-
Notifications
You must be signed in to change notification settings - Fork 320
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #56 from struz/namespace_restriction
Namespace restriction: revised
- Loading branch information
Showing
8 changed files
with
366 additions
and
63 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
|
|
||
| log "github.com/Sirupsen/logrus" | ||
| "k8s.io/kubernetes/pkg/api" | ||
| ) | ||
|
|
||
| type namespaceHandler struct { | ||
| storage *store | ||
| } | ||
|
|
||
| // OnAdd called with a namespace is added to k8s | ||
| func (h *namespaceHandler) OnAdd(obj interface{}) { | ||
| ns, ok := obj.(*api.Namespace) | ||
| if !ok { | ||
| log.Errorf("Expected Namespace but OnAdd handler received %+v", obj) | ||
| return | ||
| } | ||
|
|
||
| log.Debugf("Namespace OnAdd %s", ns.GetName()) | ||
|
|
||
| roles := h.getRoleAnnotation(ns) | ||
| for _, role := range roles { | ||
| log.Debugf("- Role %s", role) | ||
| h.storage.AddRoleToNamespace(ns.GetName(), role) | ||
| } | ||
|
|
||
| } | ||
|
|
||
| // OnUpdate called with a namespace is updated inside k8s | ||
| func (h *namespaceHandler) OnUpdate(oldObj, newObj interface{}) { | ||
| //ons, ok := oldObj.(*api.Namespace) | ||
| nns, ok := newObj.(*api.Namespace) | ||
| if !ok { | ||
| log.Errorf("Expected Namespace but OnUpdate handler received %+v", newObj) | ||
| return | ||
| } | ||
| log.Debugf("Namespace OnUpdate %s", nns.GetName()) | ||
|
|
||
| roles := h.getRoleAnnotation(nns) | ||
| nsname := nns.GetName() | ||
| h.storage.DeleteNamespace(nsname) | ||
| for _, role := range roles { | ||
| log.Debugf("- Role %s", role) | ||
| h.storage.AddRoleToNamespace(nsname, role) | ||
| } | ||
| } | ||
|
|
||
| // OnDelete called with a namespace is removed from k8s | ||
| func (h *namespaceHandler) OnDelete(obj interface{}) { | ||
| ns, ok := obj.(*api.Namespace) | ||
| if !ok { | ||
| log.Errorf("Expected Namespace but OnDelete handler received %+v", obj) | ||
| return | ||
| } | ||
| log.Debugf("Namespace OnDelete %s", ns.GetName()) | ||
| h.storage.DeleteNamespace(ns.GetName()) | ||
| } | ||
|
|
||
| // getRoleAnnotations reads the "iam.amazonaws.com/allowed-roles" annotation off a namespace | ||
| // and splits them as a JSON list (["role1", "role2", "role3"]) | ||
| func (h *namespaceHandler) getRoleAnnotation(ns *api.Namespace) []string { | ||
| rolesString := ns.Annotations[h.storage.namespaceKey] | ||
| if rolesString != "" { | ||
| var decoded []string | ||
| if err := json.Unmarshal([]byte(rolesString), &decoded); err != nil { | ||
| log.Errorf("Unable to decode roles on namespace %s ( role annotation is '%s' ) with error: %s", ns.Name, rolesString, err) | ||
| } | ||
| return decoded | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func newNamespaceHandler(s *store) *namespaceHandler { | ||
| return &namespaceHandler{ | ||
| storage: s, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| log "github.com/Sirupsen/logrus" | ||
| "k8s.io/kubernetes/pkg/api" | ||
| kcache "k8s.io/kubernetes/pkg/client/cache" | ||
| ) | ||
|
|
||
| type podHandler struct { | ||
| storage *store | ||
| } | ||
|
|
||
| // OnAdd is called when a pod is added. | ||
| func (p *podHandler) OnAdd(obj interface{}) { | ||
| pod, ok := obj.(*api.Pod) | ||
| if !ok { | ||
| log.Errorf("Expected Pod but OnAdd handler received %+v", obj) | ||
| return | ||
| } | ||
| log.Debugf("Pod OnAdd %s - %s", pod.GetName(), pod.Status.PodIP) | ||
|
|
||
| p.storage.AddNamespaceToIP(pod) | ||
|
|
||
| if pod.Status.PodIP != "" { | ||
| if role, ok := pod.Annotations[p.storage.iamRoleKey]; ok { | ||
| log.Debugf("- Role %s", role) | ||
| p.storage.AddRoleToIP(pod, role) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // OnUpdate is called when a pod is modified. | ||
| func (p *podHandler) OnUpdate(oldObj, newObj interface{}) { | ||
| oldPod, ok1 := oldObj.(*api.Pod) | ||
| newPod, ok2 := newObj.(*api.Pod) | ||
| if !ok1 || !ok2 { | ||
| log.Errorf("Expected Pod but OnUpdate handler received %+v %+v", oldObj, newObj) | ||
| return | ||
| } | ||
| log.Debugf("Pod OnUpdate %s - %s", newPod.GetName(), newPod.Status.PodIP) | ||
|
|
||
| if oldPod.Status.PodIP != newPod.Status.PodIP { | ||
| p.OnDelete(oldPod) | ||
| p.OnAdd(newPod) | ||
| } | ||
| } | ||
|
|
||
| // OnDelete is called when a pod is deleted. | ||
| func (p *podHandler) OnDelete(obj interface{}) { | ||
| pod, ok := obj.(*api.Pod) | ||
| if !ok { | ||
| deletedObj, dok := obj.(kcache.DeletedFinalStateUnknown) | ||
| if dok { | ||
| pod, ok = deletedObj.Obj.(*api.Pod) | ||
| } | ||
| } | ||
|
|
||
| if !ok { | ||
| log.Errorf("Expected Pod but OnDelete handler received %+v", obj) | ||
| return | ||
| } | ||
|
|
||
| log.Debugf("Pod OnDelete %s - %s", pod.GetName(), pod.Status.PodIP) | ||
|
|
||
| if pod.Status.PodIP != "" { | ||
| p.storage.DeleteIP(pod.Status.PodIP) | ||
| } | ||
| } | ||
|
|
||
| func newPodHandler(s *store) *podHandler { | ||
| return &podHandler{ | ||
| storage: s, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.