Skip to content

Commit 4e83b28

Browse files
apo-gerapo-ger
committed
review: Use controller-runtime client to create SAR objects
Signed-off-by: Apostolos Gerakaris <[email protected]>
1 parent 86f190a commit 4e83b28

File tree

4 files changed

+58
-39
lines changed

4 files changed

+58
-39
lines changed

‎pkg/new-ui/v1beta1/authzn.go‎

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ import (
1010

1111
"github.com/kubeflow/katib/pkg/util/v1beta1/env"
1212
v1 "k8s.io/api/authorization/v1"
13-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
14-
"k8s.io/client-go/kubernetes"
13+
"sigs.k8s.io/controller-runtime/pkg/client"
1514
)
1615

1716
// ENV variables
@@ -60,8 +59,39 @@ func CreateSAR(user, verb, namespace, group,
6059
return sar
6160
}
6261

62+
// func IsAuthorized(user, verb, namespace, group,
63+
// version, resource, subresource, name string, client *kubernetes.Clientset) error {
64+
65+
// // Skip authz when in dev_mode
66+
// if BACKEND_MODE == "dev" || BACKEND_MODE == "development" {
67+
// log.Printf("Skipping authorization check in development mode")
68+
// return nil
69+
// }
70+
// // Skip authz when admin is explicity requested it
71+
// if DISABLE_AUTH {
72+
// log.Printf("APP_DISABLE_AUTH set to True. Skipping authorization check")
73+
// return nil
74+
// }
75+
76+
// sar := CreateSAR(user, verb, namespace, group, version, resource, subresource, name)
77+
78+
// res, err := client.AuthorizationV1().SubjectAccessReviews().Create(context.TODO(), sar, metav1.CreateOptions{})
79+
// if err != nil {
80+
// log.Printf("Error submitting SubjectAccessReview: %v, %s", sar, err.Error())
81+
// return err
82+
// }
83+
84+
// if res.Status.Allowed {
85+
// return nil
86+
// }
87+
88+
// msg := generateUnauthorizedMessage(user, verb, namespace, group, version, resource, subresource, res)
89+
// err = errors.New(msg)
90+
// return err
91+
// }
92+
6393
func IsAuthorized(user, verb, namespace, group,
64-
version, resource, subresource, name string, client *kubernetes.Clientset) error {
94+
version, resource, subresource, name string, client client.Client) error {
6595

6696
// Skip authz when in dev_mode
6797
if BACKEND_MODE == "dev" || BACKEND_MODE == "development" {
@@ -76,17 +106,17 @@ func IsAuthorized(user, verb, namespace, group,
76106

77107
sar := CreateSAR(user, verb, namespace, group, version, resource, subresource, name)
78108

79-
res, err := client.AuthorizationV1().SubjectAccessReviews().Create(context.TODO(), sar, metav1.CreateOptions{})
109+
err := client.Create(context.TODO(), sar)
80110
if err != nil {
81111
log.Printf("Error submitting SubjectAccessReview: %v, %s", sar, err.Error())
82112
return err
83113
}
84114

85-
if res.Status.Allowed {
115+
if sar.Status.Allowed {
86116
return nil
87117
}
88118

89-
msg := generateUnauthorizedMessage(user, verb, namespace, group, version, resource, subresource, res)
119+
msg := generateUnauthorizedMessage(user, verb, namespace, group, version, resource, subresource, sar)
90120
err = errors.New(msg)
91121
return err
92122
}

‎pkg/new-ui/v1beta1/backend.go‎

Lines changed: 19 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,7 @@ import (
2525

2626
"google.golang.org/grpc"
2727
"google.golang.org/grpc/credentials/insecure"
28-
"k8s.io/client-go/kubernetes"
2928
"sigs.k8s.io/controller-runtime/pkg/client"
30-
"sigs.k8s.io/controller-runtime/pkg/client/config"
3129

3230
experimentv1beta1 "github.com/kubeflow/katib/pkg/apis/controller/experiments/v1beta1"
3331
api_pb_v1beta1 "github.com/kubeflow/katib/pkg/apis/manager/v1beta1"
@@ -40,20 +38,11 @@ func NewKatibUIHandler(dbManagerAddr string) *KatibUIHandler {
4038
log.Printf("NewClient for Katib failed: %v", err)
4139
panic(err)
4240
}
43-
// create a new client for manipulating SAR objects.
44-
conf, err := config.GetConfig()
45-
if err != nil {
46-
log.Printf("Failed to create k8s rest config: %v", err)
47-
panic(err)
48-
}
49-
sarclient, err := kubernetes.NewForConfig(conf)
50-
if err != nil {
51-
log.Printf("SarClient for Katib failes: %v", err)
52-
panic(err)
53-
}
41+
sarclient := kclient.GetClient()
42+
5443
return &KatibUIHandler{
5544
katibClient: kclient,
56-
sarClient: *sarclient,
45+
sarClient: sarclient,
5746
dbManagerAddr: dbManagerAddr,
5847
}
5948
}
@@ -123,9 +112,9 @@ func (k *KatibUIHandler) CreateExperiment(w http.ResponseWriter, r *http.Request
123112
namespace := job.ObjectMeta.Namespace
124113
expName := job.ObjectMeta.Name
125114

126-
err = IsAuthorized(user, "create", namespace, "kubeflow.org", "v1beta1", "experiments", "", "", &k.sarClient)
115+
err = IsAuthorized(user, "create", namespace, "kubeflow.org", "v1beta1", "experiments", "", "", k.sarClient)
127116
if err != nil {
128-
log.Printf("The user: %s is not authorized to create experiment: %s from namespace: %s \n", user, expName, namespace)
117+
log.Printf("The user: %s is not authorized to create experiment: %s in namespace: %s \n", user, expName, namespace)
129118
http.Error(w, err.Error(), http.StatusForbidden)
130119
return
131120
}
@@ -158,9 +147,9 @@ func (k *KatibUIHandler) FetchNamespacedExperiments(w http.ResponseWriter, r *ht
158147

159148
namespace := namespaces[0]
160149

161-
err = IsAuthorized(user, "list", namespace, "kubeflow.org", "v1beta1", "experiments", "", "", &k.sarClient)
150+
err = IsAuthorized(user, "list", namespace, "kubeflow.org", "v1beta1", "experiments", "", "", k.sarClient)
162151
if err != nil {
163-
log.Printf("The user: %s is not authorized to list experiments from namespace: %s \n", user, namespace)
152+
log.Printf("The user: %s is not authorized to list experiments in namespace: %s \n", user, namespace)
164153
http.Error(w, err.Error(), http.StatusForbidden)
165154
return
166155
}
@@ -236,9 +225,9 @@ func (k *KatibUIHandler) DeleteExperiment(w http.ResponseWriter, r *http.Request
236225
experimentName := experimentNames[0]
237226
namespace := namespaces[0]
238227

239-
err = IsAuthorized(user, "delete", namespace, "kubeflow.org", "v1beta1", "experiments", "", experimentName, &k.sarClient)
228+
err = IsAuthorized(user, "delete", namespace, "kubeflow.org", "v1beta1", "experiments", "", "", k.sarClient)
240229
if err != nil {
241-
log.Printf("The user: %s is not authorized to delete experiment: %s from namespace: %s \n", user, experimentName, namespace)
230+
log.Printf("The user: %s is not authorized to delete experiment: %s in namespace: %s \n", user, experimentName, namespace)
242231
http.Error(w, err.Error(), http.StatusForbidden)
243232
return
244233
}
@@ -353,9 +342,9 @@ func (k *KatibUIHandler) AddTemplate(w http.ResponseWriter, r *http.Request) {
353342
updatedConfigMapPath := data["updatedConfigMapPath"].(string)
354343
updatedTemplateYaml := data["updatedTemplateYaml"].(string)
355344

356-
err = IsAuthorized(user, "create", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, &k.sarClient)
345+
err = IsAuthorized(user, "create", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, k.sarClient)
357346
if err != nil {
358-
log.Printf("The user: %s is not authorized to add configmap: %s from namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
347+
log.Printf("The user: %s is not authorized to add configmap: %s in namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
359348
http.Error(w, err.Error(), http.StatusForbidden)
360349
return
361350
}
@@ -408,9 +397,9 @@ func (k *KatibUIHandler) EditTemplate(w http.ResponseWriter, r *http.Request) {
408397
updatedConfigMapPath := data["updatedConfigMapPath"].(string)
409398
updatedTemplateYaml := data["updatedTemplateYaml"].(string)
410399

411-
err = IsAuthorized(user, "update", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, &k.sarClient)
400+
err = IsAuthorized(user, "update", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, k.sarClient)
412401
if err != nil {
413-
log.Printf("The user: %s is not authorized to edit configmap: %s from namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
402+
log.Printf("The user: %s is not authorized to edit configmap: %s in namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
414403
http.Error(w, err.Error(), http.StatusForbidden)
415404
return
416405
}
@@ -460,9 +449,9 @@ func (k *KatibUIHandler) DeleteTemplate(w http.ResponseWriter, r *http.Request)
460449
updatedConfigMapName := data["updatedConfigMapName"].(string)
461450
updatedConfigMapPath := data["updatedConfigMapPath"].(string)
462451

463-
err = IsAuthorized(user, "delete", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, &k.sarClient)
452+
err = IsAuthorized(user, "delete", updatedConfigMapNamespace, "", "v1", "configmaps", "", updatedConfigMapName, k.sarClient)
464453
if err != nil {
465-
log.Printf("The user: %s is not authorized to delete configmap: %s from namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
454+
log.Printf("The user: %s is not authorized to delete configmap: %s in namespace: %s \n", user, updatedConfigMapName, updatedConfigMapNamespace)
466455
http.Error(w, err.Error(), http.StatusForbidden)
467456
return
468457
}
@@ -541,9 +530,9 @@ func (k *KatibUIHandler) FetchExperiment(w http.ResponseWriter, r *http.Request)
541530
experimentName := experimentNames[0]
542531
namespace := namespaces[0]
543532

544-
err = IsAuthorized(user, "get", namespace, "kubeflow.org", "v1beta1", "experiments", "", experimentName, &k.sarClient)
533+
err = IsAuthorized(user, "get", namespace, "kubeflow.org", "v1beta1", "experiments", "", experimentName, k.sarClient)
545534
if err != nil {
546-
log.Printf("The user: %s is not authorized to get experiment: %s from namespace: %s \n", user, experimentName, namespace)
535+
log.Printf("The user: %s is not authorized to get experiment: %s in namespace: %s \n", user, experimentName, namespace)
547536
http.Error(w, err.Error(), http.StatusForbidden)
548537
return
549538
}
@@ -594,9 +583,9 @@ func (k *KatibUIHandler) FetchSuggestion(w http.ResponseWriter, r *http.Request)
594583
suggestionName := suggestionNames[0]
595584
namespace := namespaces[0]
596585

597-
err = IsAuthorized(user, "get", namespace, "kubeflow.org", "v1beta1", "suggestions", "", suggestionName, &k.sarClient)
586+
err = IsAuthorized(user, "get", namespace, "kubeflow.org", "v1beta1", "suggestions", "", suggestionName, k.sarClient)
598587
if err != nil {
599-
log.Printf("The user: %s is not authorized to get suggestion: %s from namespace: %s \n", user, suggestionName, namespace)
588+
log.Printf("The user: %s is not authorized to get suggestion: %s in namespace: %s \n", user, suggestionName, namespace)
600589
http.Error(w, err.Error(), http.StatusForbidden)
601590
return
602591
}

‎pkg/new-ui/v1beta1/types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import (
2020
v1beta1experiment "github.com/kubeflow/katib/pkg/apis/controller/experiments/v1beta1"
2121
"github.com/kubeflow/katib/pkg/controller.v1beta1/consts"
2222
"github.com/kubeflow/katib/pkg/util/v1beta1/katibclient"
23-
"k8s.io/client-go/kubernetes"
23+
"sigs.k8s.io/controller-runtime/pkg/client"
2424
)
2525

2626
var (
@@ -76,7 +76,7 @@ type Template struct {
7676

7777
type KatibUIHandler struct {
7878
katibClient katibclient.Client
79-
sarClient kubernetes.Clientset
79+
sarClient client.Client
8080
dbManagerAddr string
8181
}
8282

‎pkg/new-ui/v1beta1/util.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ func (k *KatibUIHandler) getTrialTemplatesViewList(user string) ([]TrialTemplate
104104
} else {
105105
// for all other namespaces check authorization rbac
106106
configmapName := cmap.ObjectMeta.Name
107-
err = IsAuthorized(user, "get", ns, "", "v1", "configmaps", "", configmapName, &k.sarClient)
107+
err = IsAuthorized(user, "get", ns, "", "v1", "configmaps", "", configmapName, k.sarClient)
108108
if err != nil {
109109
log.Printf("The user: %s is not authorized to view configmap: %s from namespace: %s \n", user, configmapName, ns)
110110
return nil, err

0 commit comments

Comments
 (0)