forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request kubernetes#58143 from CaoShuFeng/audit_annotation_…
…another_version Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Add PodSecurityPolicy information to audit logs Depends on: kubernetes#58806 Fix kubernetes#56209 **Release note**: ```release-note PodSecurityPolicy admission information is added to audit logs ```
- Loading branch information
Showing
13 changed files
with
463 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
staging/src/k8s.io/apiserver/pkg/admission/attributes_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| Copyright 2018 The Kubernetes Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package admission | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestAddAnnotation(t *testing.T) { | ||
| attr := &attributesRecord{} | ||
|
|
||
| // test AddAnnotation | ||
| attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/validate-policy", "privileged") | ||
| attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/admit-policy", "privileged") | ||
| annotations := attr.getAnnotations() | ||
| assert.Equal(t, annotations["podsecuritypolicy.admission.k8s.io/validate-policy"], "privileged") | ||
|
|
||
| // test overwrite | ||
| assert.Error(t, attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/validate-policy", "privileged-overwrite"), | ||
| "admission annotations should not be allowd to be overwritten") | ||
| annotations = attr.getAnnotations() | ||
| assert.Equal(t, annotations["podsecuritypolicy.admission.k8s.io/validate-policy"], "privileged", "admission annotations should not be overwritten") | ||
|
|
||
| // test invalid plugin names | ||
| var testCases map[string]string = map[string]string{ | ||
| "invalid dns subdomain": "INVALID-DNS-Subdomain/policy", | ||
| "no plugin name": "policy", | ||
| "no key name": "podsecuritypolicy.admission.k8s.io", | ||
| "empty key": "", | ||
| } | ||
| for name, invalidKey := range testCases { | ||
| err := attr.AddAnnotation(invalidKey, "value-foo") | ||
| assert.Error(t, err) | ||
| annotations = attr.getAnnotations() | ||
| assert.Equal(t, annotations[invalidKey], "", name+": invalid pluginName is not allowed ") | ||
| } | ||
|
|
||
| // test all saved annotations | ||
| assert.Equal( | ||
| t, | ||
| annotations, | ||
| map[string]string{ | ||
| "podsecuritypolicy.admission.k8s.io/validate-policy": "privileged", | ||
| "podsecuritypolicy.admission.k8s.io/admit-policy": "privileged", | ||
| }, | ||
| "unexpected final annotations", | ||
| ) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| /* | ||
| Copyright 2018 The Kubernetes Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package admission | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| auditinternal "k8s.io/apiserver/pkg/apis/audit" | ||
| "k8s.io/apiserver/pkg/audit" | ||
| ) | ||
|
|
||
| // auditHandler logs annotations set by other admission handlers | ||
| type auditHandler struct { | ||
| Interface | ||
| ae *auditinternal.Event | ||
| } | ||
|
|
||
| var _ Interface = &auditHandler{} | ||
| var _ MutationInterface = &auditHandler{} | ||
| var _ ValidationInterface = &auditHandler{} | ||
|
|
||
| // WithAudit is a decorator for a admission phase. It saves annotations | ||
| // of attribute into the audit event. Attributes passed to the Admit and | ||
| // Validate function must be instance of privateAnnotationsGetter or | ||
| // AnnotationsGetter, otherwise an error is returned. | ||
| func WithAudit(i Interface, ae *auditinternal.Event) Interface { | ||
| if i == nil { | ||
| return i | ||
| } | ||
| return &auditHandler{i, ae} | ||
| } | ||
|
|
||
| func (handler auditHandler) Admit(a Attributes) error { | ||
| if !handler.Interface.Handles(a.GetOperation()) { | ||
| return nil | ||
| } | ||
| if err := ensureAnnotationGetter(a); err != nil { | ||
| return err | ||
| } | ||
| var err error | ||
| if mutator, ok := handler.Interface.(MutationInterface); ok { | ||
| err = mutator.Admit(a) | ||
| handler.logAnnotations(a) | ||
| } | ||
| return err | ||
| } | ||
|
|
||
| func (handler auditHandler) Validate(a Attributes) error { | ||
| if !handler.Interface.Handles(a.GetOperation()) { | ||
| return nil | ||
| } | ||
| if err := ensureAnnotationGetter(a); err != nil { | ||
| return err | ||
| } | ||
| var err error | ||
| if validator, ok := handler.Interface.(ValidationInterface); ok { | ||
| err = validator.Validate(a) | ||
| handler.logAnnotations(a) | ||
| } | ||
| return err | ||
| } | ||
|
|
||
| func ensureAnnotationGetter(a Attributes) error { | ||
| _, okPrivate := a.(privateAnnotationsGetter) | ||
| _, okPublic := a.(AnnotationsGetter) | ||
| if okPrivate || okPublic { | ||
| return nil | ||
| } | ||
| return fmt.Errorf("attributes must be an instance of privateAnnotationsGetter or AnnotationsGetter") | ||
| } | ||
|
|
||
| func (handler auditHandler) logAnnotations(a Attributes) { | ||
| switch a := a.(type) { | ||
| case privateAnnotationsGetter: | ||
| audit.LogAnnotations(handler.ae, a.getAnnotations()) | ||
| case AnnotationsGetter: | ||
| audit.LogAnnotations(handler.ae, a.GetAnnotations()) | ||
| default: | ||
| // this will never happen, because we have already checked it in ensureAnnotationGetter | ||
| } | ||
| } |
Oops, something went wrong.