kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12869 from rifelpet/gcs-bucket-iam-cleanup 

Remove unused StorageBucketIam GCE task
This commit is contained in:
Kubernetes Prow Robot 2021-12-01 22:55:32 -08:00 committed by GitHub
parent 0be79b25b7 1573869515
commit 31b39ed9f9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 0 additions and 221 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
upup/pkg/fi/cloudup/gcetasks/BUILD.bazel generated
View File

@ -24,8 +24,6 @@ go_library(
"router_fitask.go",
"storagebucketacl.go",
"storagebucketacl_fitask.go",
"storagebucketiam.go",
"storagebucketiam_fitask.go",
"storageobjectacl.go",
"storageobjectacl_fitask.go",
"subnet.go",

167
upup/pkg/fi/cloudup/gcetasks/storagebucketiam.go
View File

@ -1,167 +0,0 @@
/*
Copyright 2017 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package gcetasks
import (
"fmt"
"google.golang.org/api/storage/v1"
"k8s.io/klog/v2"
"k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/cloudup/gce"
"k8s.io/kops/upup/pkg/fi/cloudup/terraform"
)
// StorageBucketIam represents an IAM policy on a google cloud storage bucket
// +kops:fitask
type StorageBucketIam struct {
Name *string
Lifecycle fi.Lifecycle
Bucket *string
Entity *string
Role *string
}
var _ fi.CompareWithID = &StorageBucketIam{}
func (e *StorageBucketIam) CompareWithID() *string {
return e.Name
}
func (e *StorageBucketIam) Find(c *fi.Context) (*StorageBucketIam, error) {
cloud := c.Cloud.(gce.GCECloud)
bucket := fi.StringValue(e.Bucket)
entity := fi.StringValue(e.Entity)
role := fi.StringValue(e.Role)
klog.V(2).Infof("Checking GCS IAM policy for gs://%s for %s", bucket, entity)
policy, err := cloud.Storage().Buckets.GetIamPolicy(bucket).Do()
if err != nil {
if gce.IsNotFound(err) {
policy = &storage.Policy{}
} else {
return nil, fmt.Errorf("error querying GCS IAM policy for gs://%s for %s: %v", bucket, entity, err)
}
}
for _, binding := range policy.Bindings {
if binding.Role != role {
continue
}
for _, member := range binding.Members {
if member == entity {
return &StorageBucketIam{
Name: e.Name,
Bucket: e.Bucket,
Entity: e.Entity,
Role: e.Role,
Lifecycle: e.Lifecycle,
}, nil
}
}
}
return nil, nil
}
func (e *StorageBucketIam) Run(c *fi.Context) error {
return fi.DefaultDeltaRunMethod(e, c)
}
func (_ *StorageBucketIam) CheckChanges(a, e, changes *StorageBucketIam) error {
if fi.StringValue(e.Bucket) == "" {
return fi.RequiredField("Bucket")
}
if fi.StringValue(e.Entity) == "" {
return fi.RequiredField("Entity")
}
return nil
}
func (_ *StorageBucketIam) RenderGCE(t *gce.GCEAPITarget, a, e, changes *StorageBucketIam) error {
bucket := fi.StringValue(e.Bucket)
entity := fi.StringValue(e.Entity)
role := fi.StringValue(e.Role)
policy, err := t.Cloud.Storage().Buckets.GetIamPolicy(bucket).Do()
if err != nil {
if gce.IsNotFound(err) {
policy = &storage.Policy{}
} else {
return fmt.Errorf("error querying GCS IAM policy for gs://%s: %v", bucket, err)
}
}
foundRole := false
for _, binding := range policy.Bindings {
if binding.Role != role {
continue
}
foundRole = true
foundMember := false
for _, member := range binding.Members {
if member == entity {
foundMember = true
}
}
if foundMember {
return nil
}
binding.Members = append(binding.Members, entity)
}
if !foundRole {
binding := &storage.PolicyBindings{
Role: role,
Members: []string{entity},
}
policy.Bindings = append(policy.Bindings, binding)
}
klog.V(2).Infof("Setting GCS IAM policy for gs://%s for %s: %s", bucket, entity, role)
if _, err := t.Cloud.Storage().Buckets.SetIamPolicy(bucket, policy).Do(); err != nil {
return fmt.Errorf("error setting GCS IAM policy for gs://%s for %s: %v", bucket, entity, err)
}
return nil
}
// type terraformStorageBucketIam struct {
// Bucket string `json:"bucket,omitempty" cty:"bucket"`
// RoleEntity []string `json:"role_entity,omitempty" cty:"role_entity"`
// }
func (_ *StorageBucketIam) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *StorageBucketIam) error {
//var roleEntities []string
//roleEntities = append(roleEntities, fi.StringValue(e.Role)+":"+fi.StringValue(e.Name))
//tf := &terraformStorageBucketIam{
// Bucket: fi.StringValue(e.Bucket),
// RoleEntity: roleEntities,
//}
//
//return t.RenderResource("google_storage_bucket_IAM policy", *e.Name, tf)
klog.Warningf("terraform does not support GCE IAM policies on GCS buckets; please ensure your service account has access")
return nil
}

52
upup/pkg/fi/cloudup/gcetasks/storagebucketiam_fitask.go
View File

@ -1,52 +0,0 @@
//go:build !ignore_autogenerated
// +build !ignore_autogenerated
/*
Copyright The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// Code generated by fitask. DO NOT EDIT.
package gcetasks
import (
"k8s.io/kops/upup/pkg/fi"
)
// StorageBucketIam
var _ fi.HasLifecycle = &StorageBucketIam{}
// GetLifecycle returns the Lifecycle of the object, implementing fi.HasLifecycle
func (o *StorageBucketIam) GetLifecycle() fi.Lifecycle {
return o.Lifecycle
}
// SetLifecycle sets the Lifecycle of the object, implementing fi.SetLifecycle
func (o *StorageBucketIam) SetLifecycle(lifecycle fi.Lifecycle) {
o.Lifecycle = lifecycle
}
var _ fi.HasName = &StorageBucketIam{}
// GetName returns the Name of the object, implementing fi.HasName
func (o *StorageBucketIam) GetName() *string {
return o.Name
}
// String is the stringer function for the task, producing readable output using fi.TaskAsString
func (o *StorageBucketIam) String() string {
return fi.TaskAsString(o)
}