mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 05:27:24 +08:00
Tiago Silva
7dde7c2811
This PR introduces a mechanism to control access to Pods in Kubernetes clusters based on access criteria defined in user Roles or Resource Access Requests.
New `Role` version - `v6` - introduced a new field `kubernetes_resources` that allows admins to restrict access to a subset of cluster resources based on the configuration provided.
This PR implements the resource control for `pods` and allows
```yaml
kubernetes_resources:
- kind: pod
name: nginx-*
namespace: default
- kind: pod
name: *
namespace: dev
```
It also implements the logic blocks for supporting Resource Access Requests to Kubernetes Pods. The tsh boilerplate is not included in this PR and will be included in future PRs.
An example of usage:
```
tsh request search --kind pod --kube-cluster=minikube
Name Namespace Labels Resource ID
--------------------------------- --------- -------------------------------------- ---------------------------------------------
nginx-deployment-6595874d85-6j2zm default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-7xgmb default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-c4kz8 default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
test default run=test /tele.teleport.local/pod/minikube/default/...
To request access to these resources, run
> tsh request create --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-6j2zm --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-7xgmb --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-c4kz8 --resource /tele.teleport.local/pod/minikube/default/test \
--reason <request reason>
```
Part of #18434
66 lines
2.2 KiB
Go
66 lines
2.2 KiB
Go
/*
|
|
Copyright 2022 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package proxy
|
|
|
|
import (
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
"k8s.io/apimachinery/pkg/runtime/serializer"
|
|
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
|
"k8s.io/client-go/kubernetes/scheme"
|
|
)
|
|
|
|
var (
|
|
// kubeScheme is the runtime Scheme that holds information about supported
|
|
// message types.
|
|
kubeScheme = runtime.NewScheme()
|
|
// kubeCodecs creates a serializer/deserizalier for the different codecs
|
|
// supported by the Kubernetes API.
|
|
kubeCodecs = serializer.NewCodecFactory(kubeScheme)
|
|
)
|
|
|
|
// Register all groups in the schema's registry.
|
|
// It manually registers support for `metav1.Table` because go-client does not
|
|
// support it but `kubectl` calls require support for it.
|
|
func init() {
|
|
// Register external types for Scheme
|
|
metav1.AddToGroupVersion(kubeScheme, schema.GroupVersion{Version: "v1"})
|
|
utilruntime.Must(metav1.AddMetaToScheme(kubeScheme))
|
|
utilruntime.Must(metav1beta1.AddMetaToScheme(kubeScheme))
|
|
utilruntime.Must(scheme.AddToScheme(kubeScheme))
|
|
utilruntime.Must(kubeScheme.SetVersionPriority(corev1.SchemeGroupVersion))
|
|
}
|
|
|
|
// newClientNegotiator creates a negotiator that based on `Content-Type` header
|
|
// from the Kubernetes API response is able to create a different encoder/decoder.
|
|
// Supported content types:
|
|
// - "application/json"
|
|
// - "application/yaml"
|
|
// - "application/vnd.kubernetes.protobuf"
|
|
func newClientNegotiator() runtime.ClientNegotiator {
|
|
return runtime.NewClientNegotiator(
|
|
kubeCodecs.WithoutConversion(),
|
|
schema.GroupVersion{
|
|
// create a serializer for Kube API v1
|
|
Version: "v1",
|
|
},
|
|
)
|
|
}
|