|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "log" |
| 6 | + "net/http" |
| 7 | + "net/url" |
| 8 | + |
| 9 | + "github.com/gorilla/mux" |
| 10 | + authorizationv1 "k8s.io/api/authorization/v1" |
| 11 | + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 12 | +) |
| 13 | + |
| 14 | +// kubeflowUserHandler returns an http.Handler which |
| 15 | +// wraps the provided handler h, and will |
| 16 | +// load the User ID of the user from the specific |
| 17 | +// header in the request and add it to the HTTP request information. |
| 18 | +func kubeflowUserHandler(header string, h http.Handler) http.Handler { |
| 19 | + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 20 | + user := r.Header.Get(header) |
| 21 | + if user != "" { |
| 22 | + // Add the User information to the request. |
| 23 | + r.URL.User = url.User(user) |
| 24 | + } |
| 25 | + |
| 26 | + h.ServeHTTP(w, r) |
| 27 | + }) |
| 28 | +} |
| 29 | + |
| 30 | +// checkAccess is a middleware HTTP handler function that will verify the |
| 31 | +// provided user's access against the Kubernetes API server. It loads the |
| 32 | +// user's ID from the `kubeflow-userid` Header, generated a SubjectAccessReview |
| 33 | +// request and submits it to the Kubernetes API server. The API server will |
| 34 | +// return whether the user is permitted to perform the requested action. |
| 35 | +// |
| 36 | +// subjectAccessReviewTemplate: A authorization.k8s.io/v1 SubjectAccessReview |
| 37 | +// object used as a template for the request. |
| 38 | +// Note: the spec.User and Spec.ResourceAttributes.Namespace are REPLACED by this function. |
| 39 | +// next: The next handler to call if the user is authorized to access the desired resource |
| 40 | +func (s *server) checkAccess(subjectAccessReviewTemplate authorizationv1.SubjectAccessReview, next http.HandlerFunc) http.HandlerFunc { |
| 41 | + return func(w http.ResponseWriter, r *http.Request) { |
| 42 | + vars := mux.Vars(r) |
| 43 | + |
| 44 | + // Make a copy of the template, so we don't replace content in the templated version |
| 45 | + sar := subjectAccessReviewTemplate.DeepCopy() |
| 46 | + |
| 47 | + // Load the user from kubeflow-userid. If there is no user provided, |
| 48 | + // then do not continue to process the request. |
| 49 | + user := r.URL.User.Username() |
| 50 | + if user == "" { |
| 51 | + log.Printf("no user found") |
| 52 | + s.respond(w, r, APIResponse{ |
| 53 | + Success: false, |
| 54 | + Log: "no user found", |
| 55 | + }) |
| 56 | + return |
| 57 | + } |
| 58 | + |
| 59 | + // Update the SubjectAccessReview request with the namespace and user information |
| 60 | + sar.Spec.ResourceAttributes.Namespace = vars["namespace"] |
| 61 | + sar.Spec.User = user |
| 62 | + |
| 63 | + // Submit the SubjectAccessReview to the Kubernetes API server |
| 64 | + resp, err := s.clientsets.kubernetes.AuthorizationV1().SubjectAccessReviews().Create(r.Context(), sar, v1.CreateOptions{}) |
| 65 | + if err != nil { |
| 66 | + s.error(w, r, err) |
| 67 | + return |
| 68 | + } |
| 69 | + |
| 70 | + // If the user is not permitted, log and return the error and do not process the request |
| 71 | + if !resp.Status.Allowed { |
| 72 | + msg := fmt.Sprintf("User %s is not permitted to %s %s.%s.%s for namespace: %s", sar.Spec.User, sar.Spec.ResourceAttributes.Verb, sar.Spec.ResourceAttributes.Group, sar.Spec.ResourceAttributes.Version, sar.Spec.ResourceAttributes.Resource, sar.Spec.ResourceAttributes.Namespace) |
| 73 | + |
| 74 | + log.Println(msg) |
| 75 | + |
| 76 | + s.respond(w, r, APIResponse{ |
| 77 | + Success: false, |
| 78 | + Log: msg, |
| 79 | + }) |
| 80 | + return |
| 81 | + } |
| 82 | + |
| 83 | + // Finally, if the user is authorized |
| 84 | + next(w, r) |
| 85 | + } |
| 86 | +} |
0 commit comments