From 33f546aafd9455f228db22d4bc01e62039382105 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Tue, 30 Oct 2018 00:12:19 +0800 Subject: [PATCH] =?UTF-8?q?=E9=87=8D=E6=9E=84=E4=BB=A3=E7=A0=81=EF=BC=8C?= =?UTF-8?q?=E5=B0=86policy=E4=BB=8Edb=E4=B8=AD=E5=88=86=E7=A6=BB=E5=87=BA?= =?UTF-8?q?=E6=9D=A5=EF=BC=8C=E4=BB=A3=E7=A0=81=E6=9B=B4=E5=B9=B2=E5=87=80?= =?UTF-8?q?=E4=B8=80=E4=BA=9B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cmd/climc/shell/policies.go | 6 +-- pkg/cloudcommon/auth.go | 7 ++-- pkg/cloudcommon/consts/consts.go | 23 ++++++++++++ pkg/cloudcommon/consts/db.go | 15 ++++++++ pkg/cloudcommon/consts/policy.go | 13 +++++++ pkg/cloudcommon/db/db_dispatcher.go | 45 ++++++++++++----------- pkg/cloudcommon/db/db_joint_dispatcher.go | 16 ++++---- pkg/cloudcommon/db/global.go | 44 ---------------------- pkg/cloudcommon/db/namevalidator.go | 5 ++- pkg/cloudcommon/db/quotas/handler.go | 38 ++++++++++--------- pkg/cloudcommon/db/rbac.go | 10 +++-- pkg/cloudcommon/db/tenantcache.go | 3 +- pkg/cloudcommon/options.go | 3 ++ pkg/cloudcommon/policy/global.go | 11 ++++++ pkg/cloudcommon/{db => policy}/policy.go | 7 ++-- pkg/compute/service/service.go | 3 +- pkg/compute/usages/handler.go | 14 ++++--- pkg/scheduler/manager/task_queue.go | 4 +- 18 files changed, 152 insertions(+), 115 deletions(-) create mode 100644 pkg/cloudcommon/consts/consts.go create mode 100644 pkg/cloudcommon/consts/db.go create mode 100644 pkg/cloudcommon/consts/policy.go delete mode 100644 pkg/cloudcommon/db/global.go create mode 100644 pkg/cloudcommon/policy/global.go rename pkg/cloudcommon/{db => policy}/policy.go (97%) diff --git a/cmd/climc/shell/policies.go b/cmd/climc/shell/policies.go index 4f595012b3..5bf125cfd2 100644 --- a/cmd/climc/shell/policies.go +++ b/cmd/climc/shell/policies.go @@ -8,7 +8,7 @@ import ( "strings" "time" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" "yunion.io/x/onecloud/pkg/mcclient/modules" @@ -189,7 +189,7 @@ func init() { } R(&PolicyExplainOptions{}, "policy-explain", "Explain policy result", func(s *mcclient.ClientSession, args *PolicyExplainOptions) error { auth.InitFromClientSession(s) - db.EnableGlobalRbac(15*time.Second, 15*time.Second) + policy.EnableGlobalRbac(15*time.Second, 15*time.Second) req := jsonutils.NewDict() for i := 0; i < len(args.Request); i += 1 { @@ -212,7 +212,7 @@ func init() { req.Add(jsonutils.NewArray(data...), key) } fmt.Println(req.String()) - result, err := db.PolicyManager.ExplainRpc(s.GetToken(), req) + result, err := policy.PolicyManager.ExplainRpc(s.GetToken(), req) if err != nil { return err } diff --git a/pkg/cloudcommon/auth.go b/pkg/cloudcommon/auth.go index 22220a7e1c..62bc0a63e7 100644 --- a/pkg/cloudcommon/auth.go +++ b/pkg/cloudcommon/auth.go @@ -5,7 +5,8 @@ import ( "os" "time" - "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient/auth" ) @@ -43,11 +44,11 @@ func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) { authComplete() if options.GlobalVirtualResourceNamespace { - db.EnableGlobalVirtualResourceNamespace() + consts.EnableGlobalVirtualResourceNamespace() } if options.EnableRbac { - db.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second, + policy.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second, time.Duration(options.RbacPolicySyncFailedRetrySeconds)*time.Second) } } diff --git a/pkg/cloudcommon/consts/consts.go b/pkg/cloudcommon/consts/consts.go new file mode 100644 index 0000000000..3c9464f117 --- /dev/null +++ b/pkg/cloudcommon/consts/consts.go @@ -0,0 +1,23 @@ +package consts + +var ( + globalRegion = "" + + globalServiceType = "" +) + +func SetRegion(region string) { + globalRegion = region +} + +func GetRegion() string { + return globalRegion +} + +func SetServiceType(srvType string) { + globalServiceType = srvType +} + +func GetServiceType() string { + return globalServiceType +} diff --git a/pkg/cloudcommon/consts/db.go b/pkg/cloudcommon/consts/db.go new file mode 100644 index 0000000000..8fdef6d6e8 --- /dev/null +++ b/pkg/cloudcommon/consts/db.go @@ -0,0 +1,15 @@ +package consts + +/// Global virtual resource namespace + +var ( + globalVirtualResourceNamespace = false +) + +func EnableGlobalVirtualResourceNamespace() { + globalVirtualResourceNamespace = true +} + +func IsGlobalVirtualResourceNamespace() bool { + return globalVirtualResourceNamespace +} diff --git a/pkg/cloudcommon/consts/policy.go b/pkg/cloudcommon/consts/policy.go new file mode 100644 index 0000000000..1c3e20a93e --- /dev/null +++ b/pkg/cloudcommon/consts/policy.go @@ -0,0 +1,13 @@ +package consts + +var ( + globalsRbacEnabled = false +) + +func EnableRbac() { + globalsRbacEnabled = true +} + +func IsRbacEnabled() bool { + return globalsRbacEnabled +} diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index 334f246ece..eaf1b0f762 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -15,7 +15,9 @@ import ( "yunion.io/x/sqlchemy" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -490,10 +492,10 @@ func (dispatcher *DBModelDispatcher) List(ctx context.Context, query jsonutils.J userCred := fetchUserCredential(ctx) var isAllow bool - if globalsRbacEnabled { + if consts.IsRbacEnabled() { isAdmin := jsonutils.QueryBoolean(query, "admin", false) - isAllow = PolicyManager.Allow(isAdmin, userCred, GetGlobalServiceType(), - dispatcher.modelManager.KeywordPlural(), PolicyActionList) + isAllow = policy.PolicyManager.Allow(isAdmin, userCred, consts.GetServiceType(), + dispatcher.modelManager.KeywordPlural(), policy.PolicyActionList) } else { isAllow = dispatcher.modelManager.AllowListItems(ctx, userCred, query) } @@ -602,8 +604,8 @@ func (dispatcher *DBModelDispatcher) Get(ctx context.Context, idStr string, quer } // log.Debugf("Get found %s", model) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionGet) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionGet) } else { isAllow = model.AllowGetDetails(ctx, userCred, query) } @@ -633,8 +635,8 @@ func (dispatcher *DBModelDispatcher) GetSpecific(ctx context.Context, idStr stri modelValue := reflect.ValueOf(model) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionGet, spec) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionGet, spec) } else { funcName := fmt.Sprintf("AllowGetDetails%s", specCamel) @@ -690,8 +692,9 @@ func fetchOwnerProjectId(ctx context.Context, userCred mcclient.TokenCredential, return userCred.GetProjectId(), nil } var isAllow bool - if globalsRbacEnabled { - isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(), PolicyDelegation, "") + if consts.IsRbacEnabled() { + isAllow = policy.PolicyManager.Allow(true, userCred, + consts.GetServiceType(), policy.PolicyDelegation, "") } else { isAllow = userCred.IsSystemAdmin() } @@ -811,8 +814,8 @@ func (dispatcher *DBModelDispatcher) Create(ctx context.Context, query jsonutils defer lockman.ReleaseClass(ctx, dispatcher.modelManager, ownerProjId) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, PolicyActionCreate) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, policy.PolicyActionCreate) } else { isAllow = dispatcher.modelManager.AllowCreateItem(ctx, userCred, query, data) } @@ -875,8 +878,8 @@ func (dispatcher *DBModelDispatcher) BatchCreate(ctx context.Context, query json defer lockman.ReleaseClass(ctx, dispatcher.modelManager, ownerProjId) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, PolicyActionCreate) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, policy.PolicyActionCreate) } else { isAllow = dispatcher.modelManager.AllowCreateItem(ctx, userCred, query, data) } @@ -942,8 +945,8 @@ func (dispatcher *DBModelDispatcher) PerformClassAction(ctx context.Context, act data := body.(*jsonutils.JSONDict) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(manager, nil, userCred, PolicyActionPerform, action) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(manager, nil, userCred, policy.PolicyActionPerform, action) } else { isAllow = manager.AllowPerformCheckCreateData(ctx, userCred, query, data) } @@ -1020,8 +1023,8 @@ func objectPerformAction(dispatcher *DBModelDispatcher, model IModel, modelValue } var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionPerform, action) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionPerform, action) } else { allowFuncName := "Allow" + funcName allowFuncValue := modelValue.MethodByName(allowFuncName) @@ -1132,8 +1135,8 @@ func (dispatcher *DBModelDispatcher) Update(ctx context.Context, idStr string, q } var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionUpdate) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionUpdate) } else { isAllow = model.AllowUpdateItem(ctx, userCred) } @@ -1168,8 +1171,8 @@ func deleteItem(manager IModelManager, model IModel, ctx context.Context, userCr log.Debugf("deleteItem %s", jsonutils.Marshal(model)) var isAllow bool - if globalsRbacEnabled { - isAllow = isRbacAllowed(manager, model, userCred, PolicyActionDelete) + if consts.IsRbacEnabled() { + isAllow = isRbacAllowed(manager, model, userCred, policy.PolicyActionDelete) } else { isAllow = model.AllowDeleteItem(ctx, userCred, query, data) } diff --git a/pkg/cloudcommon/db/db_joint_dispatcher.go b/pkg/cloudcommon/db/db_joint_dispatcher.go index 9d629f6b35..638e810e65 100644 --- a/pkg/cloudcommon/db/db_joint_dispatcher.go +++ b/pkg/cloudcommon/db/db_joint_dispatcher.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type DBJointModelDispatcher struct { @@ -99,10 +101,10 @@ func (dispatcher *DBJointModelDispatcher) ListSlaveDescendent(ctx context.Contex func (dispatcher *DBJointModelDispatcher) _listJoint(ctx context.Context, userCred mcclient.TokenCredential, ctxModel IModel, queryDict jsonutils.JSONObject) (*modules.ListResult, error) { var isAllow bool - if IsGlobalRbacEnabled() { + if consts.IsRbacEnabled() { isAdmin := jsonutils.QueryBoolean(queryDict, "admin", false) - isAllow = PolicyManager.Allow(isAdmin, userCred, GetGlobalServiceType(), - dispatcher.JointModelManager().KeywordPlural(), PolicyActionList) + isAllow = policy.PolicyManager.Allow(isAdmin, userCred, consts.GetServiceType(), + dispatcher.JointModelManager().KeywordPlural(), policy.PolicyActionList) } else { isAllow = dispatcher.JointModelManager().AllowListDescendent(ctx, userCred, ctxModel, queryDict) } @@ -144,8 +146,8 @@ func (dispatcher *DBJointModelDispatcher) Get(ctx context.Context, id1 string, i return nil, httperrors.NewGeneralError(err) } var isAllow bool - if IsGlobalRbacEnabled() { - isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, PolicyActionGet) + if consts.IsRbacEnabled() { + isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, policy.PolicyActionGet) } else { isAllow = item.AllowGetJointDetails(ctx, userCred, query, item) } @@ -215,8 +217,8 @@ func (dispatcher *DBJointModelDispatcher) Update(ctx context.Context, id1 string } var isAllow bool - if IsGlobalRbacEnabled() { - isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, PolicyActionUpdate) + if consts.IsRbacEnabled() { + isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, policy.PolicyActionUpdate) } else { isAllow = item.AllowUpdateJointItem(ctx, userCred, item) } diff --git a/pkg/cloudcommon/db/global.go b/pkg/cloudcommon/db/global.go deleted file mode 100644 index 86e3c59efc..0000000000 --- a/pkg/cloudcommon/db/global.go +++ /dev/null @@ -1,44 +0,0 @@ -package db - -import "time" - -/// Global virtual resource namespace - -var ( - globalVirtualResourceNamespace = false - - globalRegion = "" - - globalServiceType = "" - - globalsRbacEnabled = false -) - -func EnableGlobalVirtualResourceNamespace() { - globalVirtualResourceNamespace = true -} - -func SetGlobalRegion(region string) { - globalRegion = region -} - -func GetGlobalRegion() string { - return globalRegion -} - -func SetGlobalServiceType(srvType string) { - globalServiceType = srvType -} - -func GetGlobalServiceType() string { - return globalServiceType -} - -func EnableGlobalRbac(refreshInterval time.Duration, retryInterval time.Duration) { - globalsRbacEnabled = true - PolicyManager.start(refreshInterval, retryInterval) -} - -func IsGlobalRbacEnabled() bool { - return globalsRbacEnabled -} diff --git a/pkg/cloudcommon/db/namevalidator.go b/pkg/cloudcommon/db/namevalidator.go index d679f8ff08..bc9f62fd0b 100644 --- a/pkg/cloudcommon/db/namevalidator.go +++ b/pkg/cloudcommon/db/namevalidator.go @@ -3,6 +3,7 @@ package db import ( "fmt" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/pkg/util/stringutils" ) @@ -10,7 +11,7 @@ import ( func isNameUnique(manager IModelManager, owner string, name string) bool { q := manager.Query() q = manager.FilterByName(q, name) - if !globalVirtualResourceNamespace { + if !consts.IsGlobalVirtualResourceNamespace() { q = manager.FilterByOwner(q, owner) } return q.Count() == 0 @@ -31,7 +32,7 @@ func isAlterNameUnique(model IModel, name string) bool { manager := model.GetModelManager() q := manager.Query() q = manager.FilterByName(q, name) - if !globalVirtualResourceNamespace { + if !consts.IsGlobalVirtualResourceNamespace() { q = manager.FilterByOwner(q, model.GetOwnerProjectId()) } q = manager.FilterByNotId(q, model.GetId()) diff --git a/pkg/cloudcommon/db/quotas/handler.go b/pkg/cloudcommon/db/quotas/handler.go index 80bfeedd21..3544e780a1 100644 --- a/pkg/cloudcommon/db/quotas/handler.go +++ b/pkg/cloudcommon/db/quotas/handler.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient/auth" ) @@ -75,18 +77,18 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request projectId := params[""] if len(projectId) == 0 { projectId = userCred.GetProjectId() - if db.IsGlobalRbacEnabled() { - if !db.PolicyManager.Allow(false, userCred, db.GetGlobalServiceType(), - "quotas", db.PolicyActionGet) { + if consts.IsRbacEnabled() { + if !policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(), + "quotas", policy.PolicyActionGet) { httperrors.ForbiddenError(w, "not allow to get quota") return } } } else { isAllow := false - if db.IsGlobalRbacEnabled() { - isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - db.PolicyDelegation, db.PolicyActionGet) + if consts.IsRbacEnabled() { + isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + policy.PolicyDelegation, policy.PolicyActionGet) } else { isAllow = userCred.IsSystemAdmin() } @@ -94,9 +96,9 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request httperrors.ForbiddenError(w, "not allow to delegate query quota") return } - if db.IsGlobalRbacEnabled() { - if !db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - "quotas", db.PolicyActionGet) { + if consts.IsRbacEnabled() { + if !policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + "quotas", policy.PolicyActionGet) { httperrors.ForbiddenError(w, "not allow to query quota") return } @@ -131,9 +133,9 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request userCred := auth.FetchUserCredential(ctx) var isAllow bool - if db.IsGlobalRbacEnabled() { - isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - "quotas", db.PolicyActionUpdate) + if consts.IsRbacEnabled() { + isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + "quotas", policy.PolicyActionUpdate) } else { isAllow = userCred.IsSystemAdmin() } @@ -194,9 +196,9 @@ func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Reque userCred := auth.FetchUserCredential(ctx) isAllow := false - if db.IsGlobalRbacEnabled() { - isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - db.PolicyDelegation, db.PolicyActionGet) + if consts.IsRbacEnabled() { + isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + policy.PolicyDelegation, policy.PolicyActionGet) } else { isAllow = userCred.IsSystemAdmin() } @@ -204,9 +206,9 @@ func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Reque httperrors.ForbiddenError(w, "not allow to delegate check quota") return } - if db.IsGlobalRbacEnabled() { - if !db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - "quotas", db.PolicyActionGet) { + if consts.IsRbacEnabled() { + if !policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + "quotas", policy.PolicyActionGet) { httperrors.ForbiddenError(w, "not allow to query quota") return } diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index a6994279c2..f3b91e3617 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -1,6 +1,8 @@ package db import ( + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -25,11 +27,11 @@ func isRbacAllowed(manager IModelManager, model IModel, userCred mcclient.TokenC } } if !isAdmin { - isAllow = PolicyManager.Allow(false, userCred, GetGlobalServiceType(), + isAllow = policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(), manager.KeywordPlural(), action, extra...) } if !isAllow { - isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(), + isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), manager.KeywordPlural(), action, extra...) } return isAllow @@ -44,11 +46,11 @@ func isJointRbacAllowed(manager IJointModelManager, item IJointModel, userCred m isAdmin = false } if !isAdmin { - isAllow = PolicyManager.Allow(false, userCred, GetGlobalServiceType(), + isAllow = policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(), manager.KeywordPlural(), action, extra...) } if !isAllow { - isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(), + isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), manager.KeywordPlural(), action, extra...) } return isAllow diff --git a/pkg/cloudcommon/db/tenantcache.go b/pkg/cloudcommon/db/tenantcache.go index 3bb9bfb0c2..f2a7aa6068 100644 --- a/pkg/cloudcommon/db/tenantcache.go +++ b/pkg/cloudcommon/db/tenantcache.go @@ -8,6 +8,7 @@ import ( "yunion.io/x/onecloud/pkg/mcclient/auth" "yunion.io/x/onecloud/pkg/mcclient/modules" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" ) @@ -77,7 +78,7 @@ func (manager *STenantCacheManager) FetchTenantByName(ctx context.Context, idStr } func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context, idStr string) (*STenant, error) { - s := auth.GetAdminSession(GetGlobalRegion(), "v1") + s := auth.GetAdminSession(consts.GetRegion(), "v1") tenant, err := modules.Projects.Get(s, idStr, nil) if err != nil { log.Errorf("fetch project fail %s", err) diff --git a/pkg/cloudcommon/options.go b/pkg/cloudcommon/options.go index a28253eb80..cc2d9d5f46 100644 --- a/pkg/cloudcommon/options.go +++ b/pkg/cloudcommon/options.go @@ -6,6 +6,7 @@ import ( "path" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/pkg/util/version" "yunion.io/x/pkg/utils" "yunion.io/x/structarg" @@ -114,4 +115,6 @@ func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, con } log.V(10).Debugf("Parsed options: %#v", optStruct) + + consts.SetRegion(optionsRef.Region) } diff --git a/pkg/cloudcommon/policy/global.go b/pkg/cloudcommon/policy/global.go new file mode 100644 index 0000000000..2604c16b4f --- /dev/null +++ b/pkg/cloudcommon/policy/global.go @@ -0,0 +1,11 @@ +package policy + +import ( + "time" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" +) + +func EnableGlobalRbac(refreshInterval time.Duration, retryInterval time.Duration) { + consts.EnableRbac() + PolicyManager.start(refreshInterval, retryInterval) +} diff --git a/pkg/cloudcommon/db/policy.go b/pkg/cloudcommon/policy/policy.go similarity index 97% rename from pkg/cloudcommon/db/policy.go rename to pkg/cloudcommon/policy/policy.go index 84bd91c678..0ad2aacb44 100644 --- a/pkg/cloudcommon/db/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -1,10 +1,11 @@ -package db +package policy import ( "yunion.io/x/jsonutils" "yunion.io/x/log" "time" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -69,7 +70,7 @@ func parseJsonPolicy(obj jsonutils.JSONObject) (string, rbacutils.SRbacPolicy, e } func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRbacPolicy, error) { - s := auth.GetAdminSession(GetGlobalRegion(), "v1") + s := auth.GetAdminSession(consts.GetRegion(), "v1") policies := make(map[string]rbacutils.SRbacPolicy) adminPolicies := make(map[string]rbacutils.SRbacPolicy) @@ -157,7 +158,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, return false, httperrors.NewInputParameterError("invalid format") } isAdmin, _ := policySeq[0].Bool() - if !IsGlobalRbacEnabled() { + if !consts.IsRbacEnabled() { if !isAdmin || (isAdmin && userCred.IsSystemAdmin()) { return true, nil } else { diff --git a/pkg/compute/service/service.go b/pkg/compute/service/service.go index e5de80bc75..0f0bcf950f 100644 --- a/pkg/compute/service/service.go +++ b/pkg/compute/service/service.go @@ -16,6 +16,7 @@ import ( _ "yunion.io/x/onecloud/pkg/util/esxi/provider" "yunion.io/x/onecloud/pkg/cloudcommon" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/cronman" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/compute" @@ -24,7 +25,7 @@ import ( ) func StartService() { - db.SetGlobalServiceType("compute") + consts.SetServiceType("compute") cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "region.conf") diff --git a/pkg/compute/usages/handler.go b/pkg/compute/usages/handler.go index 71899df1ea..a27525d627 100644 --- a/pkg/compute/usages/handler.go +++ b/pkg/compute/usages/handler.go @@ -13,7 +13,9 @@ import ( "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -246,9 +248,9 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo isAdmin := false - if db.IsGlobalRbacEnabled() { - if db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(), - "usages", db.PolicyActionGet) { + if consts.IsRbacEnabled() { + if policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), + "usages", policy.PolicyActionGet) { isAdmin = true } } else { @@ -262,9 +264,9 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo } } - if db.IsGlobalRbacEnabled() { - if !db.PolicyManager.Allow(false, userCred, db.GetGlobalServiceType(), - "usages", db.PolicyActionGet) { + if consts.IsRbacEnabled() { + if !policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(), + "usages", policy.PolicyActionGet) { err = httperrors.NewForbiddenError("not allow to get usages") return } diff --git a/pkg/scheduler/manager/task_queue.go b/pkg/scheduler/manager/task_queue.go index 0fffd0268d..0a413c8703 100644 --- a/pkg/scheduler/manager/task_queue.go +++ b/pkg/scheduler/manager/task_queue.go @@ -200,8 +200,8 @@ type TaskManager struct { func NewTaskManager(stopCh <-chan struct{}) *TaskManager { return &TaskManager{ taskExecutorQueueManager: NewTaskExecutorQueueManager(stopCh), - stopCh: stopCh, - lock: sync.Mutex{}, + stopCh: stopCh, + lock: sync.Mutex{}, } }