forked from openshift/origin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
admission.go
148 lines (130 loc) · 4.21 KB
/
admission.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
package requestlimit
import (
"fmt"
"io"
"io/ioutil"
"reflect"
"k8s.io/kubernetes/pkg/admission"
kapi "k8s.io/kubernetes/pkg/api"
kclient "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/pkg/labels"
"github.com/openshift/origin/pkg/client"
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
configlatest "github.com/openshift/origin/pkg/cmd/server/api/latest"
projectapi "github.com/openshift/origin/pkg/project/api"
projectcache "github.com/openshift/origin/pkg/project/cache"
)
func init() {
admission.RegisterPlugin("ProjectRequestLimit", func(client kclient.Interface, config io.Reader) (admission.Interface, error) {
pluginConfig, err := readConfig(config)
if err != nil {
return nil, err
}
return NewProjectRequestLimit(pluginConfig)
})
}
func readConfig(reader io.Reader) (*ProjectRequestLimitConfig, error) {
if reader == nil || reflect.ValueOf(reader).IsNil() {
return &ProjectRequestLimitConfig{}, nil
}
configBytes, err := ioutil.ReadAll(reader)
if err != nil {
return nil, err
}
config := &ProjectRequestLimitConfig{}
err = configlatest.ReadYAML(configBytes, config)
if err != nil {
return nil, err
}
errs := ValidateProjectRequestLimitConfig(config)
if len(errs) > 0 {
return nil, errs.ToAggregate()
}
return config, nil
}
type projectRequestLimit struct {
*admission.Handler
client client.Interface
config *ProjectRequestLimitConfig
cache *projectcache.ProjectCache
}
// ensure that the required Openshift admission interfaces are implemented
var _ = oadmission.WantsProjectCache(&projectRequestLimit{})
var _ = oadmission.WantsOpenshiftClient(&projectRequestLimit{})
var _ = oadmission.Validator(&projectRequestLimit{})
// Admit ensures that only a configured number of projects can be requested by a particular user.
func (o *projectRequestLimit) Admit(a admission.Attributes) (err error) {
if a.GetResource() != projectapi.Resource("projectrequests") {
return nil
}
if _, isProjectRequest := a.GetObject().(*projectapi.ProjectRequest); !isProjectRequest {
return nil
}
userName := a.GetUserInfo().GetName()
projectCount, err := o.projectCountByRequester(userName)
if err != nil {
return err
}
maxProjects, hasLimit, err := o.maxProjectsByRequester(userName)
if err != nil {
return err
}
if hasLimit && projectCount >= maxProjects {
return admission.NewForbidden(a, fmt.Errorf("user %s cannot create more than %d project(s).", userName, maxProjects))
}
return nil
}
// maxProjectsByRequester returns the maximum number of projects allowed for a given user, whether a limit exists, and an error
// if an error occurred. If a limit doesn't exist, the maximum number should be ignored.
func (o *projectRequestLimit) maxProjectsByRequester(userName string) (int, bool, error) {
// prevent a user lookup if no limits are configured
if len(o.config.Limits) == 0 {
return 0, false, nil
}
user, err := o.client.Users().Get(userName)
if err != nil {
return 0, false, err
}
userLabels := labels.Set(user.Labels)
for _, limit := range o.config.Limits {
selector := labels.Set(limit.Selector).AsSelector()
if selector.Matches(userLabels) {
if limit.MaxProjects == nil {
return 0, false, nil
}
return *limit.MaxProjects, true, nil
}
}
return 0, false, nil
}
func (o *projectRequestLimit) projectCountByRequester(userName string) (int, error) {
namespaces, err := o.cache.Store.ByIndex("requester", userName)
if err != nil {
return 0, err
}
return len(namespaces), nil
}
func (o *projectRequestLimit) SetOpenshiftClient(client client.Interface) {
o.client = client
}
func (o *projectRequestLimit) SetProjectCache(cache *projectcache.ProjectCache) {
o.cache = cache
}
func (o *projectRequestLimit) Validate() error {
if o.client == nil {
return fmt.Errorf("ProjectRequestLimit plugin requires an Openshift client")
}
if o.cache == nil {
return fmt.Errorf("ProjectRequestLimit plugin requires a project cache")
}
return nil
}
func NewProjectRequestLimit(config *ProjectRequestLimitConfig) (admission.Interface, error) {
return &projectRequestLimit{
config: config,
Handler: admission.NewHandler(admission.Create),
}, nil
}
func projectRequester(ns *kapi.Namespace) string {
return ns.Annotations[projectapi.ProjectRequester]
}