|
| 1 | +/* |
| 2 | +Copyright 2017 The Kubernetes Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package openstack |
| 18 | + |
| 19 | +import ( |
| 20 | + "fmt" |
| 21 | + "net/http" |
| 22 | + "sync" |
| 23 | + "time" |
| 24 | + |
| 25 | + "github.com/golang/glog" |
| 26 | + "github.com/gophercloud/gophercloud/openstack" |
| 27 | + |
| 28 | + restclient "k8s.io/client-go/rest" |
| 29 | +) |
| 30 | + |
| 31 | +func init() { |
| 32 | + if err := restclient.RegisterAuthProviderPlugin("openstack", newOpenstackAuthProvider); err != nil { |
| 33 | + glog.Fatalf("Failed to register openstack auth plugin: %s", err) |
| 34 | + } |
| 35 | +} |
| 36 | + |
| 37 | +// DefaultTTLDuration is the time before a token gets expired. |
| 38 | +const DefaultTTLDuration = 10 * time.Minute |
| 39 | + |
| 40 | +// openstackAuthProvider is an authprovider for openstack. this provider reads |
| 41 | +// the environment variables to determine the client identity, and generates a |
| 42 | +// token which will be inserted into the request header later. |
| 43 | +type openstackAuthProvider struct { |
| 44 | + ttl time.Duration |
| 45 | + |
| 46 | + tokenGetter TokenGetter |
| 47 | +} |
| 48 | + |
| 49 | +// TokenGetter returns a bearer token that can be inserted into request. |
| 50 | +type TokenGetter interface { |
| 51 | + Token() (string, error) |
| 52 | +} |
| 53 | + |
| 54 | +type tokenGetter struct{} |
| 55 | + |
| 56 | +// Token creates a token by authenticate with keystone. |
| 57 | +func (*tokenGetter) Token() (string, error) { |
| 58 | + options, err := openstack.AuthOptionsFromEnv() |
| 59 | + if err != nil { |
| 60 | + return "", fmt.Errorf("failed to read openstack env vars: %s", err) |
| 61 | + } |
| 62 | + client, err := openstack.AuthenticatedClient(options) |
| 63 | + if err != nil { |
| 64 | + return "", fmt.Errorf("authentication failed: %s", err) |
| 65 | + } |
| 66 | + return client.TokenID, nil |
| 67 | +} |
| 68 | + |
| 69 | +// cachedGetter caches a token until it gets expired, after the expiration, it will |
| 70 | +// generate another token and cache it. |
| 71 | +type cachedGetter struct { |
| 72 | + mutex sync.Mutex |
| 73 | + tokenGetter TokenGetter |
| 74 | + |
| 75 | + token string |
| 76 | + born time.Time |
| 77 | + ttl time.Duration |
| 78 | +} |
| 79 | + |
| 80 | +// Token returns the current available token, create a new one if expired. |
| 81 | +func (c *cachedGetter) Token() (string, error) { |
| 82 | + c.mutex.Lock() |
| 83 | + defer c.mutex.Unlock() |
| 84 | + |
| 85 | + var err error |
| 86 | + // no token or exceeds the TTL |
| 87 | + if c.token == "" || time.Now().Sub(c.born) > c.ttl { |
| 88 | + c.token, err = c.tokenGetter.Token() |
| 89 | + if err != nil { |
| 90 | + return "", fmt.Errorf("failed to get token: %s", err) |
| 91 | + } |
| 92 | + c.born = time.Now() |
| 93 | + } |
| 94 | + return c.token, nil |
| 95 | +} |
| 96 | + |
| 97 | +// tokenRoundTripper implements the RoundTripper interface: adding the bearer token |
| 98 | +// into the request header. |
| 99 | +type tokenRoundTripper struct { |
| 100 | + http.RoundTripper |
| 101 | + |
| 102 | + tokenGetter TokenGetter |
| 103 | +} |
| 104 | + |
| 105 | +// RoundTrip adds the bearer token into the request. |
| 106 | +func (t *tokenRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) { |
| 107 | + // if the authorization header already present, use it. |
| 108 | + if req.Header.Get("Authorization") != "" { |
| 109 | + return t.RoundTripper.RoundTrip(req) |
| 110 | + } |
| 111 | + |
| 112 | + token, err := t.tokenGetter.Token() |
| 113 | + if err == nil { |
| 114 | + req.Header.Set("Authorization", "Bearer "+token) |
| 115 | + } else { |
| 116 | + glog.V(4).Infof("failed to get token: %s", err) |
| 117 | + } |
| 118 | + |
| 119 | + return t.RoundTripper.RoundTrip(req) |
| 120 | +} |
| 121 | + |
| 122 | +// newOpenstackAuthProvider creates an auth provider which works with openstack |
| 123 | +// environment. |
| 124 | +func newOpenstackAuthProvider(clusterAddress string, config map[string]string, persister restclient.AuthProviderConfigPersister) (restclient.AuthProvider, error) { |
| 125 | + var ttlDuration time.Duration |
| 126 | + var err error |
| 127 | + |
| 128 | + ttl, found := config["ttl"] |
| 129 | + if !found { |
| 130 | + ttlDuration = DefaultTTLDuration |
| 131 | + // persist to config |
| 132 | + config["ttl"] = ttlDuration.String() |
| 133 | + if err = persister.Persist(config); err != nil { |
| 134 | + return nil, fmt.Errorf("failed to persist config: %s", err) |
| 135 | + } |
| 136 | + } else { |
| 137 | + ttlDuration, err = time.ParseDuration(ttl) |
| 138 | + if err != nil { |
| 139 | + return nil, fmt.Errorf("failed to parse ttl config: %s", err) |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | + // TODO: read/persist client configuration(OS_XXX env vars) in config |
| 144 | + |
| 145 | + return &openstackAuthProvider{ |
| 146 | + ttl: ttlDuration, |
| 147 | + tokenGetter: &tokenGetter{}, |
| 148 | + }, nil |
| 149 | +} |
| 150 | + |
| 151 | +func (oap *openstackAuthProvider) WrapTransport(rt http.RoundTripper) http.RoundTripper { |
| 152 | + return &tokenRoundTripper{ |
| 153 | + RoundTripper: rt, |
| 154 | + tokenGetter: &cachedGetter{ |
| 155 | + tokenGetter: oap.tokenGetter, |
| 156 | + ttl: oap.ttl, |
| 157 | + }, |
| 158 | + } |
| 159 | +} |
| 160 | + |
| 161 | +func (oap *openstackAuthProvider) Login() error { return nil } |
0 commit comments