Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Origin to/from Kube conversions for SAR #13156

Open
enj opened this issue Feb 28, 2017 · 4 comments
Open

Origin to/from Kube conversions for SAR #13156

enj opened this issue Feb 28, 2017 · 4 comments
Labels
area/techdebt help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/P2

Comments

@enj
Copy link
Contributor

enj commented Feb 28, 2017 •
edited
Loading

For example, origin SAR scopes can be translated to kube SAR extras.

Full round trip conversion may not be possible.

I (Mo) do not think they are fully convertible. Our SAR stuff defaults the namespace and user to the current if not given, kube requires it. Kube SAR also has NonResourceAttributes and Subresource which we do not seem to have. I am also not sure if kube's Extra and our Scopes can be round tripped without losing data.

I planned on simply removing it but I was not sure if the origin SAR stuff even handled NonResourceAttributes. While both ResourceAttributes and NonResourceAttributes cannot be specified together, the origin stuff does have a .Path so I feel like that should be used at some point.

xref: #13128
@enj enj mentioned this issue Feb 28, 2017
Merged
4 tasks
@simo5 simo5 mentioned this issue Jul 24, 2017
Merged
67 tasks
openshift-merge-robot added a commit that referenced this issue Aug 17, 2017
@openshift-merge-robot
Merge pull request #15021 from simo5/RBAC1
edf3ff5 
Automatic merge from submit-queue

Migrate to Kubernetes RBAC

Trello xref: https://trello.com/c/n3bR3Ys9

Fixes #12303
Fixes #13549
Fixes #13432
Fixes #15338
Fixes #14168
Fixes #10056

Need to investigate:

- [x] ...

Dependencies:

- [x] Prerequisite #15342
- [x] Requires openshift/openshift-ansible/pull/4933 @sdodson 
- [x] Blocked on openshift/openshift-ansible/issues/4967
- [x] Prerequisite kubernetes/kubernetes#50639

Followups:
- [ ] #15412
- [ ] #13316
- [ ] #13156
- [ ] #13430
- [ ] Should delete with proxy return details?
- [ ] Make project creation use RBAC instead of proxy endpoints?
- [ ] Remove policy objects from bootstrap roles
- [ ] Check if delegated_test.go can be revived
- [ ] Check to see if the deleted unit tests are reflected upstream and fix gaps
- [ ] Open issue to remove `openshiftSubjectLocator`
- [ ] Open issue to revisit forbidden message maker
- [ ] Update upstream `subject_locator_test` with origin's extensive testing
- [ ] Fix proxied create: ` _ bool is includeUnintialized, which we should really be passing through to the underlying API... it's odd there's not a CreateOptions parameter to Create`
- [ ] Fix proxied update: `if initializers use Update() to initialize objects (which I think they do), we may need to pass GetOptions{IncludeUninitialized: true} here...`
- [ ] Fix panics() in Convert...OrDie() functions
- [ ] glog.Fatal on post stark hook error
- [ ] Remove `TestPolicyCache`?
- [ ] Use discovery API based gating?
- [ ] upstream rules have always required a group. followup issue to remove getAPIGroupLegacy from `pkg/authorization/authorizer/scope/converter.go`
- [ ] issue to remove "normalizeResources" from `pkg/cmd/server/bootstrappolicy/policy.go`
- [ ] issue to  find callers of `clusterpolicyregistry "github.com/openshift/origin/pkg/authorization/registry/clusterpolicy"` and move to point of use
- [ ] issue to switch our encoding to rbac in `pkg/cmd/server/admin/create_bootstrappolicy_file.go`
- [ ] Exercise proxied endpoints
- [ ] hack/test-cmd.sh of gated overwrite bootstrap policy
- [ ] Delete unused legacy policy registry code
- [ ] Make RBAC discovery rule authoritative `pkg/authorization/apis/authorization/types.go`
- [ ] Fix `ignoreError` in `pkg/oc/admin/router/router.go`
- [ ] Confirm changes to `TestAuthorizationResolution` and `TestAuthorizationResourceAccessReview` in `test/integration/authorization_test.go`

Done:

- Store ClusterRoles as native RBAC Objects via Kubernetes.
- Provides backwards compatible API for the old policy based roles.
- Use Kubernetes authorizer

TODO:

- [x] Delete policy end points
- [x] Decide what to do with overwrite policy
- [x] Remove or gate `oc create policybinding`
- [x] Move new impersonation code to `pkg/auth/client/impersonate.go`
- [x] Remove any unnecessary conversions
- [x] Review new `proxy.go` files
- [x] Remove reason logic `allowed by rule in ...`
- [x] Add interface assertion to proxy files
- [x] Confirm we need `pkg/authorization/util/convert/convert.go`
- [x] Confrim we need to expose some of the private conversion functions
- [x] Add protect/autoupdate annotation conversion to general conversion functions
- [x] ~~Support watch on proxied endpoints~~
- [x] Cherry pick kubernetes/kubernetes#49868 -> #15721
- [x] Fix upstream commits
- [x] Restore and version gate `NewCmdMigrateAuthorization`
- [x] ~~Wrap other errors in proxy files?~~ Remove all error wrapping
- [x] Make `NewImpersonatingRBACFromContext` more generic
- [x] Kube authorizer's reason on deny contains evaluation errors - do we want to preserve those?
- [x] Review `ImpersonatingRESTClient` in `pkg/auth/client/impersonate.go`
- [ ] Review `pkg/project/auth/cache.go` and ` pkg/project/auth/cache_test.go`
- [ ] Review ` pkg/authorization/authorizer/scope/converter_test.go`
- [ ] Review `k8s.io/kubernetes/staging/src/k8s.io/client-go/rest/request.go`
@enj enj added the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label Oct 9, 2017
@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci-robot openshift-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 22, 2018
@openshift-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci-robot openshift-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Mar 24, 2018
@openshift-bot
Copy link
Contributor

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

@enj enj added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. labels Apr 26, 2018
@enj enj reopened this Apr 26, 2018
@enj
Copy link
Contributor Author

enj commented Oct 16, 2019

/unassign

@stlaz @sttts @mfojtik

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/techdebt help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/P2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@mfojtik @openshift-bot @enj @openshift-ci-robot