-
Notifications
You must be signed in to change notification settings - Fork 87
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #225 from coreydaley/cleanup_go_mod_tidy
Cleaning up some leftover packages
- Loading branch information
Showing
55 changed files
with
5,251 additions
and
1,055 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
321 changes: 321 additions & 0 deletions
321
pkg/route/apiserver/admission/requiredrouteannotations/admission.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,321 @@ | ||
| package requiredrouteannotations | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "io" | ||
| "regexp" | ||
| "strconv" | ||
| "strings" | ||
| "time" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/labels" | ||
| utilruntime "k8s.io/apimachinery/pkg/util/runtime" | ||
| "k8s.io/apiserver/pkg/admission" | ||
| "k8s.io/apiserver/pkg/admission/initializer" | ||
| "k8s.io/client-go/informers" | ||
| corev1listers "k8s.io/client-go/listers/core/v1" | ||
| "k8s.io/client-go/rest" | ||
| logger "k8s.io/klog/klogr" | ||
|
|
||
| configv1 "github.com/openshift/api/config/v1" | ||
| routev1 "github.com/openshift/api/route/v1" | ||
| configtypedclient "github.com/openshift/client-go/config/clientset/versioned/typed/config/v1" | ||
| routetypedclient "github.com/openshift/client-go/route/clientset/versioned/typed/route/v1" | ||
| "github.com/openshift/library-go/pkg/apiserver/admission/admissionrestconfig" | ||
| routeapi "github.com/openshift/openshift-apiserver/pkg/route/apis/route" | ||
| ) | ||
|
|
||
| var Logger = logger.New() | ||
| var log = Logger.WithName("admission") | ||
|
|
||
| const ( | ||
| pluginName = "route.openshift.io/RequiredRouteAnnotations" | ||
| timeToWaitForCacheSync = 10 * time.Second | ||
| ) | ||
|
|
||
| func Register(plugins *admission.Plugins) { | ||
| plugins.Register(pluginName, | ||
| func(_ io.Reader) (admission.Interface, error) { | ||
| return NewRequiredRouteAnnotations() | ||
| }) | ||
| } | ||
|
|
||
| type requiredRouteAnnotations struct { | ||
| *admission.Handler | ||
| routeClient routetypedclient.RoutesGetter | ||
| configClient configtypedclient.IngressesGetter | ||
| nsLister corev1listers.NamespaceLister | ||
| nsListerSynced func() bool | ||
| } | ||
|
|
||
| // Ensure that the required OpenShift admission interfaces are implemented. | ||
| var _ = initializer.WantsExternalKubeInformerFactory(&requiredRouteAnnotations{}) | ||
| var _ = admissionrestconfig.WantsRESTClientConfig(&requiredRouteAnnotations{}) | ||
| var _ = admission.ValidationInterface(&requiredRouteAnnotations{}) | ||
|
|
||
| const hstsAnnotation = "haproxy.router.openshift.io/hsts_header" | ||
|
|
||
| // Validate ensures that routes specify required annotations, and returns nil if valid. | ||
| func (o *requiredRouteAnnotations) Validate(ctx context.Context, a admission.Attributes, _ admission.ObjectInterfaces) (err error) { | ||
| if a.GetResource().GroupResource() != routev1.Resource("routes") { | ||
| return nil | ||
| } | ||
| if _, isRoute := a.GetObject().(*routeapi.Route); !isRoute { | ||
| return nil | ||
| } | ||
|
|
||
| if !o.waitForSyncedStore(time.After(timeToWaitForCacheSync)) { | ||
| return admission.NewForbidden(a, errors.New(pluginName+": caches not synchronized")) | ||
| } | ||
|
|
||
| ingress, err := o.configClient.Ingresses().Get(ctx, "cluster", metav1.GetOptions{}) | ||
| if err != nil { | ||
| return admission.NewForbidden(a, err) | ||
| } | ||
|
|
||
| newRoute := a.GetObject().(*routeapi.Route) | ||
| if old := a.GetOldObject(); old != nil { | ||
| oldRoute := old.(*routeapi.Route) | ||
| // if this is an update and the annotation in question is the same, then we know the update will be allowed | ||
| if a.GetOperation() == admission.Update && newRoute.Annotations[hstsAnnotation] == oldRoute.Annotations[hstsAnnotation] { | ||
| return nil | ||
| } | ||
| } | ||
|
|
||
| namespace, err := o.nsLister.Get(newRoute.Namespace) | ||
| if err != nil { | ||
| return admission.NewForbidden(a, err) | ||
| } | ||
|
|
||
| if err = isRouteHSTSAllowed(ingress, newRoute, namespace); err != nil { | ||
| return admission.NewForbidden(a, err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (o *requiredRouteAnnotations) SetRESTClientConfig(restClientConfig rest.Config) { | ||
| var err error | ||
| // TODO: Use an informer for config. | ||
| o.configClient, err = configtypedclient.NewForConfig(&restClientConfig) | ||
| if err != nil { | ||
| utilruntime.HandleError(err) | ||
| return | ||
| } | ||
| o.routeClient, err = routetypedclient.NewForConfig(&restClientConfig) | ||
| if err != nil { | ||
| utilruntime.HandleError(err) | ||
| return | ||
| } | ||
| } | ||
|
|
||
| func (o *requiredRouteAnnotations) SetExternalKubeInformerFactory(kubeInformers informers.SharedInformerFactory) { | ||
| o.nsLister = kubeInformers.Core().V1().Namespaces().Lister() | ||
| o.nsListerSynced = kubeInformers.Core().V1().Namespaces().Informer().HasSynced | ||
| } | ||
|
|
||
| func (o *requiredRouteAnnotations) waitForSyncedStore(timeout <-chan time.Time) bool { | ||
| for !o.nsListerSynced() { | ||
| select { | ||
| case <-time.After(100 * time.Millisecond): | ||
| case <-timeout: | ||
| return o.nsListerSynced() | ||
| } | ||
| } | ||
|
|
||
| return true | ||
| } | ||
|
|
||
| func (o *requiredRouteAnnotations) ValidateInitialization() error { | ||
| if o.configClient == nil { | ||
| return fmt.Errorf(pluginName + " plugin needs a config client") | ||
| } | ||
| if o.routeClient == nil { | ||
| return fmt.Errorf(pluginName + " plugin needs a route client") | ||
| } | ||
| if o.nsLister == nil { | ||
| return fmt.Errorf(pluginName + " plugin needs a namespace lister") | ||
| } | ||
| if o.nsListerSynced == nil { | ||
| return fmt.Errorf(pluginName + " plugin needs a namespace lister synced") | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func NewRequiredRouteAnnotations() (admission.Interface, error) { | ||
| return &requiredRouteAnnotations{ | ||
| Handler: admission.NewHandler(admission.Create, admission.Update), | ||
| }, nil | ||
| } | ||
|
|
||
| // isRouteHSTSAllowed returns nil if the route is allowed. Otherwise, returns details and a suggestion in the error | ||
| func isRouteHSTSAllowed(ingress *configv1.Ingress, newRoute *routeapi.Route, namespace *corev1.Namespace) error { | ||
| // Invalid if a HSTS Policy is specified but this route is not TLS. Just log a warning. | ||
| if tls := newRoute.Spec.TLS; tls != nil { | ||
| switch termination := tls.Termination; termination { | ||
| case routeapi.TLSTerminationEdge, routeapi.TLSTerminationReencrypt: | ||
| // Valid case | ||
| default: | ||
| // Non-tls routes will not get HSTS headers, but can still be valid | ||
| log.Info("HSTS Policy not accepted for %s, termination type: %s", newRoute.Name, termination) | ||
| return nil | ||
| } | ||
| } else { | ||
| return fmt.Errorf("termination type is empty, must be %s or %s", routev1.TLSTerminationEdge, routev1.TLSTerminationReencrypt) | ||
| } | ||
|
|
||
| requirements := ingress.Spec.RequiredHSTSPolicies | ||
| for _, requirement := range requirements { | ||
| if matches, err := requiredHSTSMatchesRoute(requirement, newRoute, namespace); err != nil { | ||
| return err | ||
| } else if !matches { | ||
| continue | ||
| } | ||
|
|
||
| routeHSTS, err := hstsConfigFromRoute(newRoute) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| requirementErr := routeHSTS.meetsRequirements(requirement) | ||
| if requirementErr != nil { | ||
| return requirementErr | ||
| } | ||
| // Validation only checks the first matching required HSTS rule. | ||
| return nil | ||
| } | ||
|
|
||
| // None of the requirements matched this route's domain/namespace, it is automatically allowed | ||
| return nil | ||
| } | ||
|
|
||
| type hstsConfig struct { | ||
| maxAge int32 | ||
| preload bool | ||
| includeSubDomains bool | ||
| } | ||
|
|
||
| // Parse out the hstsConfig fields from the annotation | ||
| func hstsConfigFromRoute(route *routeapi.Route) (hstsConfig, error) { | ||
| ret := hstsConfig{} | ||
| ret.maxAge = -1 | ||
| tokens := strings.Split(route.Annotations[hstsAnnotation], ";") | ||
| for _, token := range tokens { | ||
| trimmed := strings.Trim(token, " ") | ||
| if strings.EqualFold(trimmed, "includeSubDomains") { | ||
| ret.includeSubDomains = true | ||
| } | ||
| if strings.EqualFold(trimmed, "preload") { | ||
| ret.preload = true | ||
| } | ||
| if strings.HasPrefix(strings.ToLower(trimmed), "max-age=") { | ||
| age, err := strconv.ParseInt(trimmed[len("max-age="):], 10, 32) | ||
| if err != nil { | ||
| return hstsConfig{}, err | ||
| } | ||
| ret.maxAge = int32(age) | ||
| } | ||
| // unrecognized tokens are ignored | ||
| } | ||
|
|
||
| return ret, nil | ||
| } | ||
|
|
||
| // Make sure the given requirement meets the configured HSTS policy, validating: | ||
| // - existence and range for maxAge | ||
| // - preloadPolicy | ||
| // - includeSubDomainsPolicy | ||
| func (c hstsConfig) meetsRequirements(requirement configv1.RequiredHSTSPolicy) error { | ||
| configHasMaxAge := c.maxAge >= 0 | ||
| if !configHasMaxAge { | ||
| return fmt.Errorf("max age is required") | ||
| } | ||
| if requirement.MaxAge.LargestMaxAge >= 0 && c.maxAge > requirement.MaxAge.LargestMaxAge { | ||
| return fmt.Errorf("does not match maximum age %d", requirement.MaxAge.LargestMaxAge) | ||
| } | ||
| if requirement.MaxAge.SmallestMaxAge >= 0 && c.maxAge < requirement.MaxAge.SmallestMaxAge { | ||
| return fmt.Errorf("does not match minimum age %d", requirement.MaxAge.SmallestMaxAge) | ||
| } | ||
|
|
||
| switch requirement.PreloadPolicy { | ||
| case configv1.DefaultPreloadPolicy, configv1.NoOpinionPreloadPolicy: | ||
| // anything is allowed, do nothing | ||
| case configv1.RequirePreloadPolicy: | ||
| if !c.preload { | ||
| return fmt.Errorf("preload must be specified") | ||
| } | ||
| case configv1.RequireNoPreloadPolicy: | ||
| if c.preload { | ||
| return fmt.Errorf("preload must not be specified") | ||
| } | ||
| } | ||
|
|
||
| switch requirement.IncludeSubDomainsPolicy { | ||
| case configv1.DefaultIncludeSubDomains, configv1.NoOpinionIncludeSubDomains: | ||
| // anything is allowed, do nothing | ||
| case configv1.RequireIncludeSubDomains: | ||
| if !c.includeSubDomains { | ||
| return fmt.Errorf("includeSubDomains must be specified") | ||
| } | ||
| case configv1.RequireNotIncludeSubDomains: | ||
| if c.includeSubDomains { | ||
| return fmt.Errorf("includeSubDomains must not be specified") | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // Check if the route matches the required domain/namespace in the HSTS Policy | ||
| func requiredHSTSMatchesRoute(requirement configv1.RequiredHSTSPolicy, route *routeapi.Route, namespace *corev1.Namespace) (bool, error) { | ||
| matchesNamespace, err := matchesNamespaceSelector(requirement.NamespaceSelector, namespace) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| if !matchesNamespace { | ||
| return false, nil | ||
| } | ||
| routeDomains := []string{route.Spec.Host} | ||
| for _, ingress := range route.Status.Ingress { | ||
| routeDomains = append(routeDomains, ingress.Host) | ||
| } | ||
| if matchesDomain(requirement.DomainPatterns, routeDomains) { | ||
| return true, nil | ||
| } | ||
|
|
||
| return false, nil | ||
| } | ||
|
|
||
| // Check all of the required domainMatcher patterns against all provided domains, | ||
| // first match returns true. If none match, return false. | ||
| func matchesDomain(domainMatchers []string, domains []string) bool { | ||
| for _, matcher := range domainMatchers { | ||
| match := regexp.MustCompile(fmt.Sprintf("^%s$", matcher)) | ||
| for _, candidate := range domains { | ||
| if match.MatchString(candidate) { | ||
| return true | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return false | ||
| } | ||
|
|
||
| func matchesNamespaceSelector(nsSelector *metav1.LabelSelector, namespace *corev1.Namespace) (bool, error) { | ||
| if nsSelector == nil { | ||
| return true, nil | ||
| } | ||
| selector, err := getParsedNamespaceSelector(nsSelector) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
| return selector.Matches(labels.Set(namespace.Labels)), nil | ||
| } | ||
|
|
||
| func getParsedNamespaceSelector(nsSelector *metav1.LabelSelector) (labels.Selector, error) { | ||
| // TODO cache this result to save time | ||
| return metav1.LabelSelectorAsSelector(nsSelector) | ||
| } |
Oops, something went wrong.