Skip to content

Commit 66834ff

Browse files
author
OpenShift Bot
authored
Merge pull request #11612 from sdminonne/sa_informer_in_posecuritypolicyreview
Merged by openshift-bot
2 parents 21040e2 + dc761fb commit 66834ff

File tree

3 files changed

+42
-32
lines changed

3 files changed

+42
-32
lines changed

‎pkg/cmd/server/origin/master.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,7 @@ func (c *MasterConfig) GetRestStorage() map[string]rest.Storage {
624624
resourceAccessReviewRegistry := resourceaccessreview.NewRegistry(resourceAccessReviewStorage)
625625
localResourceAccessReviewStorage := localresourceaccessreview.NewREST(resourceAccessReviewRegistry)
626626

627-
podSecurityPolicyReviewStorage := podsecuritypolicyreview.NewREST(oscc.NewDefaultSCCMatcher(c.Informers.SecurityContextConstraints().Lister()), clientadapter.FromUnversionedClient(c.PrivilegedLoopbackKubernetesClient))
627+
podSecurityPolicyReviewStorage := podsecuritypolicyreview.NewREST(oscc.NewDefaultSCCMatcher(c.Informers.SecurityContextConstraints().Lister()), c.Informers.ServiceAccounts().Lister(), clientadapter.FromUnversionedClient(c.PrivilegedLoopbackKubernetesClient))
628628
podSecurityPolicySubjectStorage := podsecuritypolicysubjectreview.NewREST(oscc.NewDefaultSCCMatcher(c.Informers.SecurityContextConstraints().Lister()), clientadapter.FromUnversionedClient(c.PrivilegedLoopbackKubernetesClient))
629629
podSecurityPolicySelfSubjectReviewStorage := podsecuritypolicyselfsubjectreview.NewREST(oscc.NewDefaultSCCMatcher(c.Informers.SecurityContextConstraints().Lister()), clientadapter.FromUnversionedClient(c.PrivilegedLoopbackKubernetesClient))
630630

‎pkg/security/registry/podsecuritypolicyreview/rest.go

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"k8s.io/kubernetes/pkg/serviceaccount"
1515
kerrors "k8s.io/kubernetes/pkg/util/errors"
1616

17+
oscache "github.com/openshift/origin/pkg/client/cache"
1718
securityapi "github.com/openshift/origin/pkg/security/api"
1819
securityvalidation "github.com/openshift/origin/pkg/security/api/validation"
1920
"github.com/openshift/origin/pkg/security/registry/podsecuritypolicysubjectreview"
@@ -23,12 +24,13 @@ import (
2324
// REST implements the RESTStorage interface in terms of an Registry.
2425
type REST struct {
2526
sccMatcher oscc.SCCMatcher
27+
saCache oscache.StoreToServiceAccountLister
2628
client clientset.Interface
2729
}
2830

2931
// NewREST creates a new REST for policies..
30-
func NewREST(m oscc.SCCMatcher, c clientset.Interface) *REST {
31-
return &REST{sccMatcher: m, client: c}
32+
func NewREST(m oscc.SCCMatcher, saCache oscache.StoreToServiceAccountLister, c clientset.Interface) *REST {
33+
return &REST{sccMatcher: m, saCache: saCache, client: c}
3234
}
3335

3436
// New creates a new PodSecurityPolicyReview object
@@ -49,7 +51,7 @@ func (r *REST) Create(ctx kapi.Context, obj runtime.Object) (runtime.Object, err
4951
if !ok {
5052
return nil, kapierrors.NewBadRequest("namespace parameter required.")
5153
}
52-
serviceAccounts, err := getServiceAccounts(pspr.Spec, r.client, ns)
54+
serviceAccounts, err := getServiceAccounts(pspr.Spec, r.saCache, ns)
5355
if err != nil {
5456
return nil, kapierrors.NewBadRequest(err.Error())
5557
}
@@ -97,7 +99,7 @@ func (r *REST) Create(ctx kapi.Context, obj runtime.Object) (runtime.Object, err
9799
return pspr, nil
98100
}
99101

100-
func getServiceAccounts(psprSpec securityapi.PodSecurityPolicyReviewSpec, client clientset.Interface, namespace string) ([]*kapi.ServiceAccount, error) {
102+
func getServiceAccounts(psprSpec securityapi.PodSecurityPolicyReviewSpec, saCache oscache.StoreToServiceAccountLister, namespace string) ([]*kapi.ServiceAccount, error) {
101103
serviceAccounts := []*kapi.ServiceAccount{}
102104
// TODO: express 'all service accounts'
103105
//if serviceAccountList, err := client.Core().ServiceAccounts(namespace).List(kapi.ListOptions{}); err == nil {
@@ -108,8 +110,7 @@ func getServiceAccounts(psprSpec securityapi.PodSecurityPolicyReviewSpec, client
108110
if len(psprSpec.ServiceAccountNames) > 0 {
109111
errs := []error{}
110112
for _, saName := range psprSpec.ServiceAccountNames {
111-
// TODO: use cache as soon ServiceAccount informer is ready
112-
sa, err := client.Core().ServiceAccounts(namespace).Get(saName)
113+
sa, err := saCache.ServiceAccounts(namespace).Get(saName)
113114
if err != nil {
114115
errs = append(errs, fmt.Errorf("unable to retrieve ServiceAccount %s: %v", saName, err))
115116
}
@@ -121,7 +122,7 @@ func getServiceAccounts(psprSpec securityapi.PodSecurityPolicyReviewSpec, client
121122
if len(psprSpec.Template.Spec.ServiceAccountName) > 0 {
122123
saName = psprSpec.Template.Spec.ServiceAccountName
123124
}
124-
sa, err := client.Core().ServiceAccounts(namespace).Get(saName)
125+
sa, err := saCache.ServiceAccounts(namespace).Get(saName)
125126
if err != nil {
126127
return serviceAccounts, fmt.Errorf("unable to retrieve ServiceAccount %s: %v", saName, err)
127128
}

‎pkg/security/registry/podsecuritypolicyreview/rest_test.go

Lines changed: 33 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,8 @@ import (
55
"testing"
66

77
kapi "k8s.io/kubernetes/pkg/api"
8-
"k8s.io/kubernetes/pkg/client/cache"
9-
clientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
8+
cache "k8s.io/kubernetes/pkg/client/cache"
109
clientsetfake "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/fake"
11-
"k8s.io/kubernetes/pkg/runtime"
1210

1311
oscache "github.com/openshift/origin/pkg/client/cache"
1412
admissionttesting "github.com/openshift/origin/pkg/security/admission/testing"
@@ -121,20 +119,25 @@ func TestNoErrors(t *testing.T) {
121119
}
122120

123121
for testName, testcase := range testcases {
124-
cache := &oscache.IndexerToSecurityContextConstraintsLister{
122+
sccCache := &oscache.IndexerToSecurityContextConstraintsLister{
125123
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
126124
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
127125
}
128126
for _, scc := range testcase.sccs {
129-
if err := cache.Add(scc); err != nil {
127+
if err := sccCache.Add(scc); err != nil {
130128
t.Fatalf("error adding sccs to store: %v", err)
131129
}
132130
}
131+
saCache := oscache.StoreToServiceAccountLister{
132+
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
133+
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
134+
}
133135
namespace := admissionttesting.CreateNamespaceForTest()
134136
serviceAccount := admissionttesting.CreateSAForTest()
135137
serviceAccount.Namespace = namespace.Name
136-
csf := clientsetfake.NewSimpleClientset(namespace, serviceAccount)
137-
storage := REST{oscc.NewDefaultSCCMatcher(cache), csf}
138+
saCache.Add(serviceAccount)
139+
csf := clientsetfake.NewSimpleClientset(namespace)
140+
storage := REST{oscc.NewDefaultSCCMatcher(sccCache), saCache, csf}
138141
ctx := kapi.WithNamespace(kapi.NewContext(), namespace.Name)
139142
obj, err := storage.Create(ctx, testcase.request)
140143
if err != nil {
@@ -194,28 +197,32 @@ func TestErrors(t *testing.T) {
194197
},
195198
},
196199
},
197-
errorMessage: `unable to retrieve ServiceAccount default: ServiceAccount "default" not found`,
200+
errorMessage: `unable to retrieve ServiceAccount default: serviceaccount "default" not found`,
198201
},
199202
}
200203
for testName, testcase := range testcases {
201-
cache := &oscache.IndexerToSecurityContextConstraintsLister{
204+
sccCache := &oscache.IndexerToSecurityContextConstraintsLister{
202205
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
203206
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
204207
}
205208
for _, scc := range testcase.sccs {
206-
if err := cache.Add(scc); err != nil {
209+
if err := sccCache.Add(scc); err != nil {
207210
t.Fatalf("error adding sccs to store: %v", err)
208211
}
209212
}
213+
saCache := oscache.StoreToServiceAccountLister{
214+
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
215+
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
216+
}
210217
namespace := admissionttesting.CreateNamespaceForTest()
211-
var csf clientset.Interface
218+
serviceAccount := admissionttesting.CreateSAForTest()
212219
if testcase.serviceAccount != nil {
213-
testcase.serviceAccount.Namespace = namespace.Name
214-
csf = clientsetfake.NewSimpleClientset(namespace, testcase.serviceAccount)
215-
} else {
216-
csf = clientsetfake.NewSimpleClientset(namespace)
220+
serviceAccount.Namespace = namespace.Name
221+
saCache.Add(serviceAccount)
217222
}
218-
storage := REST{oscc.NewDefaultSCCMatcher(cache), csf}
223+
csf := clientsetfake.NewSimpleClientset(namespace)
224+
225+
storage := REST{oscc.NewDefaultSCCMatcher(sccCache), saCache, csf}
219226
ctx := kapi.WithNamespace(kapi.NewContext(), namespace.Name)
220227
_, err := storage.Create(ctx, testcase.request)
221228
if err == nil {
@@ -349,28 +356,30 @@ func TestSpecificSAs(t *testing.T) {
349356
},
350357
},
351358
},
352-
errorMessage: `unable to retrieve ServiceAccount bad-sa: ServiceAccount "bad-sa" not found`,
359+
errorMessage: `unable to retrieve ServiceAccount bad-sa: serviceaccount "bad-sa" not found`,
353360
},
354361
}
355362

356363
for testName, testcase := range testcases {
357-
cache := &oscache.IndexerToSecurityContextConstraintsLister{
364+
sccCache := &oscache.IndexerToSecurityContextConstraintsLister{
358365
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
359366
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
360367
}
361368
for _, scc := range testcase.sccs {
362-
if err := cache.Add(scc); err != nil {
369+
if err := sccCache.Add(scc); err != nil {
363370
t.Fatalf("error adding sccs to store: %v", err)
364371
}
365372
}
366-
objects := []runtime.Object{}
367373
namespace := admissionttesting.CreateNamespaceForTest()
368-
objects = append(objects, namespace)
374+
saCache := oscache.StoreToServiceAccountLister{
375+
Indexer: cache.NewIndexer(cache.MetaNamespaceKeyFunc,
376+
cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}),
377+
}
369378
for i := range testcase.serviceAccounts {
370-
objects = append(objects, testcase.serviceAccounts[i])
379+
saCache.Add(testcase.serviceAccounts[i])
371380
}
372-
csf := clientsetfake.NewSimpleClientset(objects...)
373-
storage := REST{oscc.NewDefaultSCCMatcher(cache), csf}
381+
csf := clientsetfake.NewSimpleClientset(namespace)
382+
storage := REST{oscc.NewDefaultSCCMatcher(sccCache), saCache, csf}
374383
ctx := kapi.WithNamespace(kapi.NewContext(), namespace.Name)
375384
_, err := storage.Create(ctx, testcase.request)
376385
switch {

0 commit comments

Comments
 (0)