Skip to content
This repository was archived by the owner on Mar 22, 2018. It is now read-only.

Commit 6d902a6

Browse files
dimsdims
committed
Cleanup k8s-keystone-auth
- Move files around - fix logging levels - fail unauthenticated users in sample policy.json
1 parent 3e2a042 commit 6d902a6

8 files changed

Lines changed: 56 additions & 50 deletions

File tree

‎cmd/k8s-keystone-auth/main.go‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,17 @@ limitations under the License.
1515
package main
1616

1717
import (
18-
flag "github.com/spf13/pflag"
19-
"log"
18+
"flag"
19+
"github.com/golang/glog"
20+
"github.com/spf13/pflag"
2021
"net/http"
2122

22-
"git.openstack.org/openstack/openstack-cloud-controller-manager/pkg/authenticator/token/keystone"
23+
"git.openstack.org/openstack/openstack-cloud-controller-manager/pkg/identity/keystone"
2324
"git.openstack.org/openstack/openstack-cloud-controller-manager/pkg/identity/webhook"
2425
"k8s.io/apiserver/pkg/authentication/authenticator"
2526
"k8s.io/apiserver/pkg/authorization/authorizer"
27+
kflag "k8s.io/apiserver/pkg/util/flag"
28+
"k8s.io/apiserver/pkg/util/logs"
2629
)
2730

2831
func webhookServer(authenticator authenticator.Token, authorizer authorizer.Authorizer) http.Handler {
@@ -42,35 +45,39 @@ var (
4245
)
4346

4447
func main() {
45-
flag.StringVar(&listenAddr, "listen", "localhost:8443", "<address>:<port> to listen on")
46-
flag.StringVar(&tlsCertFile, "tls-cert-file", "", "File containing the default x509 Certificate for HTTPS.")
47-
flag.StringVar(&tlsPrivateKey, "tls-private-key-file", "", "File containing the default x509 private key matching --tls-cert-file.")
48-
flag.StringVar(&keystoneURL, "keystone-url", "http://localhost/identity/v3/", "URL for the OpenStack Keystone API")
49-
flag.StringVar(&keystoneCaFile, "keystone-ca-file", "", "File containing the certificate authority for Keystone Service.")
50-
flag.StringVar(&policyFile, "keystone-policy-file", "", "File containing the policy.")
51-
flag.Parse()
48+
flag.CommandLine.Parse([]string{})
49+
pflag.StringVar(&listenAddr, "listen", "0.0.0.0:8443", "<address>:<port> to listen on")
50+
pflag.StringVar(&tlsCertFile, "tls-cert-file", "", "File containing the default x509 Certificate for HTTPS.")
51+
pflag.StringVar(&tlsPrivateKey, "tls-private-key-file", "", "File containing the default x509 private key matching --tls-cert-file.")
52+
pflag.StringVar(&keystoneURL, "keystone-url", "http://localhost/identity/v3/", "URL for the OpenStack Keystone API")
53+
pflag.StringVar(&keystoneCaFile, "keystone-ca-file", "", "File containing the certificate authority for Keystone Service.")
54+
pflag.StringVar(&policyFile, "keystone-policy-file", "", "File containing the policy.")
55+
56+
kflag.InitFlags()
57+
logs.InitLogs()
58+
defer logs.FlushLogs()
5259

5360
if tlsCertFile == "" || tlsPrivateKey == "" {
54-
log.Fatal("Please specify --tls-cert-file and --tls-private-key-file arguments.")
61+
glog.Fatal("Please specify --tls-cert-file and --tls-private-key-file arguments.")
5562
}
5663
if policyFile == "" {
57-
log.Printf("Argument --keystone-policy-file missing. Only keystone authentication will work. Use RBAC for authorization.")
64+
glog.Infof("Argument --keystone-policy-file missing. Only keystone authentication will work. Use RBAC for authorization.")
5865
}
5966

6067
authentication_handler, err := keystone.NewKeystoneAuthenticator(keystoneURL, keystoneCaFile)
6168
if err != nil {
62-
log.Fatal(err.Error())
69+
glog.Fatal(err.Error())
6370
}
6471

6572
authorization_handler, err := keystone.NewKeystoneAuthorizer(keystoneURL, keystoneCaFile, policyFile)
6673
if err != nil {
67-
log.Fatal(err.Error())
74+
glog.Fatal(err.Error())
6875
}
6976

7077
http.Handle("/webhook", webhookServer(authentication_handler, authorization_handler))
71-
log.Println("Starting webhook..")
72-
log.Fatal(
73-
http.ListenAndServeTLS(":8443",
78+
glog.Infof("Starting webhook..")
79+
glog.Fatal(
80+
http.ListenAndServeTLS(listenAddr,
7481
tlsCertFile,
7582
tlsPrivateKey,
7683
nil))

‎examples/webhook/policy.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
},
2121
"match": {
2222
"type": "group",
23-
"value": "*"
23+
"value": "system:authenticated"
2424
}
2525
},
2626
{
@@ -40,7 +40,7 @@
4040
},
4141
"match": {
4242
"type": "group",
43-
"value": "*"
43+
"value": "system:authenticated"
4444
}
4545
}
4646
]

pkg/authenticator/token/keystone/authenticator.go renamed to pkg/identity/keystone/authenticator.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,14 @@ func (keystoneAuthenticator *KeystoneAuthenticator) AuthenticateToken(token stri
5050
url := keystoneAuthenticator.client.ServiceURL("auth", "tokens")
5151
response, err := keystoneAuthenticator.client.Request("GET", url, &request_opts)
5252
if err != nil {
53-
glog.V(4).Info("Failed: bad response from API call: %v", err)
53+
glog.Warningf("Failed: bad response from API call: %v", err)
5454
return nil, false, errors.New("Failed to authenticate")
5555
}
5656

5757
defer response.Body.Close()
5858
bodyBytes, err := ioutil.ReadAll(response.Body)
5959
if err != nil {
60-
glog.V(4).Infof("Cannot get HTTP response body from keystone token validate: %v", err)
60+
glog.Warningf("Cannot get HTTP response body from keystone token validate: %v", err)
6161
return nil, false, errors.New("Failed to authenticate")
6262
}
6363

@@ -79,7 +79,7 @@ func (keystoneAuthenticator *KeystoneAuthenticator) AuthenticateToken(token stri
7979

8080
err = json.Unmarshal(bodyBytes, &obj)
8181
if err != nil {
82-
glog.V(4).Infof("Cannot unmarshal response: %v", err)
82+
glog.Warningf("Cannot unmarshal response: %v", err)
8383
return nil, false, errors.New("Failed to authenticate")
8484
}
8585

pkg/authenticator/token/keystone/authorizer.go renamed to pkg/identity/keystone/authorizer.go

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,32 +17,33 @@ limitations under the License.
1717
package keystone
1818

1919
import (
20+
"encoding/json"
21+
22+
"github.com/golang/glog"
2023
"github.com/gophercloud/gophercloud"
21-
"log"
2224

23-
"encoding/json"
2425
"k8s.io/apiserver/pkg/authorization/authorizer"
2526
)
2627

2728
type KeystoneAuthorizer struct {
2829
authURL string
2930
client *gophercloud.ServiceClient
30-
pl policyList
31+
pl PolicyList
3132
}
3233

3334
func resourceMatches(p Policy, a authorizer.Attributes) bool {
3435
if p.NonResourceSpec != nil && p.ResourceSpec != nil {
35-
log.Printf("Policy has both resource and nonresource sections. skipping : %#v", p)
36+
glog.Infof("Policy has both resource and nonresource sections. skipping : %#v", p)
3637
return false
3738
}
3839

3940
if p.ResourceSpec.Verb == "" {
40-
log.Printf("verb is empty. skipping : %#v", p)
41+
glog.Infof("verb is empty. skipping : %#v", p)
4142
return false
4243
}
4344

4445
if p.ResourceSpec.APIGroup == nil || p.ResourceSpec.Namespace == nil || p.ResourceSpec.Resource == nil {
45-
log.Printf("version/namespace/resource should be all set. skipping : %#v", p)
46+
glog.Infof("version/namespace/resource should be all set. skipping : %#v", p)
4647
return false
4748
}
4849

@@ -54,7 +55,7 @@ func resourceMatches(p Policy, a authorizer.Attributes) bool {
5455
if allowed {
5556
output, err := json.MarshalIndent(p, "", " ")
5657
if err == nil {
57-
log.Printf(">>>> matched rule : %s", string(output))
58+
glog.V(6).Infof("matched rule : %s", string(output))
5859
}
5960
return true
6061
}
@@ -67,12 +68,12 @@ func resourceMatches(p Policy, a authorizer.Attributes) bool {
6768

6869
func nonResourceMatches(p Policy, a authorizer.Attributes) bool {
6970
if p.NonResourceSpec.Verb == "" {
70-
log.Printf("verb is empty. skipping : %#v", p)
71+
glog.Infof("verb is empty. skipping : %#v", p)
7172
return false
7273
}
7374

7475
if p.NonResourceSpec.NonResourcePath == nil {
75-
log.Printf("path should be set. skipping : %#v", p)
76+
glog.Infof("path should be set. skipping : %#v", p)
7677
return false
7778
}
7879

@@ -83,7 +84,7 @@ func nonResourceMatches(p Policy, a authorizer.Attributes) bool {
8384
if allowed {
8485
output, err := json.MarshalIndent(p, "", " ")
8586
if err == nil {
86-
log.Printf(">>>> matched rule : %s", string(output))
87+
glog.V(6).Infof("matched rule : %s", string(output))
8788
}
8889
return true
8990
}
@@ -138,16 +139,16 @@ func match(match Match, attributes authorizer.Attributes) bool {
138139
}
139140
}
140141
} else {
141-
log.Printf("unknown type %s. skipping.", match.Type)
142+
glog.Infof("unknown type %s. skipping.", match.Type)
142143
}
143144
return false
144145
}
145146

146147
func (KeystoneAuthorizer *KeystoneAuthorizer) Authorize(a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
147-
log.Printf("Authorizing user : %#v\n", a.GetUser())
148+
glog.Infof("Authorizing user : %#v\n", a.GetUser())
148149
for _, p := range KeystoneAuthorizer.pl {
149150
if p.NonResourceSpec != nil && p.ResourceSpec != nil {
150-
log.Printf("Policy has both resource and nonresource sections. skipping : %#v", p)
151+
glog.Infof("Policy has both resource and nonresource sections. skipping : %#v", p)
151152
continue
152153
}
153154
if p.ResourceSpec != nil {

pkg/authenticator/token/keystone/keystone.go renamed to pkg/identity/keystone/keystone.go

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,7 @@ import (
2121
"encoding/json"
2222
"errors"
2323
"fmt"
24-
"log"
2524
"net/http"
26-
//"strings"
2725

2826
"github.com/golang/glog"
2927
"github.com/gophercloud/gophercloud"
@@ -89,11 +87,11 @@ func createKeystoneClient(authURL string, caFile string) (*gophercloud.ServiceCl
8987
// We should use the V3 API
9088
client, err := openstack.NewIdentityV3(provider, gophercloud.EndpointOpts{})
9189
if err != nil {
92-
glog.V(4).Info("Failed: Unable to use keystone v3 identity service: %v", err)
90+
glog.Warningf("Failed: Unable to use keystone v3 identity service: %v", err)
9391
return nil, errors.New("Failed to authenticate")
9492
}
9593
if err != nil {
96-
glog.V(4).Info("Failed: Starting openstack authenticate client: %v", err)
94+
glog.Warningf("Failed: Starting openstack authenticate client: %v", err)
9795
return nil, errors.New("Failed to authenticate")
9896
}
9997

@@ -122,9 +120,9 @@ func NewKeystoneAuthorizer(authURL string, caFile string, policyFile string) (*K
122120
policyList, err := NewFromFile(policyFile)
123121
output, err := json.MarshalIndent(policyList, "", " ")
124122
if err == nil {
125-
log.Printf(">>> Policy %s", string(output))
123+
glog.V(6).Infof("Policy %s", string(output))
126124
} else {
127-
log.Fatalf(">>> Error %#v", err)
125+
glog.V(6).Infof("Error %#v", err)
128126
}
129127

130128
return &KeystoneAuthorizer{authURL: authURL, client: client, pl: policyList}, nil

pkg/authenticator/token/keystone/policy.go renamed to pkg/identity/keystone/policy.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,16 +66,16 @@ type NonResourcePolicySpec struct {
6666
NonResourcePath *string `json:"path"`
6767
}
6868

69-
type policyList []*Policy
69+
type PolicyList []*Policy
7070

71-
func NewFromFile(path string) (policyList, error) {
71+
func NewFromFile(path string) (PolicyList, error) {
7272
file, err := os.Open(path)
7373
if err != nil {
7474
return nil, err
7575
}
7676
defer file.Close()
7777

78-
var data policyList
78+
var data PolicyList
7979

8080
reader := bufio.NewReader(file)
8181
decoder := json.NewDecoder(reader)

pkg/identity/webhook/handlers.go renamed to pkg/identity/webhook/webhook.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ import (
1919
"fmt"
2020
"net/http"
2121

22+
"github.com/golang/glog"
23+
2224
"k8s.io/apiserver/pkg/authentication/authenticator"
2325
"k8s.io/apiserver/pkg/authentication/user"
2426
"k8s.io/apiserver/pkg/authorization/authorizer"
25-
"log"
2627
)
2728

2829
type userInfo struct {
@@ -71,9 +72,8 @@ func (h *WebhookHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
7172
}
7273

7374
func (h *WebhookHandler) authenticateToken(w http.ResponseWriter, r *http.Request, token string, data map[string]interface{}) {
74-
//log.Printf(">>>> authenticateToken data : %#v\n", data)
7575
user, authenticated, err := h.Authenticator.AuthenticateToken(token)
76-
log.Printf("<<<< authenticateToken : %v, %v, %v\n", token, user, err)
76+
glog.V(6).Infof("authenticateToken : %v, %v, %v\n", token, user, err)
7777

7878
if !authenticated {
7979
var response status
@@ -122,7 +122,7 @@ func getField(data map[string]interface{}, name string) string {
122122

123123
func (h *WebhookHandler) authorizeToken(w http.ResponseWriter, r *http.Request, data map[string]interface{}) {
124124
output, err := json.MarshalIndent(data, "", " ")
125-
log.Printf(">>>> authorizeToken data : %s\n", string(output))
125+
glog.V(6).Infof("authorizeToken data : %s\n", string(output))
126126

127127
spec := data["spec"].(map[string]interface{})
128128

@@ -172,7 +172,7 @@ func (h *WebhookHandler) authorizeToken(w http.ResponseWriter, r *http.Request,
172172
}
173173

174174
allowed, reason, err := h.Authorizer.Authorize(attrs)
175-
log.Printf("<<<< authorizeToken : %v, %v, %v\n", allowed, reason, err)
175+
glog.Infof("<<<< authorizeToken : %v, %v, %v\n", allowed, reason, err)
176176
if err != nil {
177177
http.Error(w, reason, http.StatusInternalServerError)
178178
return

‎pkg/volume/cinder/provisioner/provisioner.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ type cinderProvisioner struct {
4343
// Openstack cinder client
4444
VolumeService *gophercloud.ServiceClient
4545

46-
// Kubernetes Client. Use to create secret
46+
// Kubernetes client. Use to create secret
4747
Client kubernetes.Interface
4848
// Identity of this cinderProvisioner, generated. Used to identify "this"
4949
// provisioner's PVs.

0 commit comments

Comments
 (0)