forked from openshift/origin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
impersonate.go
74 lines (63 loc) · 2.82 KB
/
impersonate.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
package client
import (
"net/http"
"k8s.io/apiserver/pkg/authentication/user"
restclient "k8s.io/client-go/rest"
kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
authenticationapi "github.com/openshift/origin/pkg/auth/api"
authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
"github.com/openshift/origin/pkg/client"
)
type impersonatingRoundTripper struct {
user user.Info
delegate http.RoundTripper
}
// NewImpersonatingRoundTripper will add headers to impersonate a user, including user, groups, and scopes
func NewImpersonatingRoundTripper(user user.Info, delegate http.RoundTripper) http.RoundTripper {
return &impersonatingRoundTripper{user, delegate}
}
func (rt *impersonatingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
req = cloneRequest(req)
req.Header.Del(authenticationapi.ImpersonateUserHeader)
req.Header.Del(authenticationapi.ImpersonateGroupHeader)
req.Header.Del(authenticationapi.ImpersonateUserScopeHeader)
req.Header.Set(authenticationapi.ImpersonateUserHeader, rt.user.GetName())
for _, group := range rt.user.GetGroups() {
req.Header.Add(authenticationapi.ImpersonateGroupHeader, group)
}
for _, scope := range rt.user.GetExtra()[authorizationapi.ScopesKey] {
req.Header.Add(authenticationapi.ImpersonateUserScopeHeader, scope)
}
return rt.delegate.RoundTrip(req)
}
// cloneRequest returns a clone of the provided *http.Request.
// The clone is a shallow copy of the struct and its Header map.
func cloneRequest(r *http.Request) *http.Request {
// shallow copy of the struct
r2 := new(http.Request)
*r2 = *r
// deep copy of the Header
r2.Header = make(http.Header)
for k, s := range r.Header {
r2.Header[k] = s
}
return r2
}
// NewImpersonatingConfig wraps the config's transport to impersonate a user, including user, groups, and scopes
func NewImpersonatingConfig(user user.Info, config restclient.Config) restclient.Config {
oldWrapTransport := config.WrapTransport
config.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
return NewImpersonatingRoundTripper(user, oldWrapTransport(rt))
}
return config
}
// NewImpersonatingOpenShiftClient returns an OpenShift client that will impersonate a user, including user, groups, and scopes
func NewImpersonatingOpenShiftClient(user user.Info, config restclient.Config) (client.Interface, error) {
impersonatingConfig := NewImpersonatingConfig(user, config)
return client.New(&impersonatingConfig)
}
// NewImpersonatingKubernetesClientset returns a Kubernetes clientset that will impersonate a user, including user, groups, and scopes
func NewImpersonatingKubernetesClientset(user user.Info, config restclient.Config) (kclientset.Interface, error) {
impersonatingConfig := NewImpersonatingConfig(user, config)
return kclientset.NewForConfig(&impersonatingConfig)
}