Skip to content

Commit

Permalink
Switch from Norman to Wrangler based controllers
Browse files Browse the repository at this point in the history 
Signed-off-by: Chad Roberts <[email protected]>
  • Loading branch information
@crobby
crobby committed Oct 17, 2024
1 parent 1722103 commit d0a0154
Show file tree
Hide file tree
Showing 2 changed files with 44 additions and 45 deletions.
85 changes: 42 additions & 43 deletions pkg/auth/providers/common/usermanager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,17 +9,16 @@ import (
"strings"
"time"

v32 "github.com/rancher/rancher/pkg/apis/management.cattle.io/v3"

"github.com/pkg/errors"
"github.com/rancher/norman/types"
"github.com/rancher/norman/types/slice"
v3 "github.com/rancher/rancher/pkg/apis/management.cattle.io/v3"
"github.com/rancher/rancher/pkg/auth/tokens"
tokenUtil "github.com/rancher/rancher/pkg/auth/tokens"
v3 "github.com/rancher/rancher/pkg/generated/norman/management.cattle.io/v3"
rbacv1 "github.com/rancher/rancher/pkg/generated/norman/rbac.authorization.k8s.io/v1"
wrangmgmtv3 "github.com/rancher/rancher/pkg/generated/controllers/management.cattle.io/v3"
"github.com/rancher/rancher/pkg/types/config"
"github.com/rancher/rancher/pkg/user"
wrangrbacv1 "github.com/rancher/wrangler/v3/pkg/generated/controllers/rbac/v1"
"github.com/rancher/wrangler/v3/pkg/randomtoken"
"github.com/sirupsen/logrus"
k8srbacv1 "k8s.io/api/rbac/v1"
Expand All @@ -41,20 +40,20 @@ const (
)

func NewUserManagerNoBindings(scaledContext *config.ScaledContext) (user.Manager, error) {
userInformer := scaledContext.Management.Users("").Controller().Informer()
userIndexers := map[string]cache.IndexFunc{
userByPrincipalIndex: userByPrincipal,
}
if err := userInformer.AddIndexers(userIndexers); err != nil {
return nil, err
}
userInformer := scaledContext.Wrangler.Mgmt.User().Informer()
//userIndexers := map[string]cache.IndexFunc{
// userByPrincipalIndex: userByPrincipal,
//}
//if err := userInformer.AddIndexers(userIndexers); err != nil {
// return nil, err
//}

return &userManager{
users: scaledContext.Management.Users(""),
users: scaledContext.Wrangler.Mgmt.User(),
userIndexer: userInformer.GetIndexer(),
tokens: scaledContext.Management.Tokens(""),
tokenLister: scaledContext.Management.Tokens("").Controller().Lister(),
rbacClient: scaledContext.RBAC,
tokens: scaledContext.Wrangler.Mgmt.Token(),
tokenLister: scaledContext.Wrangler.Mgmt.Token().Cache(),
rbacClient: scaledContext.Wrangler.RBAC,
}, nil
}

Expand All @@ -66,31 +65,31 @@ var backoff = wait.Backoff{
}

func NewUserManager(scaledContext *config.ScaledContext) (user.Manager, error) {
userInformer := scaledContext.Management.Users("").Controller().Informer()
userInformer := scaledContext.Wrangler.Mgmt.User().Informer()
userIndexers := map[string]cache.IndexFunc{
userByPrincipalIndex: userByPrincipal,
}
if err := userInformer.AddIndexers(userIndexers); err != nil {
return nil, err
}

crtbInformer := scaledContext.Management.ClusterRoleTemplateBindings("").Controller().Informer()
crtbInformer := scaledContext.Wrangler.Mgmt.ClusterRoleTemplateBinding().Informer()
crtbIndexers := map[string]cache.IndexFunc{
crtbsByPrincipalAndUserIndex: crtbsByPrincipalAndUser,
}
if err := crtbInformer.AddIndexers(crtbIndexers); err != nil {
return nil, err
}

prtbInformer := scaledContext.Management.ProjectRoleTemplateBindings("").Controller().Informer()
prtbInformer := scaledContext.Wrangler.Mgmt.ProjectRoleTemplateBinding().Informer()
prtbIndexers := map[string]cache.IndexFunc{
prtbsByPrincipalAndUserIndex: prtbsByPrincipalAndUser,
}
if err := prtbInformer.AddIndexers(prtbIndexers); err != nil {
return nil, err
}

grbInformer := scaledContext.Management.GlobalRoleBindings("").Controller().Informer()
grbInformer := scaledContext.Wrangler.Mgmt.GlobalRoleBinding().Informer()
grbIndexers := map[string]cache.IndexFunc{
grbByUserIndex: grbByUser,
}
Expand All @@ -100,36 +99,36 @@ func NewUserManager(scaledContext *config.ScaledContext) (user.Manager, error) {

return &userManager{
manageBindings: true,
users: scaledContext.Management.Users(""),
users: scaledContext.Wrangler.Mgmt.User(),
userIndexer: userInformer.GetIndexer(),
crtbIndexer: crtbInformer.GetIndexer(),
prtbIndexer: prtbInformer.GetIndexer(),
tokens: scaledContext.Management.Tokens(""),
tokenLister: scaledContext.Management.Tokens("").Controller().Lister(),
globalRoleBindings: scaledContext.Management.GlobalRoleBindings(""),
globalRoleLister: scaledContext.Management.GlobalRoles("").Controller().Lister(),
tokens: scaledContext.Wrangler.Mgmt.Token(),
tokenLister: scaledContext.Wrangler.Mgmt.Token().Cache(),
globalRoleBindings: scaledContext.Wrangler.Mgmt.GlobalRoleBinding(),
globalRoleLister: scaledContext.Wrangler.Mgmt.GlobalRole().Cache(),
grbIndexer: grbInformer.GetIndexer(),
clusterRoleLister: scaledContext.RBAC.ClusterRoles("").Controller().Lister(),
clusterRoleBindingLister: scaledContext.RBAC.ClusterRoleBindings("").Controller().Lister(),
rbacClient: scaledContext.RBAC,
clusterRoleLister: scaledContext.Wrangler.RBAC.ClusterRole().Cache(),
clusterRoleBindingLister: scaledContext.Wrangler.RBAC.ClusterRoleBinding().Cache(),
rbacClient: scaledContext.Wrangler.RBAC,
}, nil
}

type userManager struct {
// manageBinding means whether or not we gr, grb, crtb, and prtb exist in the cluster
manageBindings bool
users v3.UserInterface
globalRoleBindings v3.GlobalRoleBindingInterface
globalRoleLister v3.GlobalRoleLister
users wrangmgmtv3.UserController
globalRoleBindings wrangmgmtv3.GlobalRoleBindingController
globalRoleLister wrangmgmtv3.GlobalRoleCache
grbIndexer cache.Indexer
userIndexer cache.Indexer
crtbIndexer cache.Indexer
prtbIndexer cache.Indexer
tokenLister v3.TokenLister
tokens v3.TokenInterface
clusterRoleLister rbacv1.ClusterRoleLister
clusterRoleBindingLister rbacv1.ClusterRoleBindingLister
rbacClient rbacv1.Interface
tokenLister wrangmgmtv3.TokenCache
tokens wrangmgmtv3.TokenController
clusterRoleLister wrangrbacv1.ClusterRoleCache
clusterRoleBindingLister wrangrbacv1.ClusterRoleBindingCache
rbacClient wrangrbacv1.Interface
}

func (m *userManager) SetPrincipalOnCurrentUser(apiContext *types.APIContext, principal v3.Principal) (*v3.User, error) {
Expand Down Expand Up @@ -241,7 +240,7 @@ func (m *userManager) EnsureClusterToken(clusterName string, input user.TokenInp
var err error
var token *v3.Token
if !input.Randomize {
token, err = m.tokenLister.Get("", input.TokenName)
token, err = m.tokenLister.Get(input.TokenName)
if err != nil && !apierrors.IsNotFound(err) {
return "", err
}
Expand Down Expand Up @@ -420,7 +419,7 @@ func (m *userManager) EnsureUser(principalName, displayName string) (*v3.User, e
return user, nil
}

if v32.UserConditionInitialRolesPopulated.IsTrue(user) {
if v3.UserConditionInitialRolesPopulated.IsTrue(user) {
// The users global role bindings were already created. They can differ
// from what is in the annotation if they were updated manually.
return user, nil
Expand Down Expand Up @@ -486,7 +485,7 @@ func (m *userManager) CreateNewUserClusterRoleBinding(userName string, userUID a
UID: userUID,
}

cr, err := m.clusterRoleLister.Get("", roleName)
cr, err := m.clusterRoleLister.Get(roleName)
if err != nil {
if !apierrors.IsNotFound(err) {
return err
Expand All @@ -506,15 +505,15 @@ func (m *userManager) CreateNewUserClusterRoleBinding(userName string, userUID a
Rules: []k8srbacv1.PolicyRule{rule},
}

cr, err = m.rbacClient.ClusterRoles("").Create(role)
cr, err = m.rbacClient.ClusterRole().Create(role)
if err != nil {
if !apierrors.IsAlreadyExists(err) {
return err
}
}
}

_, err = m.clusterRoleBindingLister.Get("", bindingName)
_, err = m.clusterRoleBindingLister.Get(bindingName)
if err != nil {
if !apierrors.IsNotFound(err) {
return err
Expand All @@ -536,7 +535,7 @@ func (m *userManager) CreateNewUserClusterRoleBinding(userName string, userUID a
Name: cr.Name,
},
}
_, err = m.rbacClient.ClusterRoleBindings("").Create(crb)
_, err = m.rbacClient.ClusterRoleBinding().Create(crb)
if err != nil {
if !apierrors.IsAlreadyExists(err) {
return err
Expand Down Expand Up @@ -610,7 +609,7 @@ func (m *userManager) createUsersBindings(user *v3.User) error {
user.Annotations[roleTemplatesRequired] = rtr

if reflect.DeepEqual(roleMap["required"], createdRoles) {
v32.UserConditionInitialRolesPopulated.True(user)
v3.UserConditionInitialRolesPopulated.True(user)
}

_, err = m.users.Update(user)
Expand All @@ -636,7 +635,7 @@ func (m *userManager) createUsersRoleAnnotation() (map[string]string, error) {

roleMap := make(map[string][]string)

roles, err := m.globalRoleLister.List("", labels.NewSelector())
roles, err := m.globalRoleLister.List(labels.NewSelector())
if err != nil {
return nil, err
}
Expand Down
4 changes: 2 additions & 2 deletions pkg/auth/server.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,8 @@ func NewServer(ctx context.Context, cfg *rest.Config, wContext *wrangler.Context
return nil, err
}

sc.Wrangler = wContext

sc.UserManager, err = common.NewUserManagerNoBindings(sc)
if err != nil {
return nil, err
Expand All @@ -66,8 +68,6 @@ func NewServer(ctx context.Context, cfg *rest.Config, wContext *wrangler.Context
return nil, err
}

sc.Wrangler = wContext

authenticator := requests.NewAuthenticator(ctx, clusterrouter.GetClusterID, sc)
authManagement, err := newAPIManagement(ctx, sc)
if err != nil {
Expand Down

0 comments on commit d0a0154

Please sign in to comment.