Skip to content

Commit 932411e

Browse files
deads2ksoltysh
deads2k
authored and
soltysh
committed
UPSTREAM: <carry>: openshift-kube-apiserver: add kube-apiserver patches
Origin-commit: 170dd7d25cca990fd7683eaf424d00bcd776c39c Origin-commit: 35ef039cb099dc609c576cf594aadd849212a00b UPSTREAM: <carry>: openshift-kube-apiserver: enabled conversion gen for admission configs UPSTREAM: <carry>: openshift-kube-apiserver/admission: fix featuregates resource name UPSTREAM: <carry>: openshift-kube-apiserver/admission: add missing FeatureSets UPSTREAM: <carry>: openshift-kube-apiserver: use github.com/openshift/apiserver-library-go/pkg/labelselector UPSTREAM: <carry>: openshift authenticator: don't allow old-style tokens UPSTREAM: <carry>: oauth-authn: support sha256 prefixed tokens UPSTREAM: <carry>: oauth-token-authn: switch to sha256~ prefix UPSTREAM: <carry>: oauth-token-authn: add sha256~ support to bootstrap authenticator UPSTREAM: <drop>: remove the openshift authenticator from the apiserver In 4.8, we moved the authenticator to be configured via webhookTokenAuthenticators to an endpoint in the oauth-apiserver, this should now be safe to remove. UPSTREAM: <carry>: set ResourceQuotaValidationOptions to true When PodAffinityNamespaceSelector goes to beta or GA this might affect how our ClusterResourceQuota might work UPSTREAM: <carry>: simplify the authorizer patch to allow the flags to function Origin-commit: 0d7fb2d769d631054ec9ac0721aee623c96c1001 UPSTREAM: <carry>: eliminate unnecessary closure in openshift configuration wiring Origin-commit: 3b0c72dd7b9f9367dda8f8645909d9277a6c29e9 openshift-rebase(v1.24):source=78e37fdfb28 UPSTREAM: <carry>: add crdvalidation for apiserver.spec.tlsSecurityProfile Origin-commit: 84ba7fc304870a30df7136da14bccb4d5232f075 openshift-rebase(v1.24):source=eecae1591a1 UPSTREAM: <carry>: openshift-kube-apiserver: Add custom resource validation for network spec openshift-rebase(v1.24):source=2af991c43b1 UPSTREAM: <carry>: stop overriding flags that are explicitly set openshift-rebase(v1.24):source=8355d726bbf UPSTREAM: <carry>: add readyz check for openshift apiserver availability openshift-rebase(v1.24):source=3784942f6fc UPSTREAM: <carry>: wait for oauth-apiserver accessibility openshift-rebase(v1.24):source=0c175222685 UPSTREAM: <carry>: provide a new admission plugin to mutate management pods CPUs requests The ManagementCPUOverride admission plugin replaces pod container CPU requests with a new management resource. It applies to all pods that: 1. are in an allowed namespace 2. and have the workload annotation. It also sets the new management resource request and limit and set resource annotation that CRI-O can recognize and apply the relevant changes. For more information, see - openshift/enhancements#703 Conditions for CPUs requests deletion: 1. The namespace should have allowed annotation "workload.openshift.io/allowed": "management" 2. The pod should have management annotation: "workload.openshift.io/management": "{"effect": "PreferredDuringScheduling"}" 3. All nodes under the cluster should have new management resource - "management.workload.openshift.io/cores" 4. The CPU request deletion will not change the pod QoS class Signed-off-by: Artyom Lukianov <[email protected]> UPSTREAM: <carry>: Does not prevent pod creation because of no nodes reason when it runs under the regular cluster Check the `cluster` infrastructure resource status to be sure that we run on top of a SNO cluster and in case if the pod runs on top of regular cluster, exit before node existence check. Signed-off-by: Artyom Lukianov <[email protected]> UPSTREAM: <carry>: do not mutate pods when it has a container with both CPU request and limit Removing the CPU request from the container that has a CPU limit will result in the defaulter to set the CPU request back equals to the CPU limit. Signed-off-by: Artyom Lukianov <[email protected]> UPSTREAM: <carry>: Reject the pod creation when we can not decide the cluster type It is possible a race condition between pod creation and the update of the infrastructure resource status with correct values under Status.ControlPlaneTopology and Status.InfrastructureTopology. Signed-off-by: Artyom Lukianov <[email protected]> openshift-rebase(v1.24):source=ea874aa684f UPSTREAM: <carry>: add CRD validation for dnses Add an admission plugin that validates the dnses.operator.openshift.io custom resource. For now, the plugin only validates the DNS pod node-placement parameters. This commit fixes bug 1967745. https://bugzilla.redhat.com/show_bug.cgi?id=1967745 * openshift-kube-apiserver/admission/customresourcevalidation/attributes.go (init): Install operatorv1 into supportedObjectsScheme. * openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration/cr_validation_registration.go (AllCustomResourceValidators, RegisterCustomResourceValidation): Register the new plugin. * openshift-kube-apiserver/admission/customresourcevalidation/dns/validate_dns.go: New file. (PluginName): New const. (Register): New function. Register the plugin. (toDNSV1): New function. Convert a runtime object to a versioned DNS. (dnsV1): New type to represent a runtime object that is validated as a versioned DNS. (ValidateCreate, ValidateUpdate, ValidateStatusUpdate): New methods. Implement the ObjectValidator interface, using the validateDNSSpecCreate and validateDNSSpecUpdate helpers. (validateDNSSpecCreate, validateDNSSpecUpdate): New functions. Validate a DNS, using the validateDNSSpec helper. (validateDNSSpec): New function. Validate the spec field of a DNS, using the validateDNSNodePlacement helper. (validateDNSNodePlacement): New function. Validate the node selector and tolerations in a DNS's node-placement parameters, using validateTolerations. (validateTolerations): New function. Validate a slice of corev1.Toleration. * openshift-kube-apiserver/admission/customresourcevalidation/dns/validate_dns_test.go: New file. (TestFailValidateDNSSpec): Verify that validateDNSSpec rejects invalid DNS specs. (TestSucceedValidateDNSSpec): Verify that validateDNSSpec accepts valid DNS specs. * vendor/*: Regenerate. openshift-rebase(v1.24):source=bd9a55803db UPSTREAM: <carry>: prevent the kubecontrollermanager service-ca from getting less secure openshift-rebase(v1.24):source=cc96bfa11af UPSTREAM: <carry>: allow SCC to be disabled on a per-namespace basis openshift-rebase(v1.24):source=6f2d9a525bc UPSTREAM: <carry>: verify required http2 cipher suites In the Apiserver admission, we need to return an error if the required http2 cipher suites are missing from a custom tlsSecurityProfile. Currently, custom cipher suites missing ECDHE_RSA_WITH_AES_128_GCM_SHA256 or ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 result in invalid http2 Server configuration causing the apiservers to crash. See: go/x/net/http2.ConfigureServer for futher information. Signed-off-by: Damien Grisonnet <[email protected]> openshift-rebase(v1.24):source=e2fb8191644 UPSTREAM: <carry>: drop the warning to use --keep-annotations When a user runs the `oc debug` command for the pod with the management resource, we will inform him that he should pass `--keep-annotations` parameter to the debug command. Signed-off-by: Artyom Lukianov <[email protected]> openshift-rebase(v1.24):source=9726268c979 UPSTREAM: <carry>: admission/managementcpusoverride: cover the roll-back case During the upgrade and roll-back flow 4.7->4.8->4.7, the topology related fields under the infrastructure can be empty because the old API does not support them. The code will equal the empty infrastructure section with the current one. When the status has some other non-empty field, and topology fields are empty, we assume that the cluster currently passes via roll-back and not via the clean install. Signed-off-by: Artyom Lukianov <[email protected]> openshift-rebase(v1.24):source=35a93248f51 UPSTREAM: <carry>: Remove pod warning annotation when workload partitioning is disabled openshift-rebase(v1.24):source=67e1c1dac22 UPSTREAM: <carry>: use new access token inactivity timeout field. openshift-rebase(v1.24):source=79be14211df UPSTREAM: <carry>: apirequestcount validation openshift-rebase(v1.24):source=5fbf4195cbb UPSTREAM: <carry>: Added config node object validation for extreme latency profiles Signed-off-by: Swarup Ghosh <[email protected]> UPSTREAM: <carry>: Add Upstream validation in the DNS admission check patches UPSTREAM: <carry>: Make RestrictedEndpointsAdmission check NotReadyAddresses UPSTREAM: <carry>: Make RestrictedEndpointsAdmission restrict EndpointSlices as well openshift-rebase(v1.24):source=819a64c501a
1 parent bcf574c commit 932411e

File tree

162 files changed

+16879
-52
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

162 files changed

+16879
-52
lines changed

‎cmd/kube-apiserver/app/patch_openshift.go

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎cmd/kube-apiserver/app/server.go

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ import (
2929
"strings"
3030
"time"
3131

32-
"k8s.io/kubernetes/openshift-kube-apiserver/configdefault"
32+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/admissionenablement"
3333
"k8s.io/kubernetes/openshift-kube-apiserver/enablement"
3434
"k8s.io/kubernetes/openshift-kube-apiserver/openshiftkubeapiserver"
3535

@@ -123,28 +123,32 @@ cluster's shared state through which all other components interact.`,
123123
cliflag.PrintFlags(fs)
124124

125125
if len(s.OpenShiftConfig) > 0 {
126-
enablement.ForceOpenShift()
126+
// if we are running openshift, we modify the admission chain defaults accordingly
127+
admissionenablement.InstallOpenShiftAdmissionPlugins(s)
128+
127129
openshiftConfig, err := enablement.GetOpenshiftConfig(s.OpenShiftConfig)
128130
if err != nil {
129131
klog.Fatal(err)
130132
}
131-
132-
// this forces a patch to be called
133-
// TODO we're going to try to remove bits of the patching.
134-
configPatchFn, serverPatchContext := openshiftkubeapiserver.NewOpenShiftKubeAPIServerConfigPatch(genericapiserver.NewEmptyDelegate(), openshiftConfig)
135-
OpenShiftKubeAPIServerConfigPatch = configPatchFn
136-
OpenShiftKubeAPIServerServerPatch = serverPatchContext.PatchServer
133+
enablement.ForceOpenShift(openshiftConfig)
137134

138135
args, err := openshiftkubeapiserver.ConfigToFlags(openshiftConfig)
139136
if err != nil {
140137
return err
141138
}
139+
142140
// hopefully this resets the flags?
143141
if err := cmd.ParseFlags(args); err != nil {
144142
return err
145143
}
146144

147-
enablement.ForceGlobalInitializationForOpenShift(s)
145+
// print merged flags (merged from OpenshiftConfig)
146+
cliflag.PrintFlags(cmd.Flags())
147+
148+
enablement.ForceGlobalInitializationForOpenShift()
149+
} else {
150+
// print default flags
151+
cliflag.PrintFlags(cmd.Flags())
148152
}
149153

150154
// set default options
@@ -230,10 +234,6 @@ func CreateServerChain(completedOptions completedServerRunOptions) (*aggregatora
230234
return nil, err
231235
}
232236

233-
if err := PatchKubeAPIServerServer(kubeAPIServer); err != nil {
234-
return nil, err
235-
}
236-
237237
// aggregator comes last in the chain
238238
aggregatorConfig, err := createAggregatorConfig(*kubeAPIServerConfig.GenericConfig, completedOptions.ServerRunOptions, kubeAPIServerConfig.ExtraConfig.VersionedInformers, serviceResolver, kubeAPIServerConfig.ExtraConfig.ProxyTransport, pluginInitializer)
239239
if err != nil {
@@ -472,6 +472,8 @@ func buildGenericConfig(
472472
// on a fast local network
473473
genericConfig.LoopbackClientConfig.DisableCompression = true
474474

475+
enablement.SetLoopbackClientConfig(genericConfig.LoopbackClientConfig)
476+
475477
kubeClientConfig := genericConfig.LoopbackClientConfig
476478
clientgoExternalClient, err := clientgoclientset.NewForConfig(kubeClientConfig)
477479
if err != nil {
@@ -511,14 +513,13 @@ func buildGenericConfig(
511513
return
512514
}
513515

514-
StartingDelegate, err = PatchKubeAPIServerConfig(genericConfig, versionedInformers, &pluginInitializers)
515-
if err != nil {
516+
if err := openshiftkubeapiserver.OpenShiftKubeAPIServerConfigPatch(genericConfig, versionedInformers, &pluginInitializers); err != nil {
516517
lastErr = fmt.Errorf("failed to patch: %v", err)
517518
return
518519
}
519520

520521
if enablement.IsOpenShift() {
521-
configdefault.SetAdmissionDefaults(s, versionedInformers, clientgoExternalClient)
522+
admissionenablement.SetAdmissionDefaults(s, versionedInformers, clientgoExternalClient)
522523
}
523524
err = s.Admission.ApplyTo(
524525
genericConfig,

‎openshift-kube-apiserver/admission/admissionenablement/admission.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package admissionenablement
2+
3+
import (
4+
"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
5+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
6+
)
7+
8+
func InstallOpenShiftAdmissionPlugins(o *options.ServerRunOptions) {
9+
existingAdmissionOrder := o.Admission.GenericAdmission.RecommendedPluginOrder
10+
o.Admission.GenericAdmission.RecommendedPluginOrder = NewOrderedKubeAdmissionPlugins(existingAdmissionOrder)
11+
RegisterOpenshiftKubeAdmissionPlugins(o.Admission.GenericAdmission.Plugins)
12+
customresourcevalidationregistration.RegisterCustomResourceValidation(o.Admission.GenericAdmission.Plugins)
13+
existingDefaultOff := o.Admission.GenericAdmission.DefaultOffPlugins
14+
o.Admission.GenericAdmission.DefaultOffPlugins = NewDefaultOffPluginsFunc(existingDefaultOff)()
15+
}

‎openshift-kube-apiserver/admission/admissionenablement/admission_config.go

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
package admissionenablement
2+
3+
import (
4+
"time"
5+
6+
"github.com/openshift/library-go/pkg/apiserver/admission/admissiontimeout"
7+
"k8s.io/apimachinery/pkg/labels"
8+
"k8s.io/apiserver/pkg/admission"
9+
"k8s.io/client-go/informers"
10+
"k8s.io/client-go/kubernetes"
11+
"k8s.io/kubernetes/cmd/kube-apiserver/app/options"
12+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/namespaceconditions"
13+
)
14+
15+
const disableSCCLevelLabel = "security.openshift.io/disable-securitycontextconstraints"
16+
17+
var enforceSCCSelector labels.Selector
18+
19+
func init() {
20+
var err error
21+
enforceSCCSelector, err = labels.Parse(disableSCCLevelLabel + " != true")
22+
if err != nil {
23+
panic(err)
24+
}
25+
}
26+
27+
func SetAdmissionDefaults(o *options.ServerRunOptions, informers informers.SharedInformerFactory, kubeClient kubernetes.Interface) {
28+
// set up the decorators we need. This is done late and out of order because our decorators currently require informers which are not
29+
// present until we start running
30+
namespaceLabelDecorator := namespaceconditions.NamespaceLabelConditions{
31+
NamespaceClient: kubeClient.CoreV1(),
32+
NamespaceLister: informers.Core().V1().Namespaces().Lister(),
33+
34+
SkipLevelZeroNames: SkipRunLevelZeroPlugins,
35+
SkipLevelOneNames: SkipRunLevelOnePlugins,
36+
}
37+
sccLabelDecorator := namespaceconditions.NewConditionalAdmissionPlugins(
38+
kubeClient.CoreV1(), informers.Core().V1().Namespaces().Lister(), enforceSCCSelector,
39+
"security.openshift.io/SecurityContextConstraint", "security.openshift.io/SCCExecRestrictions")
40+
41+
o.Admission.GenericAdmission.Decorators = append(o.Admission.GenericAdmission.Decorators,
42+
admission.Decorators{
43+
// SCC can be skipped by setting a namespace label `security.openshift.io/disable-securitycontextconstraints = true`
44+
// This is useful for disabling SCC and using PodSecurity admission instead.
45+
admission.DecoratorFunc(sccLabelDecorator.WithNamespaceLabelSelector),
46+
47+
admission.DecoratorFunc(namespaceLabelDecorator.WithNamespaceLabelConditions),
48+
admission.DecoratorFunc(admissiontimeout.AdmissionTimeout{Timeout: 13 * time.Second}.WithTimeout),
49+
},
50+
)
51+
}

‎openshift-kube-apiserver/admission/admissionenablement/register.go

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
package admissionenablement
2+
3+
import (
4+
"k8s.io/apimachinery/pkg/util/sets"
5+
"k8s.io/apiserver/pkg/admission"
6+
"k8s.io/apiserver/pkg/admission/plugin/resourcequota"
7+
mutatingwebhook "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating"
8+
9+
"github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy"
10+
imagepolicyapiv1 "github.com/openshift/apiserver-library-go/pkg/admission/imagepolicy/apis/imagepolicy/v1"
11+
quotaclusterresourcequota "github.com/openshift/apiserver-library-go/pkg/admission/quota/clusterresourcequota"
12+
"github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sccadmission"
13+
authorizationrestrictusers "k8s.io/kubernetes/openshift-kube-apiserver/admission/authorization/restrictusers"
14+
quotaclusterresourceoverride "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/clusterresourceoverride"
15+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride"
16+
quotarunonceduration "k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/runonceduration"
17+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
18+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/externalipranger"
19+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/restrictedendpoints"
20+
ingressadmission "k8s.io/kubernetes/openshift-kube-apiserver/admission/route"
21+
projectnodeenv "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeenv"
22+
schedulerpodnodeconstraints "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/podnodeconstraints"
23+
)
24+
25+
func RegisterOpenshiftKubeAdmissionPlugins(plugins *admission.Plugins) {
26+
authorizationrestrictusers.Register(plugins)
27+
imagepolicy.Register(plugins)
28+
ingressadmission.Register(plugins)
29+
managementcpusoverride.Register(plugins)
30+
projectnodeenv.Register(plugins)
31+
quotaclusterresourceoverride.Register(plugins)
32+
quotaclusterresourcequota.Register(plugins)
33+
quotarunonceduration.Register(plugins)
34+
schedulerpodnodeconstraints.Register(plugins)
35+
sccadmission.Register(plugins)
36+
sccadmission.RegisterSCCExecRestrictions(plugins)
37+
externalipranger.RegisterExternalIP(plugins)
38+
restrictedendpoints.RegisterRestrictedEndpoints(plugins)
39+
}
40+
41+
var (
42+
43+
// these are admission plugins that cannot be applied until after the kubeapiserver starts.
44+
// TODO if nothing comes to mind in 3.10, kill this
45+
SkipRunLevelZeroPlugins = sets.NewString()
46+
// these are admission plugins that cannot be applied until after the openshiftapiserver apiserver starts.
47+
SkipRunLevelOnePlugins = sets.NewString(
48+
imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
49+
"quota.openshift.io/ClusterResourceQuota",
50+
"security.openshift.io/SecurityContextConstraint",
51+
"security.openshift.io/SCCExecRestrictions",
52+
)
53+
54+
// openshiftAdmissionPluginsForKubeBeforeMutating are the admission plugins to add after kube admission, before mutating webhooks
55+
openshiftAdmissionPluginsForKubeBeforeMutating = []string{
56+
"autoscaling.openshift.io/ClusterResourceOverride",
57+
managementcpusoverride.PluginName, // "autoscaling.openshift.io/ManagementCPUsOverride"
58+
"authorization.openshift.io/RestrictSubjectBindings",
59+
"autoscaling.openshift.io/RunOnceDuration",
60+
"scheduling.openshift.io/PodNodeConstraints",
61+
"scheduling.openshift.io/OriginPodNodeEnvironment",
62+
"network.openshift.io/ExternalIPRanger",
63+
"network.openshift.io/RestrictedEndpointsAdmission",
64+
imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
65+
"security.openshift.io/SecurityContextConstraint",
66+
"security.openshift.io/SCCExecRestrictions",
67+
"route.openshift.io/IngressAdmission",
68+
}
69+
70+
// openshiftAdmissionPluginsForKubeAfterResourceQuota are the plugins to add after ResourceQuota plugin
71+
openshiftAdmissionPluginsForKubeAfterResourceQuota = []string{
72+
"quota.openshift.io/ClusterResourceQuota",
73+
}
74+
75+
// additionalDefaultOnPlugins is a list of plugins we turn on by default that core kube does not.
76+
additionalDefaultOnPlugins = sets.NewString(
77+
"NodeRestriction",
78+
"OwnerReferencesPermissionEnforcement",
79+
"PersistentVolumeLabel",
80+
"PodNodeSelector",
81+
"PodTolerationRestriction",
82+
"Priority",
83+
imagepolicyapiv1.PluginName, // "image.openshift.io/ImagePolicy"
84+
"StorageObjectInUseProtection",
85+
)
86+
)
87+
88+
func NewOrderedKubeAdmissionPlugins(kubeAdmissionOrder []string) []string {
89+
ret := []string{}
90+
for _, curr := range kubeAdmissionOrder {
91+
if curr == mutatingwebhook.PluginName {
92+
ret = append(ret, openshiftAdmissionPluginsForKubeBeforeMutating...)
93+
ret = append(ret, customresourcevalidationregistration.AllCustomResourceValidators...)
94+
}
95+
96+
ret = append(ret, curr)
97+
98+
if curr == resourcequota.PluginName {
99+
ret = append(ret, openshiftAdmissionPluginsForKubeAfterResourceQuota...)
100+
}
101+
}
102+
return ret
103+
}
104+
105+
func NewDefaultOffPluginsFunc(kubeDefaultOffAdmission sets.String) func() sets.String {
106+
return func() sets.String {
107+
kubeOff := sets.NewString(kubeDefaultOffAdmission.UnsortedList()...)
108+
kubeOff.Delete(additionalDefaultOnPlugins.List()...)
109+
kubeOff.Delete(openshiftAdmissionPluginsForKubeBeforeMutating...)
110+
kubeOff.Delete(openshiftAdmissionPluginsForKubeAfterResourceQuota...)
111+
kubeOff.Delete(customresourcevalidationregistration.AllCustomResourceValidators...)
112+
return kubeOff
113+
}
114+
}

‎openshift-kube-apiserver/admission/admissionenablement/register_test.go

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package admissionenablement
2+
3+
import (
4+
"reflect"
5+
"testing"
6+
7+
"k8s.io/apiserver/pkg/admission"
8+
genericapiserver "k8s.io/apiserver/pkg/server"
9+
"k8s.io/kubernetes/pkg/kubeapiserver/options"
10+
11+
"github.com/openshift/library-go/pkg/apiserver/admission/admissionregistrationtesting"
12+
"k8s.io/kubernetes/openshift-kube-apiserver/admission/customresourcevalidation/customresourcevalidationregistration"
13+
)
14+
15+
func TestAdmissionRegistration(t *testing.T) {
16+
orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins)
17+
defaultOffPlugins := NewDefaultOffPluginsFunc(options.DefaultOffAdmissionPlugins())()
18+
registerAllAdmissionPlugins := func(plugins *admission.Plugins) {
19+
genericapiserver.RegisterAllAdmissionPlugins(plugins)
20+
options.RegisterAllAdmissionPlugins(plugins)
21+
RegisterOpenshiftKubeAdmissionPlugins(plugins)
22+
customresourcevalidationregistration.RegisterCustomResourceValidation(plugins)
23+
}
24+
plugins := admission.NewPlugins()
25+
registerAllAdmissionPlugins(plugins)
26+
27+
err := admissionregistrationtesting.AdmissionRegistrationTest(plugins, orderedAdmissionChain, defaultOffPlugins)
28+
if err != nil {
29+
t.Fatal(err)
30+
}
31+
}
32+
33+
// TestResourceQuotaBeforeClusterResourceQuota simply test wheather ResourceQuota plugin is before ClusterResourceQuota plugin
34+
func TestResourceQuotaBeforeClusterResourceQuota(t *testing.T) {
35+
orderedAdmissionChain := NewOrderedKubeAdmissionPlugins(options.AllOrderedPlugins)
36+
37+
expectedOrderedAdmissionSubChain := []string{"ResourceQuota", "quota.openshift.io/ClusterResourceQuota", "AlwaysDeny"}
38+
actualOrderedAdmissionChain := extractSubChain(orderedAdmissionChain, expectedOrderedAdmissionSubChain[0])
39+
40+
if !reflect.DeepEqual(actualOrderedAdmissionChain, expectedOrderedAdmissionSubChain) {
41+
t.Fatalf("expected %v, got %v ", expectedOrderedAdmissionSubChain, actualOrderedAdmissionChain)
42+
}
43+
}
44+
45+
func extractSubChain(admissionChain []string, takeFrom string) []string {
46+
indexOfTake := 0
47+
for index, admission := range admissionChain {
48+
if admission == takeFrom {
49+
indexOfTake = index
50+
break
51+
}
52+
}
53+
return admissionChain[indexOfTake:]
54+
}

‎openshift-kube-apiserver/admission/authorization/restrictusers/groupcache_test.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package restrictusers
2+
3+
import (
4+
userv1 "github.com/openshift/api/user/v1"
5+
)
6+
7+
type fakeGroupCache struct {
8+
groups []userv1.Group
9+
}
10+
11+
func (g fakeGroupCache) GroupsFor(user string) ([]*userv1.Group, error) {
12+
ret := []*userv1.Group{}
13+
for i := range g.groups {
14+
group := &g.groups[i]
15+
for _, currUser := range group.Users {
16+
if user == currUser {
17+
ret = append(ret, group)
18+
break
19+
}
20+
}
21+
22+
}
23+
return ret, nil
24+
}
25+
26+
func (g fakeGroupCache) HasSynced() bool {
27+
return true
28+
}

0 commit comments

Comments
 (0)