From d53802e0bcf61654e32e297bf228874cd3255ebf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Thu, 14 Nov 2024 14:42:40 +0800 Subject: [PATCH] fix(region): allow disable default policy (#21587) --- pkg/apigateway/service/policy.go | 21 +++++++++++++++------ pkg/apigateway/service/service.go | 1 + pkg/apis/identity/consts.go | 1 + pkg/cloudcommon/consts/db.go | 10 ++++++++++ pkg/cloudcommon/options/options.go | 8 +++++--- pkg/cloudid/policy/defaults.go | 7 +++++-- pkg/cloudid/service/service.go | 3 ++- pkg/compute/policy/defaults.go | 7 +++++-- pkg/compute/service/service.go | 3 ++- pkg/image/policy/defaults.go | 7 +++++-- pkg/image/service/service.go | 3 ++- pkg/keystone/policy/defaults.go | 7 +++++-- pkg/keystone/service/service.go | 3 ++- pkg/logger/policy/defaults.go | 7 +++++-- pkg/logger/service/service.go | 3 ++- pkg/notify/policy/defaults.go | 7 +++++-- pkg/notify/service/service.go | 3 ++- pkg/yunionconf/policy/defaults.go | 7 +++++-- pkg/yunionconf/service/service.go | 3 ++- 19 files changed, 81 insertions(+), 30 deletions(-) diff --git a/pkg/apigateway/service/policy.go b/pkg/apigateway/service/policy.go index 8d780611e6..da9c48814b 100644 --- a/pkg/apigateway/service/policy.go +++ b/pkg/apigateway/service/policy.go @@ -16,10 +16,19 @@ package service import ( _ "yunion.io/x/onecloud/pkg/cloudevent/policy" - _ "yunion.io/x/onecloud/pkg/compute/policy" - _ "yunion.io/x/onecloud/pkg/image/policy" - _ "yunion.io/x/onecloud/pkg/keystone/policy" - _ "yunion.io/x/onecloud/pkg/logger/policy" - _ "yunion.io/x/onecloud/pkg/notify/policy" - _ "yunion.io/x/onecloud/pkg/yunionconf/policy" + compute "yunion.io/x/onecloud/pkg/compute/policy" + image "yunion.io/x/onecloud/pkg/image/policy" + keystone "yunion.io/x/onecloud/pkg/keystone/policy" + logger "yunion.io/x/onecloud/pkg/logger/policy" + notify "yunion.io/x/onecloud/pkg/notify/policy" + yunionconf "yunion.io/x/onecloud/pkg/yunionconf/policy" ) + +func InitDefaultPolicy() { + compute.Init() + image.Init() + keystone.Init() + logger.Init() + notify.Init() + yunionconf.Init() +} diff --git a/pkg/apigateway/service/service.go b/pkg/apigateway/service/service.go index 8b374d164a..5ae3a7ec6e 100644 --- a/pkg/apigateway/service/service.go +++ b/pkg/apigateway/service/service.go @@ -39,6 +39,7 @@ func StartService() { baseOpts := &opts.BaseOptions commonOpts := &opts.CommonOptions common_options.ParseOptions(opts, os.Args, "apigateway.conf", api.SERVICE_TYPE) + InitDefaultPolicy() app_common.InitAuth(commonOpts, func() { log.Infof("Auth complete.") }) diff --git a/pkg/apis/identity/consts.go b/pkg/apis/identity/consts.go index 0c67ccdac7..a302c673f1 100644 --- a/pkg/apis/identity/consts.go +++ b/pkg/apis/identity/consts.go @@ -236,6 +236,7 @@ var ( // kubeserver blacklist options // ############################ "running_mode", + "enable_default_policy", }, } ) diff --git a/pkg/cloudcommon/consts/db.go b/pkg/cloudcommon/consts/db.go index 79d302bfbf..1c6a58500e 100644 --- a/pkg/cloudcommon/consts/db.go +++ b/pkg/cloudcommon/consts/db.go @@ -28,8 +28,18 @@ var ( defaultDBChecksumHashAlgorithm string enableChangeOwnerAutoRename = false + + enableDefaultPolicy = true ) +func SetDefaultPolicy(enable bool) { + enableDefaultPolicy = enable +} + +func IsEnableDefaultPolicy() bool { + return enableDefaultPolicy == true +} + func SetDefaultDB(dialect, connStr string) { defaultDBDialect = dialect defaultDBConnectionString = connStr diff --git a/pkg/cloudcommon/options/options.go b/pkg/cloudcommon/options/options.go index c349b97983..f65b8863c0 100644 --- a/pkg/cloudcommon/options/options.go +++ b/pkg/cloudcommon/options/options.go @@ -19,7 +19,7 @@ import ( "crypto/x509" "encoding/pem" "fmt" - "io/ioutil" + "io" "net/http" "net/url" "os" @@ -121,6 +121,7 @@ type BaseOptions struct { EnableAppProfiling bool `help:"enable profiling API" default:"false"` EnableChangeOwnerAutoRename bool `help:"Allows renaming when changing names" default:"false"` + EnableDefaultPolicy bool `help:"Enable defualt policies" default:"true"` } const ( @@ -218,7 +219,7 @@ func (opt *EtcdOptions) GetEtcdTLSConfig() (*tls.Config, error) { opt.EtcdUseTLS = true } if opt.EtcdCacert != "" { - data, err := ioutil.ReadFile(opt.EtcdCacert) + data, err := os.ReadFile(opt.EtcdCacert) if err != nil { return nil, errors.Wrap(err, "read cacert file") } @@ -375,7 +376,7 @@ func parseOptions(optStruct interface{}, args []string, configFileName string, s h.Init() log.DisableColors() log.Logger().AddHook(h) - log.Logger().Out = ioutil.Discard + log.Logger().Out = io.Discard atexit.Register(atexit.ExitHandler{ Prio: atexit.PRIO_LOG_CLOSE, Reason: "deinit log rotate hook", @@ -391,6 +392,7 @@ func parseOptions(optStruct interface{}, args []string, configFileName string, s consts.SetRegion(optionsRef.Region) } + consts.SetDefaultPolicy(optionsRef.EnableDefaultPolicy) consts.SetDomainizedNamespace(optionsRef.DomainizedNamespace) } diff --git a/pkg/cloudid/policy/defaults.go b/pkg/cloudid/policy/defaults.go index a0ca1a7633..b2bc3ea3ed 100644 --- a/pkg/cloudid/policy/defaults.go +++ b/pkg/cloudid/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/cloudid" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -108,6 +109,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/cloudid/service/service.go b/pkg/cloudid/service/service.go index e1ad110a00..c83f214615 100644 --- a/pkg/cloudid/service/service.go +++ b/pkg/cloudid/service/service.go @@ -35,7 +35,7 @@ import ( _ "yunion.io/x/onecloud/pkg/cloudid/drivers" "yunion.io/x/onecloud/pkg/cloudid/models" "yunion.io/x/onecloud/pkg/cloudid/options" - _ "yunion.io/x/onecloud/pkg/cloudid/policy" + "yunion.io/x/onecloud/pkg/cloudid/policy" "yunion.io/x/onecloud/pkg/cloudid/saml" _ "yunion.io/x/onecloud/pkg/cloudid/tasks" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -47,6 +47,7 @@ func StartService() { baseOpts := &opts.BaseOptions commonOpts := &opts.CommonOptions common_options.ParseOptions(opts, os.Args, "cloudid.conf", api.SERVICE_TYPE) + policy.Init() app_common.InitAuth(commonOpts, func() { log.Infof("Auth complete!!") diff --git a/pkg/compute/policy/defaults.go b/pkg/compute/policy/defaults.go index cb2b89860a..24e2f2316b 100644 --- a/pkg/compute/policy/defaults.go +++ b/pkg/compute/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -416,6 +417,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/compute/service/service.go b/pkg/compute/service/service.go index d62d76c488..098436f943 100644 --- a/pkg/compute/service/service.go +++ b/pkg/compute/service/service.go @@ -44,7 +44,7 @@ import ( _ "yunion.io/x/onecloud/pkg/compute/hostdrivers" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/compute/options" - _ "yunion.io/x/onecloud/pkg/compute/policy" + "yunion.io/x/onecloud/pkg/compute/policy" _ "yunion.io/x/onecloud/pkg/compute/regiondrivers" _ "yunion.io/x/onecloud/pkg/compute/storagedrivers" "yunion.io/x/onecloud/pkg/compute/tasks" @@ -63,6 +63,7 @@ func StartServiceWithJobs(jobs func(cron *cronman.SCronJobManager)) { baseOpts := &options.Options.BaseOptions dbOpts := &options.Options.DBOptions common_options.ParseOptions(opts, os.Args, "region.conf", api.SERVICE_TYPE) + policy.Init() if opts.PortV2 > 0 { log.Infof("Port V2 %d is specified, use v2 port", opts.PortV2) diff --git a/pkg/image/policy/defaults.go b/pkg/image/policy/defaults.go index c6a5559b32..39a295dafd 100644 --- a/pkg/image/policy/defaults.go +++ b/pkg/image/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/image" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -90,6 +91,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/image/service/service.go b/pkg/image/service/service.go index b57511ef94..be7f91f285 100644 --- a/pkg/image/service/service.go +++ b/pkg/image/service/service.go @@ -40,7 +40,7 @@ import ( "yunion.io/x/onecloud/pkg/image/drivers/s3" "yunion.io/x/onecloud/pkg/image/models" "yunion.io/x/onecloud/pkg/image/options" - _ "yunion.io/x/onecloud/pkg/image/policy" + "yunion.io/x/onecloud/pkg/image/policy" _ "yunion.io/x/onecloud/pkg/image/tasks" "yunion.io/x/onecloud/pkg/image/torrent" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -55,6 +55,7 @@ func StartService() { baseOpts := &opts.BaseOptions dbOpts := &opts.DBOptions common_options.ParseOptions(opts, os.Args, "glance-api.conf", api.SERVICE_TYPE) + policy.Init() // no need to run glance as root any more // isRoot := sysutils.IsRootPermission() diff --git a/pkg/keystone/policy/defaults.go b/pkg/keystone/policy/defaults.go index f9c478931f..26f7d35bdf 100644 --- a/pkg/keystone/policy/defaults.go +++ b/pkg/keystone/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/identity" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -191,6 +192,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/keystone/service/service.go b/pkg/keystone/service/service.go index e15e7b5629..cea7eb2ce3 100644 --- a/pkg/keystone/service/service.go +++ b/pkg/keystone/service/service.go @@ -35,7 +35,7 @@ import ( "yunion.io/x/onecloud/pkg/keystone/cronjobs" "yunion.io/x/onecloud/pkg/keystone/models" "yunion.io/x/onecloud/pkg/keystone/options" - _ "yunion.io/x/onecloud/pkg/keystone/policy" + kpolicy "yunion.io/x/onecloud/pkg/keystone/policy" "yunion.io/x/onecloud/pkg/keystone/saml" _ "yunion.io/x/onecloud/pkg/keystone/tasks" "yunion.io/x/onecloud/pkg/keystone/tokens" @@ -63,6 +63,7 @@ func StartService() { opts := &options.Options common_options.ParseOptions(opts, os.Args, "keystone.conf", api.SERVICE_TYPE) + kpolicy.Init() if opts.Port == 0 { opts.Port = 5000 // keystone well-known port diff --git a/pkg/logger/policy/defaults.go b/pkg/logger/policy/defaults.go index 1545ca9fd6..074ec40819 100644 --- a/pkg/logger/policy/defaults.go +++ b/pkg/logger/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/logger" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -57,6 +58,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/logger/service/service.go b/pkg/logger/service/service.go index 31bd159924..44d2998926 100644 --- a/pkg/logger/service/service.go +++ b/pkg/logger/service/service.go @@ -30,7 +30,7 @@ import ( "yunion.io/x/onecloud/pkg/logger/extern" "yunion.io/x/onecloud/pkg/logger/models" "yunion.io/x/onecloud/pkg/logger/options" - _ "yunion.io/x/onecloud/pkg/logger/policy" + "yunion.io/x/onecloud/pkg/logger/policy" ) func StartService() { @@ -42,6 +42,7 @@ func StartService() { commonOpts := &opts.CommonOptions dbOpts := &opts.DBOptions common_options.ParseOptions(opts, os.Args, "log.conf", api.SERVICE_TYPE) + policy.Init() app_common.InitAuth(commonOpts, func() { log.Infof("Auth complete!!") diff --git a/pkg/notify/policy/defaults.go b/pkg/notify/policy/defaults.go index 509b2efba7..c3f405f3ea 100644 --- a/pkg/notify/policy/defaults.go +++ b/pkg/notify/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/notify" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -180,6 +181,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/notify/service/service.go b/pkg/notify/service/service.go index dad2b0fd1d..1f47f0ad67 100644 --- a/pkg/notify/service/service.go +++ b/pkg/notify/service/service.go @@ -30,7 +30,7 @@ import ( common_options "yunion.io/x/onecloud/pkg/cloudcommon/options" "yunion.io/x/onecloud/pkg/notify/models" "yunion.io/x/onecloud/pkg/notify/options" - _ "yunion.io/x/onecloud/pkg/notify/policy" + "yunion.io/x/onecloud/pkg/notify/policy" _ "yunion.io/x/onecloud/pkg/notify/sender/smsdriver" _ "yunion.io/x/onecloud/pkg/notify/tasks" ) @@ -42,6 +42,7 @@ func StartService() { dbOpts := &options.Options.DBOptions baseOpts := &options.Options.BaseOptions common_options.ParseOptions(opts, os.Args, "notify.conf", api.SERVICE_TYPE) + policy.Init() // init auth app.InitAuth(commonOpts, func() { diff --git a/pkg/yunionconf/policy/defaults.go b/pkg/yunionconf/policy/defaults.go index fd0d2caeb6..01d3018deb 100644 --- a/pkg/yunionconf/policy/defaults.go +++ b/pkg/yunionconf/policy/defaults.go @@ -18,6 +18,7 @@ import ( "yunion.io/x/pkg/util/rbacscope" api "yunion.io/x/onecloud/pkg/apis/yunionconf" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" common_policy "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/util/rbacutils" ) @@ -95,6 +96,8 @@ var ( } ) -func init() { - common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) +func Init() { + if consts.IsEnableDefaultPolicy() { + common_policy.AppendDefaultPolicies(predefinedDefaultPolicies) + } } diff --git a/pkg/yunionconf/service/service.go b/pkg/yunionconf/service/service.go index 7a26502d61..6f58b31af7 100644 --- a/pkg/yunionconf/service/service.go +++ b/pkg/yunionconf/service/service.go @@ -32,7 +32,7 @@ import ( "yunion.io/x/onecloud/pkg/mcclient/auth" "yunion.io/x/onecloud/pkg/yunionconf/models" "yunion.io/x/onecloud/pkg/yunionconf/options" - _ "yunion.io/x/onecloud/pkg/yunionconf/policy" + "yunion.io/x/onecloud/pkg/yunionconf/policy" ) func StartService() { @@ -42,6 +42,7 @@ func StartService() { commonOpts := &options.Options.CommonOptions dbOpts := &options.Options.DBOptions common_options.ParseOptions(opts, os.Args, "yunionconf.conf", api.SERVICE_TYPE) + policy.Init() app_common.InitAuth(commonOpts, func() { log.Infof("Auth complete!!") })