Files
portainer/api/http/proxy/factory/kubernetes/token_cache.go
T
Yi Chen 2247d8c3a2 (feat)k8s/RBAC: Provide Portainer RBAC functionality for Kubernetes endpoints (#35)
* + endpoint and namespace level authorizations
+ user namespace authorization API
+ k8s client setup service account with k8s roles and policies by portainer role
* User authorization changes refresh token cache
* rbac authorizes k8s requests
* CE to EE migrator to include new authorizations

* code clean up
* comments

* * merge in the RestrictDefaultNamespace changes

* - remove unnecessary check for default namespace

* + updates namespace access policies when generating token

* * updates namespace access policies when querying the user namespace endpoint

* + k8s rule in rbac.go for endpoint access test
+ missing k8s cluster rules for different roles

* feat(rbac): update kube rbac

* feat(rbac): use the authorization directive

* feat(rbac): Update namespace access policies when user/team is deleted

* refactor(app): use new angular-multi-select capabilities

* feat(rbac): fix authorizations

* feat(rbac): fix userAccessPolicies update bug

* feat(rbac): add W applications authorizations

* feat(rbac): add application details W authorizations

* feat(rbac): add configurations W autohorizations

* feat(rbac): add configuration details W authorizations

* feat(rbac): add volumes W authorizations

* feat(rbac): add volume details W authorizations

* feat(rbac): add componentstatus to portainer-view role and add cluster/node authorizations

* fix(rbac): disable application note for non authorized user

* fix(rbac): add endpoints list and components status to portainer-basic

* fix(rbac): allow user to access default namespace when restrict default namespace isn't activated

* fix(rbac): remove default namespace from useraccesspolicies when restrict default namespace isn't activated

* fix(rbac): change some things

* fix(rbac): allow standard user to access container console

* - removed unused parameter

* fix(rbac): fix team authorizations

Co-authored-by: Maxime Bajeux <max.bajeux@gmail.com>
Co-authored-by: xAt0mZ <baron_l@epitech.eu>
2020-11-03 22:08:09 +13:00

82 lines
2.0 KiB
Go

package kubernetes
import (
"strconv"
cmap "github.com/orcaman/concurrent-map"
)
type (
// TokenCacheManager represents a service used to manage multiple tokenCache objects.
TokenCacheManager struct {
tokenCaches cmap.ConcurrentMap
}
tokenCache struct {
userTokenCache cmap.ConcurrentMap
}
)
// NewTokenCacheManager returns a pointer to a new instance of TokenCacheManager
func NewTokenCacheManager() *TokenCacheManager {
return &TokenCacheManager{
tokenCaches: cmap.New(),
}
}
// CreateTokenCache will create a new tokenCache object, associate it to the manager map of caches
// and return a pointer to that tokenCache instance.
func (manager *TokenCacheManager) CreateTokenCache(endpointID int) *tokenCache {
tokenCache := newTokenCache()
key := strconv.Itoa(endpointID)
manager.tokenCaches.Set(key, tokenCache)
return tokenCache
}
// RemoveUserFromCache will ensure that the specific userID is removed from all registered caches.
func (manager *TokenCacheManager) RemoveUserFromCache(userID int) {
for cache := range manager.tokenCaches.IterBuffered() {
cache.Val.(*tokenCache).removeToken(userID)
}
}
// remove all user's token when all users' auth are updated
func (manager *TokenCacheManager) HandleUsersAuthUpdate() {
for cache := range manager.tokenCaches.IterBuffered() {
cache.Val.(*tokenCache).userTokenCache = cmap.New()
}
}
// remove a single user token when his auth is updated
func (manager *TokenCacheManager) HandleUserAuthDelete(userID int) {
manager.RemoveUserFromCache(userID)
}
func newTokenCache() *tokenCache {
return &tokenCache{
userTokenCache: cmap.New(),
}
}
func (cache *tokenCache) getToken(userID int) (string, bool) {
key := strconv.Itoa(userID)
token, ok := cache.userTokenCache.Get(key)
if ok {
return token.(string), true
}
return "", false
}
func (cache *tokenCache) addToken(userID int, token string) {
key := strconv.Itoa(userID)
cache.userTokenCache.Set(key, token)
}
func (cache *tokenCache) removeToken(userID int) {
key := strconv.Itoa(userID)
cache.userTokenCache.Remove(key)
}