diff --git a/README.md b/README.md index 986a2181a..2540eba6f 100644 --- a/README.md +++ b/README.md @@ -28,12 +28,14 @@ helm install kube-ui-server appscode/kube-ui-server ```console $ kubectl create -f artifacts/whoami.yaml -o yaml -apiVersion: authentication.k8s.appscode.com/v1alpha1 -kind: WhoAmI -response: - user: +apiVersion: authentication.k8s.io/v1 +kind: SelfSubjectReview +metadata: + creationTimestamp: "2024-06-10T18:41:37Z" +status: + userInfo: groups: - - system:masters + - kubeadm:cluster-admins - system:authenticated username: kubernetes-admin ``` diff --git a/apis/identity/v1alpha1/openapi_generated.go b/apis/identity/v1alpha1/openapi_generated.go index 45ec47d02..c05857761 100644 --- a/apis/identity/v1alpha1/openapi_generated.go +++ b/apis/identity/v1alpha1/openapi_generated.go @@ -380,9 +380,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA "kubeops.dev/ui-server/apis/identity/v1alpha1.InboxTokenRequest": schema_ui_server_apis_identity_v1alpha1_InboxTokenRequest(ref), "kubeops.dev/ui-server/apis/identity/v1alpha1.InboxTokenRequestRequest": schema_ui_server_apis_identity_v1alpha1_InboxTokenRequestRequest(ref), "kubeops.dev/ui-server/apis/identity/v1alpha1.InboxTokenRequestResponse": schema_ui_server_apis_identity_v1alpha1_InboxTokenRequestResponse(ref), - "kubeops.dev/ui-server/apis/identity/v1alpha1.UserInfo": schema_ui_server_apis_identity_v1alpha1_UserInfo(ref), - "kubeops.dev/ui-server/apis/identity/v1alpha1.WhoAmI": schema_ui_server_apis_identity_v1alpha1_WhoAmI(ref), - "kubeops.dev/ui-server/apis/identity/v1alpha1.WhoAmIResponse": schema_ui_server_apis_identity_v1alpha1_WhoAmIResponse(ref), } } @@ -19440,124 +19437,3 @@ func schema_ui_server_apis_identity_v1alpha1_InboxTokenRequestResponse(ref commo }, } } - -func schema_ui_server_apis_identity_v1alpha1_UserInfo(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "UserInfo holds the information about the user needed to implement the user.Info interface.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "username": { - SchemaProps: spec.SchemaProps{ - Description: "The name that uniquely identifies this user among all active users.", - Type: []string{"string"}, - Format: "", - }, - }, - "uid": { - SchemaProps: spec.SchemaProps{ - Description: "A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.", - Type: []string{"string"}, - Format: "", - }, - }, - "groups": { - SchemaProps: spec.SchemaProps{ - Description: "The names of groups this user is a part of.", - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - "extra": { - SchemaProps: spec.SchemaProps{ - Description: "Any additional information provided by the authenticator.", - Type: []string{"object"}, - AdditionalProperties: &spec.SchemaOrBool{ - Allows: true, - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Type: []string{"array"}, - Items: &spec.SchemaOrArray{ - Schema: &spec.Schema{ - SchemaProps: spec.SchemaProps{ - Default: "", - Type: []string{"string"}, - Format: "", - }, - }, - }, - }, - }, - }, - }, - }, - }, - }, - }, - } -} - -func schema_ui_server_apis_identity_v1alpha1_WhoAmI(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "WhoAmI is the Schema for the whoamis API", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "kind": { - SchemaProps: spec.SchemaProps{ - Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - Type: []string{"string"}, - Format: "", - }, - }, - "apiVersion": { - SchemaProps: spec.SchemaProps{ - Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - Type: []string{"string"}, - Format: "", - }, - }, - "response": { - SchemaProps: spec.SchemaProps{ - Description: "Response describes the attributes for the identity response.", - Ref: ref("kubeops.dev/ui-server/apis/identity/v1alpha1.WhoAmIResponse"), - }, - }, - }, - }, - }, - Dependencies: []string{ - "kubeops.dev/ui-server/apis/identity/v1alpha1.WhoAmIResponse"}, - } -} - -func schema_ui_server_apis_identity_v1alpha1_WhoAmIResponse(ref common.ReferenceCallback) common.OpenAPIDefinition { - return common.OpenAPIDefinition{ - Schema: spec.Schema{ - SchemaProps: spec.SchemaProps{ - Description: "WhoAmIResponse describes an admission response.", - Type: []string{"object"}, - Properties: map[string]spec.Schema{ - "user": { - SchemaProps: spec.SchemaProps{ - Description: "Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".", - Ref: ref("kubeops.dev/ui-server/apis/identity/v1alpha1.UserInfo"), - }, - }, - }, - }, - }, - Dependencies: []string{ - "kubeops.dev/ui-server/apis/identity/v1alpha1.UserInfo"}, - } -} diff --git a/apis/identity/v1alpha1/whoami_types.go b/apis/identity/v1alpha1/whoami_types.go deleted file mode 100644 index 01cd3c0cd..000000000 --- a/apis/identity/v1alpha1/whoami_types.go +++ /dev/null @@ -1,79 +0,0 @@ -/* -Copyright AppsCode Inc. and Contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package v1alpha1 - -import ( - "fmt" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" -) - -const ( - ResourceKindWhoAmI = "WhoAmI" - ResourceWhoAmI = "whoami" - ResourceWhoAmIs = "whoamis" -) - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// WhoAmI is the Schema for the whoamis API -type WhoAmI struct { - metav1.TypeMeta `json:",inline"` - // Response describes the attributes for the identity response. - // +optional - Response *WhoAmIResponse `json:"response,omitempty"` -} - -// WhoAmIResponse describes an admission response. -type WhoAmIResponse struct { - // Result contains extra details into why an admission request was denied. - // This field IS NOT consulted in any way if "Allowed" is "true". - // +optional - User *UserInfo `json:"user,omitempty"` -} - -// UserInfo holds the information about the user needed to implement the -// user.Info interface. -type UserInfo struct { - // The name that uniquely identifies this user among all active users. - // +optional - Username string `json:"username,omitempty"` - // A unique value that identifies this user across time. If this user is - // deleted and another user by the same name is added, they will have - // different UIDs. - // +optional - UID string `json:"uid,omitempty"` - // The names of groups this user is a part of. - // +optional - Groups []string `json:"groups,omitempty"` - // Any additional information provided by the authenticator. - // +optional - Extra map[string]ExtraValue `json:"extra,omitempty"` -} - -// ExtraValue masks the value so protobuf can generate -// +protobuf.nullable=true -// +protobuf.options.(gogoproto.goproto_stringer)=false -type ExtraValue []string - -func (t ExtraValue) String() string { - return fmt.Sprintf("%v", []string(t)) -} - -func init() { - SchemeBuilder.Register(&WhoAmI{}) -} diff --git a/apis/identity/v1alpha1/zz_generated.deepcopy.go b/apis/identity/v1alpha1/zz_generated.deepcopy.go index bf078e488..0bc3f7adb 100644 --- a/apis/identity/v1alpha1/zz_generated.deepcopy.go +++ b/apis/identity/v1alpha1/zz_generated.deepcopy.go @@ -102,26 +102,6 @@ func (in *ClusterIdentityStatus) DeepCopy() *ClusterIdentityStatus { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in ExtraValue) DeepCopyInto(out *ExtraValue) { - { - in := &in - *out = make(ExtraValue, len(*in)) - copy(*out, *in) - return - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraValue. -func (in ExtraValue) DeepCopy() ExtraValue { - if in == nil { - return nil - } - out := new(ExtraValue) - in.DeepCopyInto(out) - return *out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *InboxTokenRequest) DeepCopyInto(out *InboxTokenRequest) { *out = *in @@ -188,90 +168,3 @@ func (in *InboxTokenRequestResponse) DeepCopy() *InboxTokenRequestResponse { in.DeepCopyInto(out) return out } - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *UserInfo) DeepCopyInto(out *UserInfo) { - *out = *in - if in.Groups != nil { - in, out := &in.Groups, &out.Groups - *out = make([]string, len(*in)) - copy(*out, *in) - } - if in.Extra != nil { - in, out := &in.Extra, &out.Extra - *out = make(map[string]ExtraValue, len(*in)) - for key, val := range *in { - var outVal []string - if val == nil { - (*out)[key] = nil - } else { - in, out := &val, &outVal - *out = make(ExtraValue, len(*in)) - copy(*out, *in) - } - (*out)[key] = outVal - } - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserInfo. -func (in *UserInfo) DeepCopy() *UserInfo { - if in == nil { - return nil - } - out := new(UserInfo) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WhoAmI) DeepCopyInto(out *WhoAmI) { - *out = *in - out.TypeMeta = in.TypeMeta - if in.Response != nil { - in, out := &in.Response, &out.Response - *out = new(WhoAmIResponse) - (*in).DeepCopyInto(*out) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WhoAmI. -func (in *WhoAmI) DeepCopy() *WhoAmI { - if in == nil { - return nil - } - out := new(WhoAmI) - in.DeepCopyInto(out) - return out -} - -// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *WhoAmI) DeepCopyObject() runtime.Object { - if c := in.DeepCopy(); c != nil { - return c - } - return nil -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *WhoAmIResponse) DeepCopyInto(out *WhoAmIResponse) { - *out = *in - if in.User != nil { - in, out := &in.User, &out.User - *out = new(UserInfo) - (*in).DeepCopyInto(*out) - } - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WhoAmIResponse. -func (in *WhoAmIResponse) DeepCopy() *WhoAmIResponse { - if in == nil { - return nil - } - out := new(WhoAmIResponse) - in.DeepCopyInto(out) - return out -} diff --git a/artifacts/whoami.yaml b/artifacts/whoami.yaml index c4472f886..eaaead16e 100644 --- a/artifacts/whoami.yaml +++ b/artifacts/whoami.yaml @@ -1,2 +1,2 @@ -apiVersion: identity.k8s.appscode.com/v1alpha1 -kind: WhoAmI +apiVersion: authentication.k8s.io/v1 +kind: SelfSubjectReview diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go index 47e972a37..a4c0e3e4a 100644 --- a/pkg/apiserver/apiserver.go +++ b/pkg/apiserver/apiserver.go @@ -48,7 +48,6 @@ import ( coststorage "kubeops.dev/ui-server/pkg/registry/cost/reports" clusteridstorage "kubeops.dev/ui-server/pkg/registry/identity/clusteridentity" inboxtokenreqstorage "kubeops.dev/ui-server/pkg/registry/identity/inboxtokenrequest" - whoamistorage "kubeops.dev/ui-server/pkg/registry/identity/whoami" "kubeops.dev/ui-server/pkg/registry/meta/chartpresetquery" clusterprofilestorage "kubeops.dev/ui-server/pkg/registry/meta/clusterprofile" clusterstatusstorage "kubeops.dev/ui-server/pkg/registry/meta/clusterstatus" @@ -359,7 +358,6 @@ func (c completedConfig) New(ctx context.Context) (*UIServer, error) { v1alpha1storage := map[string]rest.Storage{} v1alpha1storage[identityapi.ResourceClusterIdentities] = clusteridstorage.NewStorage(ctrlClient, bc, cid) v1alpha1storage[identityapi.ResourceInboxTokenRequests] = inboxtokenreqstorage.NewStorage(ctrlClient, bc, cid) - v1alpha1storage[identityapi.ResourceWhoAmIs] = whoamistorage.NewStorage() apiGroupInfo.VersionedResourcesStorageMap["v1alpha1"] = v1alpha1storage if err := s.GenericAPIServer.InstallAPIGroup(&apiGroupInfo); err != nil { diff --git a/pkg/cmds/server/start.go b/pkg/cmds/server/start.go index acd887aad..d13ec3005 100644 --- a/pkg/cmds/server/start.go +++ b/pkg/cmds/server/start.go @@ -169,7 +169,6 @@ func (o *UIServerOptions) Config() (*apiserver.Config, error) { fmt.Sprintf("/apis/%s", identityapi.GroupVersion), fmt.Sprintf("/apis/%s/%s", identityapi.GroupVersion, identityapi.ResourceClusterIdentities), fmt.Sprintf("/apis/%s/%s", identityapi.GroupVersion, identityapi.ResourceInboxTokenRequests), - fmt.Sprintf("/apis/%s/%s", identityapi.GroupVersion, identityapi.ResourceWhoAmIs), } serverConfig.OpenAPIConfig = genericapiserver.DefaultOpenAPIConfig( diff --git a/pkg/registry/identity/whoami/storage.go b/pkg/registry/identity/whoami/storage.go deleted file mode 100644 index d053c035b..000000000 --- a/pkg/registry/identity/whoami/storage.go +++ /dev/null @@ -1,86 +0,0 @@ -/* -Copyright AppsCode Inc. and Contributors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package whoami - -import ( - "context" - "strings" - - "kubeops.dev/ui-server/apis/identity/v1alpha1" - identityapi "kubeops.dev/ui-server/apis/identity/v1alpha1" - - apierrors "k8s.io/apimachinery/pkg/api/errors" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/apiserver/pkg/endpoints/request" - "k8s.io/apiserver/pkg/registry/rest" -) - -type Storage struct{} - -var ( - _ rest.GroupVersionKindProvider = &Storage{} - _ rest.Scoper = &Storage{} - _ rest.Storage = &Storage{} - _ rest.Creater = &Storage{} - _ rest.SingularNameProvider = &Storage{} -) - -func NewStorage() *Storage { - return &Storage{} -} - -func (r *Storage) GroupVersionKind(_ schema.GroupVersion) schema.GroupVersionKind { - return identityapi.GroupVersion.WithKind(identityapi.ResourceKindWhoAmI) -} - -func (r *Storage) NamespaceScoped() bool { - return false -} - -func (r *Storage) GetSingularName() string { - return strings.ToLower(identityapi.ResourceKindWhoAmI) -} - -func (r *Storage) New() runtime.Object { - return &identityapi.WhoAmI{} -} - -func (r *Storage) Destroy() {} - -func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.ValidateObjectFunc, _ *metav1.CreateOptions) (runtime.Object, error) { - user, ok := request.UserFrom(ctx) - if !ok { - return nil, apierrors.NewBadRequest("missing user info") - } - req := obj.(*identityapi.WhoAmI) - - extra := make(map[string]identityapi.ExtraValue) - for k, v := range user.GetExtra() { - extra[k] = v - } - req.Response = &identityapi.WhoAmIResponse{ - User: &v1alpha1.UserInfo{ - Username: user.GetName(), - UID: user.GetUID(), - Groups: user.GetGroups(), - Extra: extra, - }, - } - return req, nil -}