@@ -14,13 +14,15 @@ See the License for the specific language governing permissions and
1414limitations under the License.
1515*/
1616
17- package framework
17+ package auth
1818
1919import (
20- "k8s.io/klog "
20+ "fmt "
2121 "sync"
2222 "time"
2323
24+ "github.com/onsi/ginkgo"
25+ "github.com/pkg/errors"
2426 authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
2527 rbacv1beta1 "k8s.io/api/rbac/v1beta1"
2628 apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -36,6 +38,12 @@ const (
3638 policyCachePollTimeout = 5 * time .Second
3739)
3840
41+ type bindingsGetter interface {
42+ v1beta1rbac.RoleBindingsGetter
43+ v1beta1rbac.ClusterRoleBindingsGetter
44+ v1beta1rbac.ClusterRolesGetter
45+ }
46+
3947// WaitForAuthorizationUpdate checks if the given user can perform the named verb and action.
4048// If policyCachePollTimeout is reached without the expected condition matching, an error is returned
4149func WaitForAuthorizationUpdate (c v1beta1authorization.SubjectAccessReviewsGetter , user , namespace , verb string , resource schema.GroupResource , allowed bool ) error {
@@ -57,12 +65,15 @@ func WaitForNamedAuthorizationUpdate(c v1beta1authorization.SubjectAccessReviews
5765 User : user ,
5866 },
5967 }
68+
6069 err := wait .Poll (policyCachePollInterval , policyCachePollTimeout , func () (bool , error ) {
6170 response , err := c .SubjectAccessReviews ().Create (review )
6271 // GKE doesn't enable the SAR endpoint. Without this endpoint, we cannot determine if the policy engine
6372 // has adjusted as expected. In this case, simply wait one second and hope it's up to date
73+ // TODO: Should have a check for the provider here but that introduces too tight of
74+ // coupling with the `framework` package. See: https://github.com/kubernetes/kubernetes/issues/76726
6475 if apierrors .IsNotFound (err ) {
65- klog . Info ("SubjectAccessReview endpoint is missing" )
76+ logf ("SubjectAccessReview endpoint is missing" )
6677 time .Sleep (1 * time .Second )
6778 return true , nil
6879 }
@@ -77,8 +88,13 @@ func WaitForNamedAuthorizationUpdate(c v1beta1authorization.SubjectAccessReviews
7788 return err
7889}
7990
80- // BindClusterRole binds the cluster role at the cluster scope
81- func BindClusterRole (c v1beta1rbac.ClusterRoleBindingsGetter , clusterRole , ns string , subjects ... rbacv1beta1.Subject ) {
91+ // BindClusterRole binds the cluster role at the cluster scope. If RBAC is not enabled, nil
92+ // is returned with no action.
93+ func BindClusterRole (c bindingsGetter , clusterRole , ns string , subjects ... rbacv1beta1.Subject ) error {
94+ if ! IsRBACEnabled (c ) {
95+ return nil
96+ }
97+
8298 // Since the namespace names are unique, we can leave this lying around so we don't have to race any caches
8399 _ , err := c .ClusterRoleBindings ().Create (& rbacv1beta1.ClusterRoleBinding {
84100 ObjectMeta : metav1.ObjectMeta {
@@ -92,23 +108,30 @@ func BindClusterRole(c v1beta1rbac.ClusterRoleBindingsGetter, clusterRole, ns st
92108 Subjects : subjects ,
93109 })
94110
95- // if we failed, don't fail the entire test because it may still work. RBAC may simply be disabled.
96111 if err != nil {
97- klog . Errorf ( "Error binding clusterrole/%s for %q for %v\n "clusterRole , ns , subjects )
112+ return errors . Wrapf ( err , " binding clusterrole/%s for %q for %v"clusterRole , ns , subjects )
98113 }
114+
115+ return nil
99116}
100117
101- // BindClusterRoleInNamespace binds the cluster role at the namespace scope
102- func BindClusterRoleInNamespace (c v1beta1rbac.RoleBindingsGetter , clusterRole , ns string , subjects ... rbacv1beta1.Subject ) {
103- bindInNamespace (c , "ClusterRole" , clusterRole , ns , subjects ... )
118+ // BindClusterRoleInNamespace binds the cluster role at the namespace scope. If RBAC is not enabled, nil
119+ // is returned with no action.
120+ func BindClusterRoleInNamespace (c bindingsGetter , clusterRole , ns string , subjects ... rbacv1beta1.Subject ) error {
121+ return bindInNamespace (c , "ClusterRole" , clusterRole , ns , subjects ... )
104122}
105123
106- // BindRoleInNamespace binds the role at the namespace scope
107- func BindRoleInNamespace (c v1beta1rbac.RoleBindingsGetter , role , ns string , subjects ... rbacv1beta1.Subject ) {
108- bindInNamespace (c , "Role" , role , ns , subjects ... )
124+ // BindRoleInNamespace binds the role at the namespace scope. If RBAC is not enabled, nil
125+ // is returned with no action.
126+ func BindRoleInNamespace (c bindingsGetter , role , ns string , subjects ... rbacv1beta1.Subject ) error {
127+ return bindInNamespace (c , "Role" , role , ns , subjects ... )
109128}
110129
111- func bindInNamespace (c v1beta1rbac.RoleBindingsGetter , roleType , role , ns string , subjects ... rbacv1beta1.Subject ) {
130+ func bindInNamespace (c bindingsGetter , roleType , role , ns string , subjects ... rbacv1beta1.Subject ) error {
131+ if ! IsRBACEnabled (c ) {
132+ return nil
133+ }
134+
112135 // Since the namespace names are unique, we can leave this lying around so we don't have to race any caches
113136 _ , err := c .RoleBindings (ns ).Create (& rbacv1beta1.RoleBinding {
114137 ObjectMeta : metav1.ObjectMeta {
@@ -122,10 +145,11 @@ func bindInNamespace(c v1beta1rbac.RoleBindingsGetter, roleType, role, ns string
122145 Subjects : subjects ,
123146 })
124147
125- // if we failed, don't fail the entire test because it may still work. RBAC may simply be disabled.
126148 if err != nil {
127- klog . Errorf ( "Error binding %s/%s into %q for %v\n "roleType , role , ns , subjects )
149+ return errors . Wrapf ( err , " binding %s/%s into %q for %v"roleType , role , ns , subjects )
128150 }
151+
152+ return nil
129153}
130154
131155var (
@@ -134,19 +158,41 @@ var (
134158)
135159
136160// IsRBACEnabled returns true if RBAC is enabled. Otherwise false.
137- func IsRBACEnabled (f * Framework ) bool {
161+ func IsRBACEnabled (crGetter v1beta1rbac. ClusterRolesGetter ) bool {
138162 isRBACEnabledOnce .Do (func () {
139- crs , err := f . ClientSet . RbacV1 () .ClusterRoles ().List (metav1.ListOptions {})
163+ crs , err := crGetter .ClusterRoles ().List (metav1.ListOptions {})
140164 if err != nil {
141- Logf ("Error listing ClusterRoles; assuming RBAC is disabled: %v" , err )
165+ logf ("Error listing ClusterRoles; assuming RBAC is disabled: %v" , err )
142166 isRBACEnabled = false
143167 } else if crs == nil || len (crs .Items ) == 0 {
144- Logf ("No ClusterRoles found; assuming RBAC is disabled." )
168+ logf ("No ClusterRoles found; assuming RBAC is disabled." )
145169 isRBACEnabled = false
146170 } else {
147- Logf ("Found ClusterRoles; assuming RBAC is enabled." )
171+ logf ("Found ClusterRoles; assuming RBAC is enabled." )
148172 isRBACEnabled = true
149173 }
150174 })
175+
151176 return isRBACEnabled
152177}
178+
179+ // logf logs INFO lines to the GinkgoWriter.
180+ // TODO: Log functions like these should be put into their own package,
181+ // see: https://github.com/kubernetes/kubernetes/issues/76728
182+ func logf (format string , args ... interface {}) {
183+ log ("INFO" , format , args ... )
184+ }
185+
186+ // log prints formatted log messages to the global GinkgoWriter.
187+ // TODO: Log functions like these should be put into their own package,
188+ // see: https://github.com/kubernetes/kubernetes/issues/76728
189+ func log (level string , format string , args ... interface {}) {
190+ fmt .Fprintf (ginkgo .GinkgoWriter , nowStamp ()+ ": " + level + ": " + format + "\n " , args ... )
191+ }
192+
193+ // nowStamp returns the current time formatted for placement in the logs (time.StampMilli).
194+ // TODO: If only used for logging, this should be put into a logging package,
195+ // see: https://github.com/kubernetes/kubernetes/issues/76728
196+ func nowStamp () string {
197+ return time .Now ().Format (time .StampMilli )
198+ }
0 commit comments