@@ -34,29 +34,103 @@ import (
3434
3535func TestAuthorizationOrder (t * testing.T ) {
3636 framework .Suite (t , "control-plane" )
37- webhookPort := "8081"
38- ctx , cancelFunc := context .WithCancel (context .Background ())
39- t .Cleanup (cancelFunc )
40- // start a webhook that allows kcp to boot up
41- webhookStop := RunWebhook (ctx , t , webhookPort , "kubernetes:authz:allow" )
42- t .Cleanup (webhookStop )
43-
44- server := framework .PrivateKcpServer (t , framework .WithCustomArguments (
45- "--authorization-order" ,
46- "Webhook,AlwaysAllowPaths,AlwaysAllowGroups,RBAC" ,
47- "--authorization-webhook-config-file" ,
48- "authzorder.kubeconfig" ,
49- ))
50-
51- // create clients
37+ t .Parallel ()
38+ t .Run ("Authorization order 1" , func (t * testing.T ) {
39+ webhookPort := "8080"
40+ ctx , cancelFunc := context .WithCancel (context .Background ())
41+ t .Cleanup (cancelFunc )
42+ webhookStop := RunWebhook (ctx , t , webhookPort , "kubernetes:authz:allow" )
43+ t .Cleanup (webhookStop )
44+
45+ server , kcpClusterClient , kubeClusterClient := setupTest (t , "AlwaysAllowGroups,AlwaysAllowPaths,Webhook,RBAC" , "testdata/webhook1.kubeconfig" )
46+
47+ t .Log ("Admin should be allowed to list Workspaces." )
48+ _ , err := kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).TenancyV1alpha1 ().Workspaces ().List (ctx , metav1.ListOptions {})
49+ require .NoError (t , err )
50+
51+ // stop the webhook and switch to a deny policy
52+ webhookStop ()
53+ RunWebhook (ctx , t , webhookPort , "kubernetes:authz:deny" )
54+
55+ t .Log ("Admin should not be allowed to list ConfigMaps." )
56+ _ , err = kubeClusterClient .Cluster (logicalcluster .NewPath ("root" )).CoreV1 ().ConfigMaps ("default" ).List (ctx , metav1.ListOptions {})
57+ require .Error (t , err )
58+ // access to health endpoints should still be granted based on --always-allow-paths,
59+ // even if the webhook rejects the request
60+ t .Log ("Verify that it is allowed to access one of AllowAllPaths endpoints." )
61+ verifyEndpointAccess (ctx , t , server , "/healthz" , true )
62+ })
63+
64+ t .Run ("Authorization order 2" , func (t * testing.T ) {
65+ webhookPort := "8081"
66+ ctx , cancelFunc := context .WithCancel (context .Background ())
67+ t .Cleanup (cancelFunc )
68+ webhookStop := RunWebhook (ctx , t , webhookPort , "kubernetes:authz:allow" )
69+ t .Cleanup (webhookStop )
70+
71+ server , kcpClusterClient , kubeClusterClient := setupTest (t , "Webhook,AlwaysAllowGroups,AlwaysAllowPaths,RBAC" , "testdata/webhook2.kubeconfig" )
72+
73+ t .Log ("Verify that it is allowed to access one of AllowAllPaths endpoints." )
74+ verifyEndpointAccess (ctx , t , server , "/livez" , true )
75+
76+ t .Log ("Admin should be allowed now to list Workspaces." )
77+ _ , err := kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).TenancyV1alpha1 ().Workspaces ().List (ctx , metav1.ListOptions {})
78+ require .NoError (t , err )
79+
80+ // stop the webhook and switch to a deny policy
81+ webhookStop ()
82+ RunWebhook (ctx , t , webhookPort , "kubernetes:authz:deny" )
83+
84+ t .Log ("Admin should not be allowed now to list Logical clusters." )
85+ _ , err = kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).CoreV1alpha1 ().LogicalClusters ().List (ctx , metav1.ListOptions {})
86+ require .Error (t , err )
87+
88+ t .Log ("Admin should not be allowed to list Services." )
89+ _ , err = kubeClusterClient .Cluster (logicalcluster .NewPath ("root" )).CoreV1 ().Services ("default" ).List (ctx , metav1.ListOptions {})
90+ require .Error (t , err )
91+
92+ t .Log ("Verify that it is not allowed to access one of AllowAllPaths endpoints." )
93+ verifyEndpointAccess (ctx , t , server , "/readyz" , false )
94+ })
95+
96+ t .Run ("Default authorization order" , func (t * testing.T ) {
97+ webhookPort := "8082"
98+ ctx , cancelFunc := context .WithCancel (context .Background ())
99+ t .Cleanup (cancelFunc )
100+ webhookStop := RunWebhook (ctx , t , webhookPort , "kubernetes:authz:deny" )
101+ t .Cleanup (webhookStop )
102+ // This will setup the test with the default authorization order: AlwaysAllowGroups,AlwaysAllowPaths,RBAC,Webhook
103+ server , kcpClusterClient , _ := setupTest (t , "" , "testdata/webhook3.kubeconfig" )
104+
105+ t .Log ("Verify that it is allowed to access one of AllowAllPaths endpoints." )
106+ verifyEndpointAccess (ctx , t , server , "/healthz" , true )
107+
108+ t .Log ("Admin should be allowed to list Workspaces." )
109+ _ , err := kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).TenancyV1alpha1 ().Workspaces ().List (ctx , metav1.ListOptions {})
110+ require .NoError (t , err )
111+ })
112+ }
113+
114+ func setupTest (t * testing.T , authOrder , webhookConfigFile string ) (framework.RunningServer , kcpclientset.ClusterInterface , kcpkubernetesclientset.ClusterInterface ) {
115+ args := []string {
116+ "--authorization-webhook-config-file" , webhookConfigFile ,
117+ }
118+ if authOrder != "" {
119+ args = append (args , "--authorization-order" , authOrder )
120+ }
121+
122+ server := framework .PrivateKcpServer (t , framework .WithCustomArguments (args ... ))
123+
52124 kcpConfig := server .BaseConfig (t )
53125 kubeClusterClient , err := kcpkubernetesclientset .NewForConfig (kcpConfig )
54- require .NoError (t , err , "failed to construct client for server" )
126+ require .NoError (t , err )
55127 kcpClusterClient , err := kcpclientset .NewForConfig (kcpConfig )
56- require .NoError (t , err , "failed to construct client for server" )
128+ require .NoError (t , err )
129+
130+ return server , kcpClusterClient , kubeClusterClient
131+ }
57132
58- // access to health endpoints should not be granted, as webhook is first
59- // in the order of authorizers and rejects the request
133+ func verifyEndpointAccess (ctx context.Context , t * testing.T , server framework.RunningServer , endpoint string , shouldSucceed bool ) {
60134 rootShardCfg := server .RootShardSystemMasterBaseConfig (t )
61135 if rootShardCfg .NegotiatedSerializer == nil {
62136 rootShardCfg .NegotiatedSerializer = kubernetesscheme .Codecs .WithoutConversion ()
@@ -65,35 +139,16 @@ func TestAuthorizationOrder(t *testing.T) {
65139 // in a reloadable authorizer that also always injects a privilegedGroup authorizer
66140 // that lets system:masters users in.
67141 rootShardCfg .BearerToken = ""
68- restClient , err := rest .UnversionedRESTClientFor (rootShardCfg )
69- require .NoError (t , err )
70-
71- t .Log ("Verify that you are allowed to access one of AllowAllPaths endpoints." )
72- req := rest .NewRequest (restClient ).RequestURI ("/livez" )
73- t .Logf ("%s should not be accessible." , req .URL ().String ())
74- _ , err = req .Do (ctx ).Raw ()
75- require .NoError (t , err )
76142
77- t .Log ("Admin should be allowed now to list Workspaces." )
78- _ , err = kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).TenancyV1alpha1 ().Workspaces ().List (ctx , metav1.ListOptions {})
143+ restClient , err := rest .UnversionedRESTClientFor (rootShardCfg )
79144 require .NoError (t , err )
80145
81- webhookStop ()
82- // run the webhook with deny policy
83- webhookStop = RunWebhook (ctx , t , webhookPort , "kubernetes:authz:deny" )
84- t .Cleanup (webhookStop )
85-
86- t .Log ("Admin should not be allowed now to list Logical clusters." )
87- _ , err = kcpClusterClient .Cluster (logicalcluster .NewPath ("root" )).CoreV1alpha1 ().LogicalClusters ().List (ctx , metav1.ListOptions {})
88- require .Error (t , err )
89-
90- t .Log ("Admin should not be allowed to list Services." )
91- _ , err = kubeClusterClient .Cluster (logicalcluster .NewPath ("root" )).CoreV1 ().Services ("default" ).List (ctx , metav1.ListOptions {})
92- require .Error (t , err )
93-
94- t .Log ("Verify that it is not allowed to access AllowAllPaths endpoints." )
95- req = rest .NewRequest (restClient ).RequestURI ("/healthz" )
96- t .Logf ("%s should not be accessible." , req .URL ().String ())
146+ req := rest .NewRequest (restClient ).RequestURI (endpoint )
147+ t .Logf ("Verifying access to: %s" , req .URL ().String ())
97148 _ , err = req .Do (ctx ).Raw ()
98- require .Error (t , err )
149+ if shouldSucceed {
150+ require .NoError (t , err )
151+ } else {
152+ require .Error (t , err )
153+ }
99154}
0 commit comments