Skip to content

Commit b6bc63a

Browse files
deads2kdeads2k
committed
status to indicate resources with broken secret/SA refs
1 parent f65e57c commit b6bc63a

File tree

6 files changed

+164
-15
lines changed

6 files changed

+164
-15
lines changed

‎pkg/api/graph/graph.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ type ExistenceChecker interface {
2525
Found() bool
2626
}
2727

28+
type ResourceNode interface {
29+
ResourceString() string
30+
}
31+
2832
type UniqueName string
2933

3034
type UniqueNameFunc func(obj interface{}) UniqueName
@@ -158,7 +162,7 @@ func (g Graph) SyntheticNodes() []graph.Node {
158162
sort.Sort(SortedNodeList(nodeList))
159163
for _, node := range nodeList {
160164
if potentiallySyntheticNode, ok := node.(ExistenceChecker); ok {
161-
if potentiallySyntheticNode.Found() {
165+
if !potentiallySyntheticNode.Found() {
162166
ret = append(ret, node)
163167
}
164168
}

‎pkg/api/kubegraph/nodes/types.go

+20
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ func (n ServiceNode) String() string {
3737
return string(ServiceNodeName(n.Service))
3838
}
3939

40+
func (n ServiceNode) ResourceString() string {
41+
return "svc/" + n.Name
42+
}
43+
4044
func (*ServiceNode) Kind() string {
4145
return ServiceNodeKind
4246
}
@@ -58,6 +62,10 @@ func (n PodNode) String() string {
5862
return string(PodNodeName(n.Pod))
5963
}
6064

65+
func (n PodNode) ResourceString() string {
66+
return "pod/" + n.Name
67+
}
68+
6169
func (n PodNode) UniqueName() osgraph.UniqueName {
6270
return PodNodeName(n.Pod)
6371
}
@@ -110,6 +118,10 @@ func (n ReplicationControllerNode) String() string {
110118
return string(ReplicationControllerNodeName(n.ReplicationController))
111119
}
112120

121+
func (n ReplicationControllerNode) ResourceString() string {
122+
return "rc/" + n.Name
123+
}
124+
113125
func (n ReplicationControllerNode) UniqueName() osgraph.UniqueName {
114126
return ReplicationControllerNodeName(n.ReplicationController)
115127
}
@@ -195,6 +207,10 @@ func (n ServiceAccountNode) String() string {
195207
return string(ServiceAccountNodeName(n.ServiceAccount))
196208
}
197209

210+
func (n ServiceAccountNode) ResourceString() string {
211+
return "sa/" + n.Name
212+
}
213+
198214
func (*ServiceAccountNode) Kind() string {
199215
return ServiceAccountNodeKind
200216
}
@@ -222,6 +238,10 @@ func (n SecretNode) String() string {
222238
return string(SecretNodeName(n.Secret))
223239
}
224240

241+
func (n SecretNode) ResourceString() string {
242+
return "secret/" + n.Name
243+
}
244+
225245
func (*SecretNode) Kind() string {
226246
return SecretNodeKind
227247
}

‎pkg/build/graph/nodes/types.go

+8
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ func (n BuildConfigNode) String() string {
3333
return string(BuildConfigNodeName(n.BuildConfig))
3434
}
3535

36+
func (n BuildConfigNode) ResourceString() string {
37+
return "bc/" + n.Name
38+
}
39+
3640
func (*BuildConfigNode) Kind() string {
3741
return BuildConfigNodeKind
3842
}
@@ -77,6 +81,10 @@ func (n BuildNode) String() string {
7781
return string(BuildNodeName(n.Build))
7882
}
7983

84+
func (n BuildNode) ResourceString() string {
85+
return "build/" + n.Build.Name
86+
}
87+
8088
func (*BuildNode) Kind() string {
8189
return BuildNodeKind
8290
}

‎pkg/cmd/cli/describe/projectstatus.go

+115-14
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
osgraph "github.com/openshift/origin/pkg/api/graph"
1717
"github.com/openshift/origin/pkg/api/graph/graphview"
1818
kubeedges "github.com/openshift/origin/pkg/api/kubegraph"
19+
kubeanalysis "github.com/openshift/origin/pkg/api/kubegraph/analysis"
1920
kubegraph "github.com/openshift/origin/pkg/api/kubegraph/nodes"
2021
buildapi "github.com/openshift/origin/pkg/build/api"
2122
buildedges "github.com/openshift/origin/pkg/build/graph"
@@ -43,6 +44,8 @@ func (d *ProjectStatusDescriber) MakeGraph(namespace string) (osgraph.Graph, err
4344

4445
loaders := []GraphLoader{
4546
&serviceLoader{namespace: namespace, lister: d.K},
47+
&serviceAccountLoader{namespace: namespace, lister: d.K},
48+
&secretLoader{namespace: namespace, lister: d.K},
4649
&rcLoader{namespace: namespace, lister: d.K},
4750
&podLoader{namespace: namespace, lister: d.K},
4851
&bcLoader{namespace: namespace, lister: d.C},
@@ -71,6 +74,9 @@ func (d *ProjectStatusDescriber) MakeGraph(namespace string) (osgraph.Graph, err
7174
deployedges.AddAllTriggerEdges(g)
7275
deployedges.AddAllDeploymentEdges(g)
7376
imageedges.AddAllImageStreamRefEdges(g)
77+
kubeedges.AddAllRequestedServiceAccountEdges(g)
78+
kubeedges.AddAllMountableSecretEdges(g)
79+
kubeedges.AddAllMountedSecretEdges(g)
7480

7581
return g, nil
7682
}
@@ -154,6 +160,9 @@ func (d *ProjectStatusDescriber) Describe(namespace, name string) (string, error
154160
if hasUnresolvedImageStreamTag(g) {
155161
fmt.Fprintln(out, "Warning: Some of your builds are pointing to image streams, but the administrator has not configured the integrated Docker registry (oadm registry).")
156162
}
163+
if lines, _ := describeBadPodSpecs(out, g); len(lines) > 0 {
164+
fmt.Fprintln(out, strings.Join(lines, "\n"))
165+
}
157166

158167
fmt.Fprintln(out, "To see more, use 'oc describe service <name>' or 'oc describe dc <name>'.")
159168
fmt.Fprintln(out, "You can use 'oc get all' to see a list of other objects.")
@@ -179,6 +188,50 @@ func hasUnresolvedImageStreamTag(g osgraph.Graph) bool {
179188
return false
180189
}
181190

191+
func describeBadPodSpecs(out io.Writer, g osgraph.Graph) ([]string, []*kubegraph.SecretNode) {
192+
allMissingSecrets := []*kubegraph.SecretNode{}
193+
lines := []string{}
194+
195+
for _, uncastPodSpec := range g.NodesByKind(kubegraph.PodSpecNodeKind) {
196+
podSpecNode := uncastPodSpec.(*kubegraph.PodSpecNode)
197+
unmountableSecrets, missingSecrets := kubeanalysis.CheckMountedSecrets(g, podSpecNode)
198+
containingNode := osgraph.GetTopLevelContainerNode(g, podSpecNode)
199+
200+
allMissingSecrets = append(allMissingSecrets, missingSecrets...)
201+
202+
unmountableNames := []string{}
203+
for _, secret := range unmountableSecrets {
204+
unmountableNames = append(unmountableNames, secret.ResourceString())
205+
}
206+
207+
missingNames := []string{}
208+
for _, secret := range missingSecrets {
209+
missingNames = append(missingNames, secret.ResourceString())
210+
}
211+
212+
containingNodeName := g.GraphDescriber.Name(containingNode)
213+
if resourceNode, ok := containingNode.(osgraph.ResourceNode); ok {
214+
containingNodeName = resourceNode.ResourceString()
215+
}
216+
217+
switch {
218+
case len(unmountableSecrets) > 0 && len(missingSecrets) > 0:
219+
lines = append(lines, fmt.Sprintf("\t%s is not allowed to mount %s and wants to mount these missing secrets %s", containingNodeName, strings.Join(unmountableNames, ","), strings.Join(missingNames, ",")))
220+
case len(unmountableSecrets) > 0:
221+
lines = append(lines, fmt.Sprintf("\t%s is not allowed to mount %s", containingNodeName, strings.Join(unmountableNames, ",")))
222+
case len(unmountableSecrets) > 0 && len(missingSecrets) > 0:
223+
lines = append(lines, fmt.Sprintf("\t%s wants to mount these missing secrets %s", containingNodeName, strings.Join(missingNames, ",")))
224+
}
225+
}
226+
227+
// if we had any failures, prepend the warning line
228+
if len(lines) > 0 {
229+
return append([]string{"Warning: some requested secrets are not allowed:"}, lines...), allMissingSecrets
230+
}
231+
232+
return []string{}, allMissingSecrets
233+
}
234+
182235
func printLines(out io.Writer, indent string, depth int, lines ...string) {
183236
for i, s := range lines {
184237
fmt.Fprintf(out, strings.Repeat(indent, depth))
@@ -625,14 +678,14 @@ type GraphLoader interface {
625678
AddToGraph(g osgraph.Graph) error
626679
}
627680

628-
type serviceLoader struct {
681+
type rcLoader struct {
629682
namespace string
630-
lister kclient.ServicesNamespacer
631-
items []kapi.Service
683+
lister kclient.ReplicationControllersNamespacer
684+
items []kapi.ReplicationController
632685
}
633686

634-
func (l *serviceLoader) Load() error {
635-
list, err := l.lister.Services(l.namespace).List(labels.Everything())
687+
func (l *rcLoader) Load() error {
688+
list, err := l.lister.ReplicationControllers(l.namespace).List(labels.Everything())
636689
if err != nil {
637690
return err
638691
}
@@ -641,22 +694,22 @@ func (l *serviceLoader) Load() error {
641694
return nil
642695
}
643696

644-
func (l *serviceLoader) AddToGraph(g osgraph.Graph) error {
697+
func (l *rcLoader) AddToGraph(g osgraph.Graph) error {
645698
for i := range l.items {
646-
kubegraph.EnsureServiceNode(g, &l.items[i])
699+
kubegraph.EnsureReplicationControllerNode(g, &l.items[i])
647700
}
648701

649702
return nil
650703
}
651704

652-
type rcLoader struct {
705+
type serviceLoader struct {
653706
namespace string
654-
lister kclient.ReplicationControllersNamespacer
655-
items []kapi.ReplicationController
707+
lister kclient.ServicesNamespacer
708+
items []kapi.Service
656709
}
657710

658-
func (l *rcLoader) Load() error {
659-
list, err := l.lister.ReplicationControllers(l.namespace).List(labels.Everything())
711+
func (l *serviceLoader) Load() error {
712+
list, err := l.lister.Services(l.namespace).List(labels.Everything())
660713
if err != nil {
661714
return err
662715
}
@@ -665,9 +718,9 @@ func (l *rcLoader) Load() error {
665718
return nil
666719
}
667720

668-
func (l *rcLoader) AddToGraph(g osgraph.Graph) error {
721+
func (l *serviceLoader) AddToGraph(g osgraph.Graph) error {
669722
for i := range l.items {
670-
kubegraph.EnsureReplicationControllerNode(g, &l.items[i])
723+
kubegraph.EnsureServiceNode(g, &l.items[i])
671724
}
672725

673726
return nil
@@ -697,6 +750,54 @@ func (l *podLoader) AddToGraph(g osgraph.Graph) error {
697750
return nil
698751
}
699752

753+
type serviceAccountLoader struct {
754+
namespace string
755+
lister kclient.ServiceAccountsNamespacer
756+
items []kapi.ServiceAccount
757+
}
758+
759+
func (l *serviceAccountLoader) Load() error {
760+
list, err := l.lister.ServiceAccounts(l.namespace).List(labels.Everything(), fields.Everything())
761+
if err != nil {
762+
return err
763+
}
764+
765+
l.items = list.Items
766+
return nil
767+
}
768+
769+
func (l *serviceAccountLoader) AddToGraph(g osgraph.Graph) error {
770+
for i := range l.items {
771+
kubegraph.EnsureServiceAccountNode(g, &l.items[i])
772+
}
773+
774+
return nil
775+
}
776+
777+
type secretLoader struct {
778+
namespace string
779+
lister kclient.SecretsNamespacer
780+
items []kapi.Secret
781+
}
782+
783+
func (l *secretLoader) Load() error {
784+
list, err := l.lister.Secrets(l.namespace).List(labels.Everything(), fields.Everything())
785+
if err != nil {
786+
return err
787+
}
788+
789+
l.items = list.Items
790+
return nil
791+
}
792+
793+
func (l *secretLoader) AddToGraph(g osgraph.Graph) error {
794+
for i := range l.items {
795+
kubegraph.EnsureSecretNode(g, &l.items[i])
796+
}
797+
798+
return nil
799+
}
800+
700801
type isLoader struct {
701802
namespace string
702803
lister client.ImageStreamsNamespacer

‎pkg/deploy/graph/nodes/types.go

+4
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ func (n DeploymentConfigNode) String() string {
2828
return string(DeploymentConfigNodeName(n.DeploymentConfig))
2929
}
3030

31+
func (n DeploymentConfigNode) ResourceString() string {
32+
return "dc/" + n.Name
33+
}
34+
3135
func (*DeploymentConfigNode) Kind() string {
3236
return DeploymentConfigNodeKind
3337
}

‎pkg/image/graph/nodes/types.go

+12
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ func (n ImageStreamNode) String() string {
4242
return string(ImageStreamNodeName(n.ImageStream))
4343
}
4444

45+
func (n ImageStreamNode) ResourceString() string {
46+
return "is/" + n.Name
47+
}
48+
4549
func (*ImageStreamNode) Kind() string {
4650
return ImageStreamNodeKind
4751
}
@@ -79,6 +83,10 @@ func (n ImageStreamTagNode) String() string {
7983
return string(ImageStreamTagNodeName(n.ImageStreamTag))
8084
}
8185

86+
func (n ImageStreamTagNode) ResourceString() string {
87+
return "imagestreamtag/" + n.Name
88+
}
89+
8290
func (*ImageStreamTagNode) Kind() string {
8391
return ImageStreamTagNodeKind
8492
}
@@ -148,6 +156,10 @@ func (n ImageNode) String() string {
148156
return string(ImageNodeName(n.Image))
149157
}
150158

159+
func (n ImageNode) ResourceString() string {
160+
return "image/" + n.Image.Name
161+
}
162+
151163
func (*ImageNode) Kind() string {
152164
return ImageNodeKind
153165
}

0 commit comments

Comments
 (0)