增加 usages get 和 quotas get/update 的RBAC检查

pkg/cloudcommon/auth.go

@@ -6,6 +6,7 @@ import (
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
+	"time"
 )
 
 func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
@@ -46,6 +47,7 @@ func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
 	}
 
 	if options.EnableRbac {
-		db.EnableGlobalRbac()
+		db.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second,
+			time.Duration(options.RbacPolicySyncFailedRetrySeconds)*time.Second)
 	}
 }

pkg/cloudcommon/db/global.go

@@ -1,5 +1,7 @@
 package db
 
+import "time"
+
 /// Global virtual resource namespace
 
 var (
@@ -32,9 +34,9 @@ func GetGlobalServiceType() string {
 	return globalServiceType
 }
 
-func EnableGlobalRbac() {
+func EnableGlobalRbac(refreshInterval time.Duration, retryInterval time.Duration) {
 	globalsRbacEnabled = true
-	PolicyManager.start()
+	PolicyManager.start(refreshInterval, retryInterval)
 }
 
 func IsGlobalRbacEnabled() bool {

pkg/cloudcommon/db/policy.go

@@ -12,9 +12,6 @@ import (
 )
 
 const (
-	PolicyFailedRetryInterval = 15 * time.Second
-	PolicyRefreshInterval     = 15 * time.Minute
-
 	PolicyDelegation = "delegate"
 
 	PolicyActionList    = "list"
@@ -26,7 +23,12 @@ const (
 	PolicyActionPerform = "perform"
 )
 
-var PolicyManager *SPolicyManager
+var (
+	PolicyManager *SPolicyManager
+
+	PolicyFailedRetryInterval = 15 * time.Second
+	PolicyRefreshInterval     = 15 * time.Minute
+)
 
 func init() {
 	PolicyManager = &SPolicyManager{}
@@ -106,8 +108,10 @@ func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRb
 	return policies, adminPolicies, nil
 }
 
-func (manager *SPolicyManager) start() {
+func (manager *SPolicyManager) start(refreshInterval time.Duration, retryInterval time.Duration) {
 	log.Infof("PolicyManager start to fetch policies ...")
+	PolicyRefreshInterval = refreshInterval
+	PolicyFailedRetryInterval = retryInterval
 	manager.sync()
 }
 

pkg/cloudcommon/db/quotas/handler.go

@@ -75,11 +75,33 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 	projectId := params["<tenantid>"]
 	if len(projectId) == 0 {
 		projectId = userCred.GetProjectId()
+		if db.IsGlobalRbacEnabled() {
+			if ! db.PolicyManager.Allow(false, userCred, db.GetGlobalServiceType(),
+				"quotas", db.PolicyActionGet) {
+				httperrors.ForbiddenError(w, "not allow to get quota")
+				return
+			}
+		}
 	} else {
-		if !userCred.IsSystemAdmin() {
+		isAllow := false
+		if db.IsGlobalRbacEnabled() {
+			isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
+				db.PolicyDelegation, db.PolicyActionGet)
+		} else {
+			isAllow = userCred.IsSystemAdmin()
+		}
+		if ! isAllow {
 			httperrors.ForbiddenError(w, "not allow to delegate query quota")
 			return
 		}
+		if db.IsGlobalRbacEnabled() {
+			if ! db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
+				"quotas", db.PolicyActionGet) {
+				httperrors.ForbiddenError(w, "not allow to query quota")
+				return
+			}
+		}
+
 		tenant, err := db.TenantCacheManager.FetchTenantByIdOrName(ctx, projectId)
 		if err != nil {
 			if err == sql.ErrNoRows {

pkg/cloudcommon/options.go

@@ -40,7 +40,9 @@ type Options struct {
 	SslCertfile string `help:"ssl certification file"`
 	SslKeyfile  string `help:"ssl certification key file"`
 
-	EnableRbac bool `help:"Switch on Role-based Access Control" default:"false"`
+	EnableRbac                       bool `help:"Switch on Role-based Access Control" default:"false"`
+	RbacPolicySyncPeriodSeconds      int  `help:"policy sync interval in seconds, default 15 minutes" default:"900"`
+	RbacPolicySyncFailedRetrySeconds int  `help:"seconds to wait after a failed sync, default 30 seconds" default:"30"`
 
 	structarg.BaseOptions
 }

pkg/compute/usages/handler.go

@@ -243,12 +243,33 @@ func getCommonGeneralUsage(cred mcclient.TokenCredential, rangeObj db.IStandalon
 
 func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel, hostTypes []string) (count Usage, err error) {
 	count = make(map[string]interface{})
-	if userCred.IsSystemAdmin() {
+
+	isAdmin := false
+
+	if db.IsGlobalRbacEnabled() {
+		if db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
+			"usages", db.PolicyActionGet) {
+			isAdmin = true
+		}
+	} else {
+		isAdmin = userCred.IsSystemAdmin()
+	}
+
+	if isAdmin {
 		count, err = getAdminGeneralUsage(userCred, rangeObj, hostTypes)
 		if err != nil {
 			return
 		}
 	}
+
+	if db.IsGlobalRbacEnabled() {
+		if ! db.PolicyManager.Allow(false, userCred, db.GetGlobalServiceType(),
+			"usages", db.PolicyActionGet) {
+			err = httperrors.NewForbiddenError("not allow to get usages")
+			return
+		}
+	}
+
 	commonUsage, err := getCommonGeneralUsage(userCred, rangeObj, hostTypes)
 	if err != nil {
 		return