Skip to content

Commit 330c922

Browse files
author
Kubernetes Submit Queue
authored
Merge pull request kubernetes#39729 from sttts/sttts-split-server-side-rbac-validation
Automatic merge from submit-queue Split out server-only code from api packages shared with the client Fixes staging/copy.sh.
2 parents 12e8271 + 4a1d507 commit 330c922

File tree

40 files changed

+302
-202
lines changed

40 files changed

+302
-202
lines changed

‎pkg/api/BUILD

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,9 @@ go_library(
2929
deps = [
3030
"//pkg/api/resource:go_default_library",
3131
"//pkg/fields:go_default_library",
32-
"//pkg/genericapiserver/api/request:go_default_library",
3332
"//pkg/util/intstr:go_default_library",
3433
"//pkg/util/labels:go_default_library",
3534
"//pkg/util/rand:go_default_library",
36-
"//pkg/util/uuid:go_default_library",
3735
"//vendor:github.com/davecgh/go-spew/spew",
3836
"//vendor:k8s.io/apimachinery/pkg/api/meta",
3937
"//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
@@ -88,8 +86,6 @@ go_test(
8886
"//pkg/apis/batch/v2alpha1:go_default_library",
8987
"//pkg/apis/extensions:go_default_library",
9088
"//pkg/apis/extensions/v1beta1:go_default_library",
91-
"//pkg/genericapiserver/api/request:go_default_library",
92-
"//pkg/util/uuid:go_default_library",
9389
"//vendor:github.com/davecgh/go-spew/spew",
9490
"//vendor:github.com/gogo/protobuf/proto",
9591
"//vendor:github.com/golang/protobuf/proto",

‎pkg/api/meta.go

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,23 +22,8 @@ import (
2222
"k8s.io/apimachinery/pkg/conversion"
2323
"k8s.io/apimachinery/pkg/runtime"
2424
"k8s.io/apimachinery/pkg/types"
25-
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
26-
"k8s.io/kubernetes/pkg/util/uuid"
2725
)
2826

29-
// FillObjectMetaSystemFields populates fields that are managed by the system on ObjectMeta.
30-
func FillObjectMetaSystemFields(ctx genericapirequest.Context, meta *ObjectMeta) {
31-
meta.CreationTimestamp = metav1.Now()
32-
// allows admission controllers to assign a UID earlier in the request processing
33-
// to support tracking resources pending creation.
34-
uid, found := genericapirequest.UIDFrom(ctx)
35-
if !found {
36-
uid = uuid.NewUUID()
37-
}
38-
meta.UID = uid
39-
meta.SelfLink = ""
40-
}
41-
4227
// HasObjectMetaSystemFieldValues returns true if fields that are managed by the system on ObjectMeta have values.
4328
func HasObjectMetaSystemFieldValues(meta *ObjectMeta) bool {
4429
return !meta.CreationTimestamp.Time.IsZero() ||

‎pkg/api/meta_test.go

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -28,45 +28,10 @@ import (
2828
"k8s.io/apimachinery/pkg/runtime"
2929
"k8s.io/apimachinery/pkg/runtime/schema"
3030
"k8s.io/kubernetes/pkg/api"
31-
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
32-
"k8s.io/kubernetes/pkg/util/uuid"
3331
)
3432

3533
var _ meta.Object = &api.ObjectMeta{}
3634

37-
// TestFillObjectMetaSystemFields validates that system populated fields are set on an object
38-
func TestFillObjectMetaSystemFields(t *testing.T) {
39-
ctx := genericapirequest.NewDefaultContext()
40-
resource := api.ObjectMeta{}
41-
api.FillObjectMetaSystemFields(ctx, &resource)
42-
if resource.CreationTimestamp.Time.IsZero() {
43-
t.Errorf("resource.CreationTimestamp is zero")
44-
} else if len(resource.UID) == 0 {
45-
t.Errorf("resource.UID missing")
46-
}
47-
// verify we can inject a UID
48-
uid := uuid.NewUUID()
49-
ctx = genericapirequest.WithUID(ctx, uid)
50-
resource = api.ObjectMeta{}
51-
api.FillObjectMetaSystemFields(ctx, &resource)
52-
if resource.UID != uid {
53-
t.Errorf("resource.UID expected: %v, actual: %v", uid, resource.UID)
54-
}
55-
}
56-
57-
// TestHasObjectMetaSystemFieldValues validates that true is returned if and only if all fields are populated
58-
func TestHasObjectMetaSystemFieldValues(t *testing.T) {
59-
ctx := genericapirequest.NewDefaultContext()
60-
resource := api.ObjectMeta{}
61-
if api.HasObjectMetaSystemFieldValues(&resource) {
62-
t.Errorf("the resource does not have all fields yet populated, but incorrectly reports it does")
63-
}
64-
api.FillObjectMetaSystemFields(ctx, &resource)
65-
if !api.HasObjectMetaSystemFieldValues(&resource) {
66-
t.Errorf("the resource does have all fields populated, but incorrectly reports it does not")
67-
}
68-
}
69-
7035
func getObjectMetaAndOwnerReferences() (objectMeta api.ObjectMeta, metaOwnerReferences []metav1.OwnerReference) {
7136
fuzz.New().NilChance(.5).NumElements(1, 5).Fuzz(&objectMeta)
7237
references := objectMeta.OwnerReferences

‎pkg/api/resource_helpers.go

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121

2222
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2323
"k8s.io/kubernetes/pkg/api/resource"
24-
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
2524
)
2625

2726
// Returns string version of ResourceName.
@@ -228,13 +227,3 @@ func PodRequestsAndLimits(pod *Pod) (reqs map[ResourceName]resource.Quantity, li
228227
}
229228
return
230229
}
231-
232-
// ValidNamespace returns false if the namespace on the context differs from the resource. If the resource has no namespace, it is set to the value in the context.
233-
// TODO(sttts): move into pkg/genericapiserver/api
234-
func ValidNamespace(ctx genericapirequest.Context, resource *ObjectMeta) bool {
235-
ns, ok := genericapirequest.NamespaceFrom(ctx)
236-
if len(resource.Namespace) == 0 {
237-
resource.Namespace = ns
238-
}
239-
return ns == resource.Namespace && ok
240-
}

‎pkg/api/rest/BUILD

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ licenses(["notice"])
55
load(
66
"@io_bazel_rules_go//go:def.bzl",
77
"go_library",
8+
"go_test",
89
)
910

1011
go_library(
@@ -14,6 +15,7 @@ go_library(
1415
"delete.go",
1516
"doc.go",
1617
"export.go",
18+
"meta.go",
1719
"rest.go",
1820
"types.go",
1921
"update.go",
@@ -25,6 +27,7 @@ go_library(
2527
"//pkg/api/validation/genericvalidation:go_default_library",
2628
"//pkg/api/validation/path:go_default_library",
2729
"//pkg/genericapiserver/api/request:go_default_library",
30+
"//pkg/util/uuid:go_default_library",
2831
"//vendor:k8s.io/apimachinery/pkg/api/meta",
2932
"//vendor:k8s.io/apimachinery/pkg/apis/meta/v1",
3033
"//vendor:k8s.io/apimachinery/pkg/runtime",
@@ -49,3 +52,15 @@ filegroup(
4952
],
5053
tags = ["automanaged"],
5154
)
55+
56+
go_test(
57+
name = "go_default_test",
58+
srcs = ["meta_test.go"],
59+
library = ":go_default_library",
60+
tags = ["automanaged"],
61+
deps = [
62+
"//pkg/api:go_default_library",
63+
"//pkg/genericapiserver/api/request:go_default_library",
64+
"//pkg/util/uuid:go_default_library",
65+
],
66+
)

‎pkg/api/rest/create.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
"k8s.io/kubernetes/pkg/api"
2424
"k8s.io/kubernetes/pkg/api/errors"
2525
"k8s.io/kubernetes/pkg/api/validation/genericvalidation"
26-
path "k8s.io/kubernetes/pkg/api/validation/path"
26+
"k8s.io/kubernetes/pkg/api/validation/path"
2727
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
2828
)
2929

@@ -61,7 +61,7 @@ func BeforeCreate(strategy RESTCreateStrategy, ctx genericapirequest.Context, ob
6161
}
6262

6363
if strategy.NamespaceScoped() {
64-
if !api.ValidNamespace(ctx, objectMeta) {
64+
if !ValidNamespace(ctx, objectMeta) {
6565
return errors.NewBadRequest("the namespace of the provided object does not match the namespace sent on the request")
6666
}
6767
} else {
@@ -70,7 +70,7 @@ func BeforeCreate(strategy RESTCreateStrategy, ctx genericapirequest.Context, ob
7070
objectMeta.DeletionTimestamp = nil
7171
objectMeta.DeletionGracePeriodSeconds = nil
7272
strategy.PrepareForCreate(ctx, obj)
73-
api.FillObjectMetaSystemFields(ctx, objectMeta)
73+
FillObjectMetaSystemFields(ctx, objectMeta)
7474
api.GenerateName(strategy, objectMeta)
7575

7676
// ClusterName is ignored and should not be saved

‎pkg/api/rest/meta.go

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
Copyright 2017 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package rest
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
"k8s.io/kubernetes/pkg/api"
22+
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
23+
"k8s.io/kubernetes/pkg/util/uuid"
24+
)
25+
26+
// FillObjectMetaSystemFields populates fields that are managed by the system on ObjectMeta.
27+
func FillObjectMetaSystemFields(ctx genericapirequest.Context, meta *api.ObjectMeta) {
28+
meta.CreationTimestamp = metav1.Now()
29+
// allows admission controllers to assign a UID earlier in the request processing
30+
// to support tracking resources pending creation.
31+
uid, found := genericapirequest.UIDFrom(ctx)
32+
if !found {
33+
uid = uuid.NewUUID()
34+
}
35+
meta.UID = uid
36+
meta.SelfLink = ""
37+
}
38+
39+
// ValidNamespace returns false if the namespace on the context differs from the resource. If the resource has no namespace, it is set to the value in the context.
40+
// TODO(sttts): move into pkg/genericapiserver/api
41+
func ValidNamespace(ctx genericapirequest.Context, resource *api.ObjectMeta) bool {
42+
ns, ok := genericapirequest.NamespaceFrom(ctx)
43+
if len(resource.Namespace) == 0 {
44+
resource.Namespace = ns
45+
}
46+
return ns == resource.Namespace && ok
47+
}

‎pkg/api/rest/meta_test.go

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
/*
2+
Copyright 2017 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package rest
18+
19+
import (
20+
"testing"
21+
22+
"k8s.io/kubernetes/pkg/api"
23+
genericapirequest "k8s.io/kubernetes/pkg/genericapiserver/api/request"
24+
"k8s.io/kubernetes/pkg/util/uuid"
25+
)
26+
27+
// TestFillObjectMetaSystemFields validates that system populated fields are set on an object
28+
func TestFillObjectMetaSystemFields(t *testing.T) {
29+
ctx := genericapirequest.NewDefaultContext()
30+
resource := api.ObjectMeta{}
31+
FillObjectMetaSystemFields(ctx, &resource)
32+
if resource.CreationTimestamp.Time.IsZero() {
33+
t.Errorf("resource.CreationTimestamp is zero")
34+
} else if len(resource.UID) == 0 {
35+
t.Errorf("resource.UID missing")
36+
}
37+
// verify we can inject a UID
38+
uid := uuid.NewUUID()
39+
ctx = genericapirequest.WithUID(ctx, uid)
40+
resource = api.ObjectMeta{}
41+
FillObjectMetaSystemFields(ctx, &resource)
42+
if resource.UID != uid {
43+
t.Errorf("resource.UID expected: %v, actual: %v", uid, resource.UID)
44+
}
45+
}
46+
47+
// TestHasObjectMetaSystemFieldValues validates that true is returned if and only if all fields are populated
48+
func TestHasObjectMetaSystemFieldValues(t *testing.T) {
49+
ctx := genericapirequest.NewDefaultContext()
50+
resource := api.ObjectMeta{}
51+
if api.HasObjectMetaSystemFieldValues(&resource) {
52+
t.Errorf("the resource does not have all fields yet populated, but incorrectly reports it does")
53+
}
54+
FillObjectMetaSystemFields(ctx, &resource)
55+
if !api.HasObjectMetaSystemFieldValues(&resource) {
56+
t.Errorf("the resource does have all fields populated, but incorrectly reports it does not")
57+
}
58+
}
59+
60+
// TestValidNamespace validates that namespace rules are enforced on a resource prior to create or update
61+
func TestValidNamespace(t *testing.T) {
62+
ctx := genericapirequest.NewDefaultContext()
63+
namespace, _ := genericapirequest.NamespaceFrom(ctx)
64+
resource := api.ReplicationController{}
65+
if !ValidNamespace(ctx, &resource.ObjectMeta) {
66+
t.Fatalf("expected success")
67+
}
68+
if namespace != resource.Namespace {
69+
t.Fatalf("expected resource to have the default namespace assigned during validation")
70+
}
71+
resource = api.ReplicationController{ObjectMeta: api.ObjectMeta{Namespace: "other"}}
72+
if ValidNamespace(ctx, &resource.ObjectMeta) {
73+
t.Fatalf("Expected error that resource and context errors do not match because resource has different namespace")
74+
}
75+
ctx = genericapirequest.NewContext()
76+
if ValidNamespace(ctx, &resource.ObjectMeta) {
77+
t.Fatalf("Expected error that resource and context errors do not match since context has no namespace")
78+
}
79+
80+
ctx = genericapirequest.NewContext()
81+
ns := genericapirequest.NamespaceValue(ctx)
82+
if ns != "" {
83+
t.Fatalf("Expected the empty string")
84+
}
85+
}

‎pkg/api/rest/update.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func BeforeUpdate(strategy RESTUpdateStrategy, ctx genericapirequest.Context, ob
8181
return kerr
8282
}
8383
if strategy.NamespaceScoped() {
84-
if !api.ValidNamespace(ctx, objectMeta) {
84+
if !ValidNamespace(ctx, objectMeta) {
8585
return errors.NewBadRequest("the namespace of the provided object does not match the namespace sent on the request")
8686
}
8787
} else {

‎pkg/apis/abac/v0/BUILD

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ go_library(
2222
"//vendor:k8s.io/apimachinery/pkg/conversion",
2323
"//vendor:k8s.io/apimachinery/pkg/runtime",
2424
"//vendor:k8s.io/apimachinery/pkg/runtime/schema",
25-
"//vendor:k8s.io/apiserver/pkg/authentication/user",
2625
],
2726
)
2827

0 commit comments

Comments
 (0)