kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11127 from olemarkus/validate-apiserver-authz 

Validate that kube-apiserver has the necessary authz modes set
This commit is contained in:
Kubernetes Prow Robot 2021-03-24 03:24:07 -07:00 committed by GitHub
parent 9786905712 b1d106e375
commit e691d55544
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 81 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
pkg/apis/kops/validation/validation.go
View File

@ -454,12 +454,33 @@ func validateKubeAPIServer(v *kops.KubeAPIServerConfig, c *kops.Cluster, fldPath
}
}
if v.AuthorizationMode != nil && strings.Contains(*v.AuthorizationMode, "Webhook") {
if v.AuthorizationWebhookConfigFile == nil {
allErrs = append(allErrs, field.Required(fldPath.Child("authorizationWebhookConfigFile"), "Authorization mode Webhook requires authorizationWebhookConfigFile to be specified"))
if v.AuthorizationMode != nil {
if strings.Contains(*v.AuthorizationMode, "Webhook") {
if v.AuthorizationWebhookConfigFile == nil {
allErrs = append(allErrs, field.Required(fldPath.Child("authorizationWebhookConfigFile"), "Authorization mode Webhook requires authorizationWebhookConfigFile to be specified"))
}
}
if c.Spec.Authorization != nil && c.Spec.Authorization.RBAC != nil {
var hasNode, hasRBAC bool
for _, mode := range strings.Split(*v.AuthorizationMode, ",") {
switch mode {
case "Node":
hasNode = true
case "RBAC":
hasRBAC = true
default:
allErrs = append(allErrs, IsValidValue(fldPath.Child("authorizationMode"), &mode, []string{"ABAC", "Webhook", "Node", "RBAC", "AlwaysAllow", "AlwaysDeny"})...)
}
}
if kops.CloudProviderID(c.Spec.CloudProvider) == kops.CloudProviderAWS && c.IsKubernetesGTE("1.19") {
if !hasNode || !hasRBAC {
allErrs = append(allErrs, field.Required(fldPath.Child("authorizationMode"), "As of kubernetes 1.19 on AWS, authorizationMode must include RBAC and Node"))
}
}
}
}
return allErrs
}

61
pkg/apis/kops/validation/validation_test.go
View File

@ -169,6 +169,7 @@ func TestValidateKubeAPIServer(t *testing.T) {
grid := []struct {
Input kops.KubeAPIServerConfig
Cluster *kops.Cluster
ExpectedErrors []string
ExpectedDetail string
}{
@ -207,14 +208,64 @@ func TestValidateKubeAPIServer(t *testing.T) {
},
ExpectedDetail: "Authorization mode Webhook requires authorizationWebhookConfigFile to be specified",
},
{
Input: kops.KubeAPIServerConfig{
AuthorizationMode: fi.String("RBAC"),
},
Cluster: &kops.Cluster{
Spec: kops.ClusterSpec{
Authorization: &kops.AuthorizationSpec{
RBAC: &kops.RBACAuthorizationSpec{},
},
KubernetesVersion: "1.19.0",
CloudProvider: "aws",
},
},
ExpectedErrors: []string{
"Required value::KubeAPIServer.authorizationMode",
},
},
{
Input: kops.KubeAPIServerConfig{
AuthorizationMode: fi.String("RBAC,Node"),
},
Cluster: &kops.Cluster{
Spec: kops.ClusterSpec{
Authorization: &kops.AuthorizationSpec{
RBAC: &kops.RBACAuthorizationSpec{},
},
KubernetesVersion: "1.19.0",
CloudProvider: "aws",
},
},
},
{
Input: kops.KubeAPIServerConfig{
AuthorizationMode: fi.String("RBAC,Node,Bogus"),
},
Cluster: &kops.Cluster{
Spec: kops.ClusterSpec{
Authorization: &kops.AuthorizationSpec{
RBAC: &kops.RBACAuthorizationSpec{},
},
KubernetesVersion: "1.19.0",
CloudProvider: "aws",
},
},
ExpectedErrors: []string{
"Unsupported value::KubeAPIServer.authorizationMode",
},
},
}
for _, g := range grid {
cluster := &kops.Cluster{
Spec: kops.ClusterSpec{
KubernetesVersion: "1.16.0",
},
if g.Cluster == nil {
g.Cluster = &kops.Cluster{
Spec: kops.ClusterSpec{
KubernetesVersion: "1.16.0",
},
}
}
errs := validateKubeAPIServer(&g.Input, cluster, field.NewPath("KubeAPIServer"))
errs := validateKubeAPIServer(&g.Input, g.Cluster, field.NewPath("KubeAPIServer"))
testErrors(t, g.Input, errs, g.ExpectedErrors)