-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
support reading configuration from Kubernetes Secrets
The `kubernetes` extension automatically generates a RoleBinding that refers to the `view` ClusterRole. This ClusterRole doesn't allow access to secrets. This commit therefore adds a configuration property which, when enabled, makes the `kubernetes` extension generate a special Role `view-secrets` and a second RoleBinding referring to that role. This configuration property is build-time only and has no other effect. With this configuration in place, there's nothing preventing the application from reading Secrets directly from the API server. For convenience, a warning is printed at runtime if configuration is read from Secrets yet the property is disabled.
- Loading branch information
Showing
17 changed files
with
374 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
...e/src/main/java/io/quarkus/kubernetes/client/runtime/KubernetesConfigBuildTimeConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package io.quarkus.kubernetes.client.runtime; | ||
|
|
||
| import io.quarkus.runtime.annotations.ConfigItem; | ||
| import io.quarkus.runtime.annotations.ConfigPhase; | ||
| import io.quarkus.runtime.annotations.ConfigRoot; | ||
|
|
||
| @ConfigRoot(name = "kubernetes-config", phase = ConfigPhase.BUILD_TIME) | ||
| public class KubernetesConfigBuildTimeConfig { | ||
| /** | ||
| * Whether or not configuration can be read from secrets. | ||
| * If set to {@code true}, Kubernetes resources allowing access to secrets (role and role binding) will be generated. | ||
| */ | ||
| @ConfigItem(name = "secrets.enabled", defaultValue = "false") | ||
| public boolean secretsEnabled; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
49 changes: 49 additions & 0 deletions
49
...ubernetes/spi/src/main/java/io/quarkus/kubernetes/spi/KubernetesRoleBindingBuildItem.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| package io.quarkus.kubernetes.spi; | ||
|
|
||
| import io.quarkus.builder.item.MultiBuildItem; | ||
|
|
||
| /** | ||
| * Produce this build item to request the Kubernetes extension to generate | ||
| * a Kubernetes {@code RoleBinding} resource. The configuration here is limited; | ||
| * in particular, you can't specify subjects of the role binding. The role will always | ||
| * be bound to the application's service account. | ||
| * <p> | ||
| * Note that this can't be used to generate a {@code ClusterRoleBinding}. | ||
| */ | ||
| public final class KubernetesRoleBindingBuildItem extends MultiBuildItem { | ||
| /** | ||
| * Name of the generated {@code RoleBinding} resource. | ||
| * Can be {@code null}, in which case the resource name is autogenerated. | ||
| */ | ||
| private final String name; | ||
| /** | ||
| * Name of the bound role. | ||
| */ | ||
| private final String role; | ||
| /** | ||
| * If {@code true}, the binding refers to a {@code ClusterRole}, otherwise to a namespaced {@code Role}. | ||
| */ | ||
| private final boolean clusterWide; | ||
|
|
||
| public KubernetesRoleBindingBuildItem(String role, boolean clusterWide) { | ||
| this(null, role, clusterWide); | ||
| } | ||
|
|
||
| public KubernetesRoleBindingBuildItem(String name, String role, boolean clusterWide) { | ||
| this.name = name; | ||
| this.role = role; | ||
| this.clusterWide = clusterWide; | ||
| } | ||
|
|
||
| public String getName() { | ||
| return this.name; | ||
| } | ||
|
|
||
| public String getRole() { | ||
| return this.role; | ||
| } | ||
|
|
||
| public boolean isClusterWide() { | ||
| return clusterWide; | ||
| } | ||
| } |
73 changes: 68 additions & 5 deletions
73
...sions/kubernetes/spi/src/main/java/io/quarkus/kubernetes/spi/KubernetesRoleBuildItem.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,79 @@ | ||
| package io.quarkus.kubernetes.spi; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import io.quarkus.builder.item.MultiBuildItem; | ||
|
|
||
| /** | ||
| * Produce this build item to request the Kubernetes extension to generate | ||
| * a Kubernetes {@code Role} resource. | ||
| * <p> | ||
| * Note that this can't be used to generate a {@code ClusterRole}. | ||
| */ | ||
| public final class KubernetesRoleBuildItem extends MultiBuildItem { | ||
| /** | ||
| * Name of the generated {@code Role} resource. | ||
| */ | ||
| private final String name; | ||
| /** | ||
| * The {@code PolicyRule} resources for this {@code Role}. | ||
| */ | ||
| private final List<PolicyRule> rules; | ||
|
|
||
| public KubernetesRoleBuildItem(String name, List<PolicyRule> rules) { | ||
| this.name = name; | ||
| this.rules = rules; | ||
| } | ||
|
|
||
| private final String role; | ||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| public KubernetesRoleBuildItem(String role) { | ||
| this.role = role; | ||
| public List<PolicyRule> getRules() { | ||
| return rules; | ||
| } | ||
|
|
||
| public String getRole() { | ||
| return this.role; | ||
| /** | ||
| * Corresponds directly to the Kubernetes {@code PolicyRule} resource. | ||
| */ | ||
| public static final class PolicyRule { | ||
| private final List<String> apiGroups; | ||
| private final List<String> nonResourceURLs; | ||
| private final List<String> resourceNames; | ||
| private final List<String> resources; | ||
| private final List<String> verbs; | ||
|
|
||
| public PolicyRule(List<String> apiGroups, List<String> resources, List<String> verbs) { | ||
| this(apiGroups, null, null, resources, verbs); | ||
| } | ||
|
|
||
| public PolicyRule(List<String> apiGroups, List<String> nonResourceURLs, List<String> resourceNames, | ||
| List<String> resources, List<String> verbs) { | ||
| this.apiGroups = apiGroups; | ||
| this.nonResourceURLs = nonResourceURLs; | ||
| this.resourceNames = resourceNames; | ||
| this.resources = resources; | ||
| this.verbs = verbs; | ||
| } | ||
|
|
||
| public List<String> getApiGroups() { | ||
| return apiGroups; | ||
| } | ||
|
|
||
| public List<String> getNonResourceURLs() { | ||
| return nonResourceURLs; | ||
| } | ||
|
|
||
| public List<String> getResourceNames() { | ||
| return resourceNames; | ||
| } | ||
|
|
||
| public List<String> getResources() { | ||
| return resources; | ||
| } | ||
|
|
||
| public List<String> getVerbs() { | ||
| return verbs; | ||
| } | ||
| } | ||
| } |
43 changes: 43 additions & 0 deletions
43
...a/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package io.quarkus.kubernetes.deployment; | ||
|
|
||
| import java.util.stream.Collectors; | ||
|
|
||
| import io.dekorate.deps.kubernetes.api.model.KubernetesListBuilder; | ||
| import io.dekorate.deps.kubernetes.api.model.ObjectMeta; | ||
| import io.dekorate.deps.kubernetes.api.model.rbac.PolicyRuleBuilder; | ||
| import io.dekorate.deps.kubernetes.api.model.rbac.RoleBuilder; | ||
| import io.dekorate.kubernetes.decorator.ResourceProvidingDecorator; | ||
| import io.quarkus.kubernetes.spi.KubernetesRoleBuildItem; | ||
|
|
||
| class AddRoleResourceDecorator extends ResourceProvidingDecorator<KubernetesListBuilder> { | ||
| private final KubernetesRoleBuildItem spec; | ||
|
|
||
| public AddRoleResourceDecorator(KubernetesRoleBuildItem buildItem) { | ||
| this.spec = buildItem; | ||
| } | ||
|
|
||
| public void visit(KubernetesListBuilder list) { | ||
| ObjectMeta meta = getMandatoryDeploymentMetadata(list); | ||
|
|
||
| if (contains(list, "rbac.authorization.k8s.io/v1", "Role", spec.getName())) { | ||
| return; | ||
| } | ||
|
|
||
| list.addToItems(new RoleBuilder() | ||
| .withNewMetadata() | ||
| .withName(spec.getName()) | ||
| .withLabels(meta.getLabels()) | ||
| .endMetadata() | ||
| .withRules( | ||
| spec.getRules() | ||
| .stream() | ||
| .map(it -> new PolicyRuleBuilder() | ||
| .withApiGroups(it.getApiGroups()) | ||
| .withNonResourceURLs(it.getNonResourceURLs()) | ||
| .withResourceNames(it.getResourceNames()) | ||
| .withResources(it.getResources()) | ||
| .withVerbs(it.getVerbs()) | ||
| .build()) | ||
| .collect(Collectors.toList()))); | ||
| } | ||
| } |
Oops, something went wrong.