Skip to content

Commit 7637741

Browse files
liggittliggitt
committed
Deprecate RBAC UserAll, convert v1alpha1 rolebindings to "User *" to "Group system:authenticated"
1 parent ecd251b commit 7637741

10 files changed

+230
-18
lines changed

‎hack/.linted_packages

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ pkg/apis/imagepolicy/install
9393
pkg/apis/meta/v1/unstructured
9494
pkg/apis/policy/install
9595
pkg/apis/rbac/install
96+
pkg/apis/rbac/v1alpha1
9697
pkg/apis/storage/install
9798
pkg/apis/storage/validation
9899
pkg/apiserver/audit

‎pkg/apis/rbac/types.go

-2
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@ const (
3636
GroupKind = "Group"
3737
ServiceAccountKind = "ServiceAccount"
3838
UserKind = "User"
39-
40-
UserAll = "*"
4139
)
4240

4341
// PolicyRule holds information that describes a policy rule, but does not contain information

‎pkg/apis/rbac/v1alpha1/BUILD

+15
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@ licenses(["notice"])
55
load(
66
"@io_bazel_rules_go//go:def.bzl",
77
"go_library",
8+
"go_test",
89
)
910

1011
go_library(
1112
name = "go_default_library",
1213
srcs = [
14+
"conversion.go",
1315
"defaults.go",
1416
"doc.go",
1517
"generated.pb.go",
@@ -27,6 +29,7 @@ go_library(
2729
"//pkg/api/v1:go_default_library",
2830
"//pkg/apis/meta/v1:go_default_library",
2931
"//pkg/apis/rbac:go_default_library",
32+
"//pkg/auth/user:go_default_library",
3033
"//pkg/conversion:go_default_library",
3134
"//pkg/runtime:go_default_library",
3235
"//pkg/runtime/schema:go_default_library",
@@ -36,3 +39,15 @@ go_library(
3639
"//vendor:github.com/ugorji/go/codec",
3740
],
3841
)
42+
43+
go_test(
44+
name = "go_default_xtest",
45+
srcs = ["conversion_test.go"],
46+
tags = ["automanaged"],
47+
deps = [
48+
"//pkg/api:go_default_library",
49+
"//pkg/apis/rbac:go_default_library",
50+
"//pkg/apis/rbac/install:go_default_library",
51+
"//pkg/apis/rbac/v1alpha1:go_default_library",
52+
],
53+
)

‎pkg/apis/rbac/v1alpha1/conversion.go

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
Copyright 2016 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
api "k8s.io/kubernetes/pkg/apis/rbac"
21+
"k8s.io/kubernetes/pkg/auth/user"
22+
"k8s.io/kubernetes/pkg/conversion"
23+
)
24+
25+
func Convert_v1alpha1_Subject_To_rbac_Subject(in *Subject, out *api.Subject, s conversion.Scope) error {
26+
if err := autoConvert_v1alpha1_Subject_To_rbac_Subject(in, out, s); err != nil {
27+
return err
28+
}
29+
30+
// User * in v1alpha1 will only match all authenticated users
31+
// This is only for compatibility with old RBAC bindings
32+
// Special treatment for * should not be included in v1beta1
33+
if out.Kind == UserKind && out.Name == "*" {
34+
out.Kind = GroupKind
35+
out.Name = user.AllAuthenticated
36+
}
37+
38+
return nil
39+
}

‎pkg/apis/rbac/v1alpha1/conversion_test.go

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/*
2+
Copyright 2016 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1_test
18+
19+
import (
20+
"reflect"
21+
"testing"
22+
23+
"k8s.io/kubernetes/pkg/api"
24+
rbacapi "k8s.io/kubernetes/pkg/apis/rbac"
25+
_ "k8s.io/kubernetes/pkg/apis/rbac/install"
26+
"k8s.io/kubernetes/pkg/apis/rbac/v1alpha1"
27+
)
28+
29+
func TestConversion(t *testing.T) {
30+
testcases := map[string]struct {
31+
old *v1alpha1.RoleBinding
32+
expected *rbacapi.RoleBinding
33+
}{
34+
"specific user": {
35+
old: &v1alpha1.RoleBinding{
36+
RoleRef: v1alpha1.RoleRef{Name: "foo", APIGroup: v1alpha1.GroupName},
37+
Subjects: []v1alpha1.Subject{{Kind: "User", Name: "bob"}},
38+
},
39+
expected: &rbacapi.RoleBinding{
40+
RoleRef: rbacapi.RoleRef{Name: "foo", APIGroup: v1alpha1.GroupName},
41+
Subjects: []rbacapi.Subject{{Kind: "User", Name: "bob"}},
42+
},
43+
},
44+
"wildcard user matches authenticated": {
45+
old: &v1alpha1.RoleBinding{
46+
RoleRef: v1alpha1.RoleRef{Name: "foo", APIGroup: v1alpha1.GroupName},
47+
Subjects: []v1alpha1.Subject{{Kind: "User", Name: "*"}},
48+
},
49+
expected: &rbacapi.RoleBinding{
50+
RoleRef: rbacapi.RoleRef{Name: "foo", APIGroup: v1alpha1.GroupName},
51+
Subjects: []rbacapi.Subject{{Kind: "Group", Name: "system:authenticated"}},
52+
},
53+
},
54+
}
55+
for k, tc := range testcases {
56+
internal := &rbacapi.RoleBinding{}
57+
if err := api.Scheme.Convert(tc.old, internal, nil); err != nil {
58+
t.Errorf("%s: unexpected error: %v", k, err)
59+
}
60+
if !reflect.DeepEqual(internal, tc.expected) {
61+
t.Errorf("%s: expected\n\t%#v, got \n\t%#v", k, tc.expected, internal)
62+
}
63+
}
64+
}

‎pkg/apis/rbac/v1alpha1/types.go

-2
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@ const (
3636
GroupKind = "Group"
3737
ServiceAccountKind = "ServiceAccount"
3838
UserKind = "User"
39-
40-
UserAll = "*"
4139
)
4240

4341
// Authorization is calculated against

‎pkg/apis/rbac/v1alpha1/zz_generated.conversion.go

+88-12
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,17 @@ func autoConvert_v1alpha1_ClusterRoleBinding_To_rbac_ClusterRoleBinding(in *Clus
115115
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
116116
return err
117117
}
118-
out.Subjects = *(*[]rbac.Subject)(unsafe.Pointer(&in.Subjects))
118+
if in.Subjects != nil {
119+
in, out := &in.Subjects, &out.Subjects
120+
*out = make([]rbac.Subject, len(*in))
121+
for i := range *in {
122+
if err := Convert_v1alpha1_Subject_To_rbac_Subject(&(*in)[i], &(*out)[i], s); err != nil {
123+
return err
124+
}
125+
}
126+
} else {
127+
out.Subjects = nil
128+
}
119129
if err := Convert_v1alpha1_RoleRef_To_rbac_RoleRef(&in.RoleRef, &out.RoleRef, s); err != nil {
120130
return err
121131
}
@@ -131,7 +141,17 @@ func autoConvert_rbac_ClusterRoleBinding_To_v1alpha1_ClusterRoleBinding(in *rbac
131141
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
132142
return err
133143
}
134-
out.Subjects = *(*[]Subject)(unsafe.Pointer(&in.Subjects))
144+
if in.Subjects != nil {
145+
in, out := &in.Subjects, &out.Subjects
146+
*out = make([]Subject, len(*in))
147+
for i := range *in {
148+
if err := Convert_rbac_Subject_To_v1alpha1_Subject(&(*in)[i], &(*out)[i], s); err != nil {
149+
return err
150+
}
151+
}
152+
} else {
153+
out.Subjects = nil
154+
}
135155
if err := Convert_rbac_RoleRef_To_v1alpha1_RoleRef(&in.RoleRef, &out.RoleRef, s); err != nil {
136156
return err
137157
}
@@ -166,7 +186,17 @@ func Convert_rbac_ClusterRoleBindingBuilder_To_v1alpha1_ClusterRoleBindingBuilde
166186

167187
func autoConvert_v1alpha1_ClusterRoleBindingList_To_rbac_ClusterRoleBindingList(in *ClusterRoleBindingList, out *rbac.ClusterRoleBindingList, s conversion.Scope) error {
168188
out.ListMeta = in.ListMeta
169-
out.Items = *(*[]rbac.ClusterRoleBinding)(unsafe.Pointer(&in.Items))
189+
if in.Items != nil {
190+
in, out := &in.Items, &out.Items
191+
*out = make([]rbac.ClusterRoleBinding, len(*in))
192+
for i := range *in {
193+
if err := Convert_v1alpha1_ClusterRoleBinding_To_rbac_ClusterRoleBinding(&(*in)[i], &(*out)[i], s); err != nil {
194+
return err
195+
}
196+
}
197+
} else {
198+
out.Items = nil
199+
}
170200
return nil
171201
}
172202

@@ -176,7 +206,17 @@ func Convert_v1alpha1_ClusterRoleBindingList_To_rbac_ClusterRoleBindingList(in *
176206

177207
func autoConvert_rbac_ClusterRoleBindingList_To_v1alpha1_ClusterRoleBindingList(in *rbac.ClusterRoleBindingList, out *ClusterRoleBindingList, s conversion.Scope) error {
178208
out.ListMeta = in.ListMeta
179-
out.Items = *(*[]ClusterRoleBinding)(unsafe.Pointer(&in.Items))
209+
if in.Items != nil {
210+
in, out := &in.Items, &out.Items
211+
*out = make([]ClusterRoleBinding, len(*in))
212+
for i := range *in {
213+
if err := Convert_rbac_ClusterRoleBinding_To_v1alpha1_ClusterRoleBinding(&(*in)[i], &(*out)[i], s); err != nil {
214+
return err
215+
}
216+
}
217+
} else {
218+
out.Items = nil
219+
}
180220
return nil
181221
}
182222

@@ -329,7 +369,17 @@ func autoConvert_v1alpha1_RoleBinding_To_rbac_RoleBinding(in *RoleBinding, out *
329369
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
330370
return err
331371
}
332-
out.Subjects = *(*[]rbac.Subject)(unsafe.Pointer(&in.Subjects))
372+
if in.Subjects != nil {
373+
in, out := &in.Subjects, &out.Subjects
374+
*out = make([]rbac.Subject, len(*in))
375+
for i := range *in {
376+
if err := Convert_v1alpha1_Subject_To_rbac_Subject(&(*in)[i], &(*out)[i], s); err != nil {
377+
return err
378+
}
379+
}
380+
} else {
381+
out.Subjects = nil
382+
}
333383
if err := Convert_v1alpha1_RoleRef_To_rbac_RoleRef(&in.RoleRef, &out.RoleRef, s); err != nil {
334384
return err
335385
}
@@ -345,7 +395,17 @@ func autoConvert_rbac_RoleBinding_To_v1alpha1_RoleBinding(in *rbac.RoleBinding,
345395
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
346396
return err
347397
}
348-
out.Subjects = *(*[]Subject)(unsafe.Pointer(&in.Subjects))
398+
if in.Subjects != nil {
399+
in, out := &in.Subjects, &out.Subjects
400+
*out = make([]Subject, len(*in))
401+
for i := range *in {
402+
if err := Convert_rbac_Subject_To_v1alpha1_Subject(&(*in)[i], &(*out)[i], s); err != nil {
403+
return err
404+
}
405+
}
406+
} else {
407+
out.Subjects = nil
408+
}
349409
if err := Convert_rbac_RoleRef_To_v1alpha1_RoleRef(&in.RoleRef, &out.RoleRef, s); err != nil {
350410
return err
351411
}
@@ -358,7 +418,17 @@ func Convert_rbac_RoleBinding_To_v1alpha1_RoleBinding(in *rbac.RoleBinding, out
358418

359419
func autoConvert_v1alpha1_RoleBindingList_To_rbac_RoleBindingList(in *RoleBindingList, out *rbac.RoleBindingList, s conversion.Scope) error {
360420
out.ListMeta = in.ListMeta
361-
out.Items = *(*[]rbac.RoleBinding)(unsafe.Pointer(&in.Items))
421+
if in.Items != nil {
422+
in, out := &in.Items, &out.Items
423+
*out = make([]rbac.RoleBinding, len(*in))
424+
for i := range *in {
425+
if err := Convert_v1alpha1_RoleBinding_To_rbac_RoleBinding(&(*in)[i], &(*out)[i], s); err != nil {
426+
return err
427+
}
428+
}
429+
} else {
430+
out.Items = nil
431+
}
362432
return nil
363433
}
364434

@@ -368,7 +438,17 @@ func Convert_v1alpha1_RoleBindingList_To_rbac_RoleBindingList(in *RoleBindingLis
368438

369439
func autoConvert_rbac_RoleBindingList_To_v1alpha1_RoleBindingList(in *rbac.RoleBindingList, out *RoleBindingList, s conversion.Scope) error {
370440
out.ListMeta = in.ListMeta
371-
out.Items = *(*[]RoleBinding)(unsafe.Pointer(&in.Items))
441+
if in.Items != nil {
442+
in, out := &in.Items, &out.Items
443+
*out = make([]RoleBinding, len(*in))
444+
for i := range *in {
445+
if err := Convert_rbac_RoleBinding_To_v1alpha1_RoleBinding(&(*in)[i], &(*out)[i], s); err != nil {
446+
return err
447+
}
448+
}
449+
} else {
450+
out.Items = nil
451+
}
372452
return nil
373453
}
374454

@@ -446,10 +526,6 @@ func autoConvert_v1alpha1_Subject_To_rbac_Subject(in *Subject, out *rbac.Subject
446526
return nil
447527
}
448528

449-
func Convert_v1alpha1_Subject_To_rbac_Subject(in *Subject, out *rbac.Subject, s conversion.Scope) error {
450-
return autoConvert_v1alpha1_Subject_To_rbac_Subject(in, out, s)
451-
}
452-
453529
func autoConvert_rbac_Subject_To_v1alpha1_Subject(in *rbac.Subject, out *Subject, s conversion.Scope) error {
454530
out.Kind = in.Kind
455531
out.APIVersion = in.APIVersion

‎pkg/apis/rbac/validation/rulevalidation.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ func appliesTo(user user.Info, bindingSubjects []rbac.Subject, namespace string)
168168
func appliesToUser(user user.Info, subject rbac.Subject, namespace string) bool {
169169
switch subject.Kind {
170170
case rbac.UserKind:
171-
return subject.Name == rbac.UserAll || user.GetName() == subject.Name
171+
return user.GetName() == subject.Name
172172

173173
case rbac.GroupKind:
174174
return has(user.GetGroups(), subject.Name)

‎pkg/apis/rbac/validation/rulevalidation_test.go

+21-1
Original file line numberDiff line numberDiff line change
@@ -232,8 +232,28 @@ func TestAppliesTo(t *testing.T) {
232232
},
233233
user: &user.DefaultInfo{Name: "foobar"},
234234
namespace: "default",
235+
appliesTo: false,
236+
testCase: "* user subject name doesn't match all users",
237+
},
238+
{
239+
subjects: []rbac.Subject{
240+
{Kind: rbac.GroupKind, Name: user.AllAuthenticated},
241+
{Kind: rbac.GroupKind, Name: user.AllUnauthenticated},
242+
},
243+
user: &user.DefaultInfo{Name: "foobar", Groups: []string{user.AllAuthenticated}},
244+
namespace: "default",
235245
appliesTo: true,
236-
testCase: "multiple subjects with a service account that matches",
246+
testCase: "binding to all authenticated and unauthenticated subjects matches authenticated user",
247+
},
248+
{
249+
subjects: []rbac.Subject{
250+
{Kind: rbac.GroupKind, Name: user.AllAuthenticated},
251+
{Kind: rbac.GroupKind, Name: user.AllUnauthenticated},
252+
},
253+
user: &user.DefaultInfo{Name: "system:anonymous", Groups: []string{user.AllUnauthenticated}},
254+
namespace: "default",
255+
appliesTo: true,
256+
testCase: "binding to all authenticated and unauthenticated subjects matches anonymous user",
237257
},
238258
}
239259

‎test/test_owners.csv

+1
Original file line numberDiff line numberDiff line change
@@ -592,6 +592,7 @@ k8s.io/kubernetes/pkg/apis/meta/v1,sttts,0
592592
k8s.io/kubernetes/pkg/apis/meta/v1/unstructured,smarterclayton,0
593593
k8s.io/kubernetes/pkg/apis/meta/v1/validation,smarterclayton,0
594594
k8s.io/kubernetes/pkg/apis/policy/validation,deads2k,1
595+
k8s.io/kubernetes/pkg/apis/rbac/v1alpha1,liggitt,0
595596
k8s.io/kubernetes/pkg/apis/rbac/validation,erictune,0
596597
k8s.io/kubernetes/pkg/apis/storage/validation,caesarxuchao,1
597598
k8s.io/kubernetes/pkg/apiserver,nikhiljindal,0

0 commit comments

Comments
 (0)