-
Notifications
You must be signed in to change notification settings - Fork 1
/
proxy_auditlog.go
92 lines (82 loc) · 2.45 KB
/
proxy_auditlog.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
package httpproxy
import (
"encoding/json"
"net/http"
"net/http/httputil"
"github.com/rancher/types/config"
"github.com/sirupsen/logrus"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
type Role struct {
ID string `json:"id"`
Role string `json:"role"`
}
type UserRole struct {
UserID string `json:"userid"`
GlobalRole []Role `json:"globalRole"`
ClusterRole []Role `json:"clusterRole"`
ProjectRole []Role `json:"projectRole"`
}
func NewAuditlogProxy(prefix string, validHosts Supplier, scaledContext *config.ScaledContext) http.Handler {
p := proxy{
prefix: prefix,
validHostsSupplier: validHosts,
credentials: scaledContext.Core.Secrets(""),
}
return &httputil.ReverseProxy{
Director: func(req *http.Request) {
userRole := UserRole{}
userID := req.Header.Get("Impersonate-User")
userRole.UserID = userID
globalRoleBindings, err := scaledContext.Management.GlobalRoleBindings("").List(metav1.ListOptions{})
if err != nil {
logrus.Errorln("[AuditlogProxy] List GlobalRoleBindings err", err)
} else {
for _, v := range globalRoleBindings.Items {
if v.UserName == userID {
role := Role{
ID: "",
Role: v.GlobalRoleName,
}
userRole.GlobalRole = append(userRole.GlobalRole, role)
}
}
}
clusterRoleBindings, err := scaledContext.Management.ClusterRoleTemplateBindings("").List(metav1.ListOptions{})
if err != nil {
} else {
for _, v := range clusterRoleBindings.Items {
if v.UserName == userID {
role := Role{
ID: v.ClusterName,
Role: v.RoleTemplateName,
}
userRole.ClusterRole = append(userRole.ClusterRole, role)
}
}
}
projectRoleBindings, err := scaledContext.Management.ProjectRoleTemplateBindings("").List(metav1.ListOptions{})
if err != nil {
logrus.Errorln("[AuditlogProxy] List ProjectRoleTemplateBindings err", err)
} else {
for _, v := range projectRoleBindings.Items {
if v.UserName == userID {
role := Role{
ID: v.ProjectName,
Role: v.RoleTemplateName,
}
userRole.ProjectRole = append(userRole.ProjectRole, role)
}
}
}
userinfo, err := json.Marshal(userRole)
if err != nil {
logrus.Errorln("[AuditlogProxy] userRole json Marshal error:", err)
}
req.Header.Set("userinfo", string(userinfo))
if err := p.proxy(req); err != nil {
logrus.Errorf("[AuditlogProxy] Failed to proxy %v: %v", req, err)
}
},
}
}