and out of order because our decorators currently require informers which are not
+	// present until we start running
+	namespaceLabelDecorator := namespaceconditions.NamespaceLabelConditions{
+		NamespaceClient: kubeClient.CoreV1(),
+		NamespaceLister: informers.Core().V1().Namespaces().Lister(),
+
+		SkipLevelZeroNames: SkipRunLevelZeroPlugins,
+		SkipLevelOneNames:  SkipRunLevelOnePlugins,
+	}
+	sccLabelDecorator := namespaceconditions.NewConditionalAdmissionPlugins(
+		kubeClient.CoreV1(), informers.Core().V1().Namespaces().Lister(), enforceSCCSelector,
+		"security.openshift.io/SecurityContextConstraint", "security.openshift.io/SCCExecRestrictions")
+
+	o.Admission.GenericAdmission.Decorators = append(o.Admission.GenericAdmission.Decorators,
+		admission.Decorators{
+			// SCC can be skipped by setting a namespace label `security.openshift.io/disable-securitycontextconstraints = true`
+			// This is useful for disabling SCC and using PodSecurity admission instead.
+			admission.DecoratorFunc(sccLabelDecorator.WithNamespaceLabelSelector),
+
+			admission.DecoratorFunc(namespaceLabelDecorator.WithNamespaceLabelConditions),
+			admission.DecoratorFunc(admissiontimeout.AdmissionTimeout{Timeout: 13 * time.Second}.WithTimeout),
+		},
+	)
+}
@@ -0,0 +1,122 @@
+package admissionenablement
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/resourcequota"
+	mutatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating"
+
+	"github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy"
+	imagepolicyapiv1 "github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy/apis/imagepolicy/v1"
+	quotaclusterresourcequota "github.com/openshift/apiserver-library-go/pkg/admission/quota/clusterresourcequota"
+	"github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccadmission"
+	authorizationrestrictusers "k8s.io/kubernetes/openshift-kube-apiserver/admission/authorization/restrictusers"
+	quotaclusterresourceoverride "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/clusterresourceoverride"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managednode"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride"
+	quotarunonceduration "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/runonceduration"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/externalipranger"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/restrictedendpoints"
+	ingressadmission "k8s.io/kubernetes/openshift-kube-apiserver/admission/route"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/route/hostassignment"
+	projectnodeenv "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeenv"
+	schedulerpodnodeconstraints "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/podnodeconstraints"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/storage/csiinlinevolumesecurity"
+)
+
+func RegisterOpenshiftKubeAdmissionPlugins(plugins *admission.Plugins) {
+	authorizationrestrictusers.Register(plugins)
+	hostassignment.Register(plugins)
+	imagepolicy.Register(plugins)
+	ingressadmission.Register(plugins)
+	managementcpusoverride.Register(plugins)
+	managednode.Register(plugins)
+	projectnodeenv.Register(plugins)
+	quotaclusterresourceoverride.Register(plugins)
+	quotaclusterresourcequota.Register(plugins)
+	quotarunonceduration.Register(plugins)
+	schedulerpodnodeconstraints.Register(plugins)
+	sccadmission.Register(plugins)
+	sccadmission.RegisterSCCExecRestrictions(plugins)
+	externalipranger.RegisterExternalIP(plugins)
+	restrictedendpoints.RegisterRestrictedEndpoints(plugins)
+	csiinlinevolumesecurity.Register(plugins)
+}
+
+var (
+
+	// these are admission plugins that cannot be applied until after the kubeapiserver starts.
+	// TODO if nothing comes to mind in 3.10, kill this
+	SkipRunLevelZeroPlugins = sets.NewString()
+	// these are admission plugins that cannot be applied until after the openshiftapiserver apiserver starts.
+	SkipRunLevelOnePlugins = sets.NewString(
+		imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
+		"quota.openshift.io/ClusterResourceQuota",
+		"security.openshift.io/SecurityContextConstraint",
+		"security.openshift.io/SCCExecRestrictions",
+	)
+
+	// openshiftAdmissionPluginsForKubeBeforeMutating are the admission plugins to add after kube admission, before mutating webhooks
+	openshiftAdmissionPluginsForKubeBeforeMutating = []string{
+		"autoscaling.openshift.io/ClusterResourceOverride",
+		managementcpusoverride.PluginName, // "autoscaling.openshift.io/ManagementCPUsOverride"
+		"authorization.openshift.io/RestrictSubjectBindings",
+		"autoscaling.openshift.io/RunOnceDuration",
+		"scheduling.openshift.io/PodNodeConstraints",
+		"scheduling.openshift.io/OriginPodNodeEnvironment",
+		"network.openshift.io/ExternalIPRanger",
+		"network.openshift.io/RestrictedEndpointsAdmission",
+		imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
+		"security.openshift.io/SecurityContextConstraint",
+		"security.openshift.io/SCCExecRestrictions",
+		"route.openshift.io/IngressAdmission",
+		hostassignment.PluginName,          // "route.openshift.io/RouteHostAssignment"
+		csiinlinevolumesecurity.PluginName, // "storage.openshift.io/CSIInlineVolumeSecurity"
+		managednode.PluginName,             // "autoscaling.openshift.io/ManagedNode"
+	}
+
+	// openshiftAdmissionPluginsForKubeAfterResourceQuota are the plugins to add after ResourceQuota plugin
+	openshiftAdmissionPluginsForKubeAfterResourceQuota = []string{
+		"quota.openshift.io/ClusterResourceQuota",
+	}
+
+	// additionalDefaultOnPlugins is a list of plugins we turn on by default that core kube does not.
+	additionalDefaultOnPlugins = sets.NewString(
+		"NodeRestriction",
+		"OwnerReferencesPermissionEnforcement",
+		"PodNodeSelector",
+		"PodTolerationRestriction",
+		"Priority",
+		imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
+		"StorageObjectInUseProtection",
+	)
+)
+
+func NewOrderedKubeAdmissionPlugins(kubeAdmissionOrder []string) []string {
+	ret := []string{}
+	for _, curr := range kubeAdmissionOrder {
+		if curr == mutatingwebhook.PluginName {
+			ret = append(ret, openshiftAdmissionPluginsForKubeBeforeMutating...)
+			ret = append(ret, customresourcevalidationregistration.AllCustomResourceValidators...)
+		}
+
+		ret = append(ret, curr)
+
+		if curr == resourcequota.PluginName {
+			ret = append(ret, openshiftAdmissionPluginsForKubeAfterResourceQuota...)
+		}
+	}
+	return ret
+}
+
+func NewDefaultOffPluginsFunc(kubeDefaultOffAdmission sets.Set[string]) func() sets.Set[string] {
+	return func() sets.Set[string] {
+		kubeOff := sets.New[string](kubeDefaultOffAdmission.UnsortedList()...)
+		kubeOff.Delete(additionalDefaultOnPlugins.List()...)
+		kubeOff.Delete(openshiftAdmissionPluginsForKubeBeforeMutating...)
+		kubeOff.Delete(openshiftAdmissionPluginsForKubeAfterResourceQuota...)
+		kubeOff.Delete(customresourcevalidationregistration.AllCustomResourceValidators...)
+		return kubeOff
+	}
+}
@@ -0,0 +1,55 @@
+package admissionenablement
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apiserver/pkg/admission"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/kubernetes/pkg/kubeapiserver/options"
+
+	"github.com/openshift/library-go/pkg/apiserver/admission/admissionregistrationtesting"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
+)
+
+func TestAdmissionRegistration(t *testing.T) {
+	orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins)
+	defaultOffPlugins := NewDefaultOffPluginsFunc(options.DefaultOffAdmissionPlugins())()
+	registerAllAdmissionPlugins := func(plugins *admission.Plugins) {
+		genericapiserver.RegisterAllAdmissionPlugins(plugins)
+		options.RegisterAllAdmissionPlugins(plugins)
+		RegisterOpenshiftKubeAdmissionPlugins(plugins)
+		customresourcevalidationregistration.RegisterCustomResourceValidation(plugins)
+	}
+	plugins := admission.NewPlugins()
+	registerAllAdmissionPlugins(plugins)
+
+	err := admissionregistrationtesting.AdmissionRegistrationTest(plugins, orderedAdmissionChain, sets.Set[string](defaultOffPlugins))
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestResourceQuotaBeforeClusterResourceQuota simply test wheather ResourceQuota plugin is before ClusterResourceQuota plugin
+func TestResourceQuotaBeforeClusterResourceQuota(t *testing.T) {
+	orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins)
+
+	expectedOrderedAdmissionSubChain := []string{"ResourceQuota", "quota.openshift.io/ClusterResourceQuota", "AlwaysDeny"}
+	actualOrderedAdmissionChain := extractSubChain(orderedAdmissionChain, expectedOrderedAdmissionSubChain[0])
+
+	if !reflect.DeepEqual(actualOrderedAdmissionChain, expectedOrderedAdmissionSubChain) {
+		t.Fatalf("expected %v, got %v ", expectedOrderedAdmissionSubChain, actualOrderedAdmissionChain)
+	}
+}
+
+func extractSubChain(admissionChain []string, takeFrom string) []string {
+	indexOfTake := 0
+	for index, admission := range admissionChain {
+		if admission == takeFrom {
+			indexOfTake = index
+			break
+		}
+	}
+	return admissionChain[indexOfTake:]
+}
@@ -0,0 +1,28 @@
+package restrictusers
+
+import (
+	userv1 "github.com/openshift/api/user/v1"
+)
+
+type fakeGroupCache struct {
+	groups []userv1.Group
+}
+
+func (g fakeGroupCache) GroupsFor(user string) ([]*userv1.Group, error) {
+	ret := []*userv1.Group{}
+	for i := range g.groups {
+		group := &g.groups[i]
+		for _, currUser := range group.Users {
+			if user == currUser {
+				ret = append(ret, group)
+				break
+			}
+		}
+
+	}
+	return ret, nil
+}
+
+func (g fakeGroupCache) HasSynced() bool {
+	return true
+}
@@ -0,0 +1,28 @@
+package restrictusers
+
+import (
+	"k8s.io/apiserver/pkg/admission"
+
+	userinformer "github.com/openshift/client-go/user/informers/externalversions"
+)
+
+func NewInitializer(userInformer userinformer.SharedInformerFactory) admission.PluginInitializer {
+	return &localInitializer{userInformer: userInformer}
+}
+
+type WantsUserInformer interface {
+	SetUserInformer(userinformer.SharedInformerFactory)
+	admission.InitializationValidator
+}
+
+type localInitializer struct {
+	userInformer userinformer.SharedInformerFactory
+}
+
+// Initialize will check the initialization interfaces implemented by each plugin
+// and provide the appropriate initialization data
+func (i *localInitializer) Initialize(plugin admission.Interface) {
+	if wants, ok := plugin.(WantsUserInformer); ok {
+		wants.SetUserInformer(i.userInformer)
+	}
+}