2021-01-07 22:58:09 +00:00
|
|
|
// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
|
2020-09-16 14:19:51 +00:00
|
|
|
// SPDX-License-Identifier: Apache-2.0
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2020-08-14 14:11:14 +00:00
|
|
|
// Package credentialrequest provides REST functionality for the CredentialRequest resource.
|
|
|
|
package credentialrequest
|
2020-07-23 15:05:21 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
2020-07-27 12:55:33 +00:00
|
|
|
"crypto/x509/pkix"
|
2020-07-23 15:05:21 +00:00
|
|
|
"fmt"
|
2020-07-27 12:55:33 +00:00
|
|
|
"time"
|
2020-07-23 15:05:21 +00:00
|
|
|
|
|
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
2021-02-05 15:55:19 +00:00
|
|
|
metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
|
2020-07-23 15:05:21 +00:00
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
"k8s.io/apimachinery/pkg/runtime"
|
2021-02-05 15:55:19 +00:00
|
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
2020-07-23 15:05:21 +00:00
|
|
|
"k8s.io/apimachinery/pkg/util/validation/field"
|
2020-09-21 16:37:54 +00:00
|
|
|
"k8s.io/apiserver/pkg/authentication/user"
|
2020-07-23 15:05:21 +00:00
|
|
|
"k8s.io/apiserver/pkg/registry/rest"
|
2020-08-06 22:14:30 +00:00
|
|
|
"k8s.io/utils/trace"
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2021-02-16 19:00:08 +00:00
|
|
|
loginapi "go.pinniped.dev/generated/latest/apis/concierge/login"
|
2020-07-23 15:05:21 +00:00
|
|
|
)
|
|
|
|
|
2020-07-27 18:38:32 +00:00
|
|
|
// clientCertificateTTL is the TTL for short-lived client certificates returned by this API.
|
2020-11-13 16:43:23 +00:00
|
|
|
const clientCertificateTTL = 5 * time.Minute
|
2020-07-27 18:38:32 +00:00
|
|
|
|
2020-07-27 12:55:33 +00:00
|
|
|
type CertIssuer interface {
|
|
|
|
IssuePEM(subject pkix.Name, dnsNames []string, ttl time.Duration) ([]byte, []byte, error)
|
|
|
|
}
|
|
|
|
|
2020-09-21 16:37:54 +00:00
|
|
|
type TokenCredentialRequestAuthenticator interface {
|
|
|
|
AuthenticateTokenCredentialRequest(ctx context.Context, req *loginapi.TokenCredentialRequest) (user.Info, error)
|
|
|
|
}
|
|
|
|
|
2021-02-05 15:55:19 +00:00
|
|
|
func NewREST(authenticator TokenCredentialRequestAuthenticator, issuer CertIssuer, resource schema.GroupResource) *REST {
|
2020-07-23 15:05:21 +00:00
|
|
|
return &REST{
|
2021-02-05 15:55:19 +00:00
|
|
|
authenticator: authenticator,
|
|
|
|
issuer: issuer,
|
|
|
|
tableConvertor: rest.NewDefaultTableConvertor(resource),
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
type REST struct {
|
2021-02-05 15:55:19 +00:00
|
|
|
authenticator TokenCredentialRequestAuthenticator
|
|
|
|
issuer CertIssuer
|
|
|
|
tableConvertor rest.TableConvertor
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|
|
|
|
|
2020-11-13 18:09:22 +00:00
|
|
|
// Assert that our *REST implements all the optional interfaces that we expect it to implement.
|
|
|
|
var _ interface {
|
|
|
|
rest.Creater
|
|
|
|
rest.NamespaceScopedStrategy
|
|
|
|
rest.Scoper
|
|
|
|
rest.Storage
|
|
|
|
rest.CategoriesProvider
|
2021-02-05 15:55:19 +00:00
|
|
|
rest.Lister
|
2020-11-13 18:09:22 +00:00
|
|
|
} = (*REST)(nil)
|
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
func (*REST) New() runtime.Object {
|
|
|
|
return &loginapi.TokenCredentialRequest{}
|
|
|
|
}
|
2020-09-16 19:57:18 +00:00
|
|
|
|
2021-02-05 15:55:19 +00:00
|
|
|
func (*REST) NewList() runtime.Object {
|
|
|
|
return &loginapi.TokenCredentialRequestList{}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (*REST) List(_ context.Context, _ *metainternalversion.ListOptions) (runtime.Object, error) {
|
|
|
|
return &loginapi.TokenCredentialRequestList{
|
|
|
|
ListMeta: metav1.ListMeta{
|
|
|
|
ResourceVersion: "0", // this resource version means "from the API server cache"
|
|
|
|
},
|
|
|
|
Items: []loginapi.TokenCredentialRequest{}, // avoid sending nil items list
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *REST) ConvertToTable(ctx context.Context, obj runtime.Object, tableOptions runtime.Object) (*metav1.Table, error) {
|
|
|
|
return r.tableConvertor.ConvertToTable(ctx, obj, tableOptions)
|
|
|
|
}
|
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
func (*REST) NamespaceScoped() bool {
|
2021-02-09 16:57:34 +00:00
|
|
|
return false
|
2020-09-18 22:15:04 +00:00
|
|
|
}
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2020-11-13 18:09:22 +00:00
|
|
|
func (*REST) Categories() []string {
|
|
|
|
return []string{"pinniped"}
|
|
|
|
}
|
|
|
|
|
2020-07-23 15:05:21 +00:00
|
|
|
func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions) (runtime.Object, error) {
|
2020-09-16 19:57:18 +00:00
|
|
|
t := trace.FromContext(ctx).Nest("create", trace.Field{
|
|
|
|
Key: "kind",
|
|
|
|
Value: obj.GetObjectKind().GroupVersionKind().Kind,
|
|
|
|
})
|
2020-08-06 22:14:30 +00:00
|
|
|
defer t.Log()
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2020-08-14 14:11:14 +00:00
|
|
|
credentialRequest, err := validateRequest(ctx, obj, createValidation, options, t)
|
2020-08-06 22:14:30 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|
|
|
|
|
2020-09-21 16:37:54 +00:00
|
|
|
user, err := r.authenticator.AuthenticateTokenCredentialRequest(ctx, credentialRequest)
|
2020-07-23 15:05:21 +00:00
|
|
|
if err != nil {
|
2020-12-08 01:39:51 +00:00
|
|
|
traceFailureWithError(t, "token authentication", err)
|
2020-09-18 22:15:04 +00:00
|
|
|
return failureResponse(), nil
|
2020-07-23 23:01:55 +00:00
|
|
|
}
|
2020-09-21 16:37:54 +00:00
|
|
|
if user == nil || user.GetName() == "" {
|
|
|
|
traceSuccess(t, user, false)
|
2020-09-18 22:15:04 +00:00
|
|
|
return failureResponse(), nil
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|
|
|
|
|
2020-07-27 13:08:39 +00:00
|
|
|
certPEM, keyPEM, err := r.issuer.IssuePEM(
|
|
|
|
pkix.Name{
|
2020-09-21 16:37:54 +00:00
|
|
|
CommonName: user.GetName(),
|
|
|
|
Organization: user.GetGroups(),
|
2020-07-27 13:08:39 +00:00
|
|
|
},
|
|
|
|
[]string{},
|
2020-07-27 18:38:32 +00:00
|
|
|
clientCertificateTTL,
|
2020-07-27 13:08:39 +00:00
|
|
|
)
|
|
|
|
if err != nil {
|
2020-08-06 22:14:30 +00:00
|
|
|
traceFailureWithError(t, "cert issuer", err)
|
2020-07-27 13:08:39 +00:00
|
|
|
return failureResponse(), nil
|
|
|
|
}
|
2020-07-23 23:01:55 +00:00
|
|
|
|
2020-09-21 16:37:54 +00:00
|
|
|
traceSuccess(t, user, true)
|
2020-08-06 22:14:30 +00:00
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
return &loginapi.TokenCredentialRequest{
|
|
|
|
Status: loginapi.TokenCredentialRequestStatus{
|
|
|
|
Credential: &loginapi.ClusterCredential{
|
2020-07-31 03:05:32 +00:00
|
|
|
ExpirationTimestamp: metav1.NewTime(time.Now().UTC().Add(clientCertificateTTL)),
|
2020-07-27 13:08:39 +00:00
|
|
|
ClientCertificateData: string(certPEM),
|
|
|
|
ClientKeyData: string(keyPEM),
|
2020-07-23 23:01:55 +00:00
|
|
|
},
|
2020-07-23 15:05:21 +00:00
|
|
|
},
|
2020-09-18 22:15:04 +00:00
|
|
|
}, nil
|
2020-07-23 23:01:55 +00:00
|
|
|
}
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
func validateRequest(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions, t *trace.Trace) (*loginapi.TokenCredentialRequest, error) {
|
|
|
|
credentialRequest, ok := obj.(*loginapi.TokenCredentialRequest)
|
2020-08-06 22:14:30 +00:00
|
|
|
if !ok {
|
2020-09-21 16:37:54 +00:00
|
|
|
traceValidationFailure(t, "not a TokenCredentialRequest")
|
|
|
|
return nil, apierrors.NewBadRequest(fmt.Sprintf("not a TokenCredentialRequest: %#v", obj))
|
2020-08-06 22:14:30 +00:00
|
|
|
}
|
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
if len(credentialRequest.Spec.Token) == 0 {
|
2020-08-06 22:14:30 +00:00
|
|
|
traceValidationFailure(t, "token must be supplied")
|
|
|
|
errs := field.ErrorList{field.Required(field.NewPath("spec", "token", "value"), "token must be supplied")}
|
2020-09-18 22:15:04 +00:00
|
|
|
return nil, apierrors.NewInvalid(loginapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
|
2020-08-06 22:14:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// just a sanity check, not sure how to honor a dry run on a virtual API
|
|
|
|
if options != nil {
|
|
|
|
if len(options.DryRun) != 0 {
|
|
|
|
traceValidationFailure(t, "dryRun not supported")
|
|
|
|
errs := field.ErrorList{field.NotSupported(field.NewPath("dryRun"), options.DryRun, nil)}
|
2020-09-18 22:15:04 +00:00
|
|
|
return nil, apierrors.NewInvalid(loginapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
|
2020-08-06 22:14:30 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// let dynamic admission webhooks have a chance to validate (but not mutate) as well
|
|
|
|
// TODO Since we are an aggregated API, we should investigate to see if the kube API server is already invoking admission hooks for us.
|
|
|
|
// Even if it is, its okay to call it again here. However, if the kube API server is already calling the webhooks and passing
|
|
|
|
// the token, then there is probably no reason for us to avoid passing the token when we call the webhooks here, since
|
|
|
|
// they already got the token.
|
|
|
|
if createValidation != nil {
|
|
|
|
requestForValidation := obj.DeepCopyObject()
|
2020-09-18 22:15:04 +00:00
|
|
|
requestForValidation.(*loginapi.TokenCredentialRequest).Spec.Token = ""
|
2020-08-06 22:14:30 +00:00
|
|
|
if err := createValidation(ctx, requestForValidation); err != nil {
|
|
|
|
traceFailureWithError(t, "validation webhook", err)
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-08-14 14:11:14 +00:00
|
|
|
return credentialRequest, nil
|
2020-08-06 22:14:30 +00:00
|
|
|
}
|
|
|
|
|
2020-09-21 16:37:54 +00:00
|
|
|
func traceSuccess(t *trace.Trace, userInfo user.Info, authenticated bool) {
|
2020-08-06 22:14:30 +00:00
|
|
|
userID := "<none>"
|
2020-09-21 16:37:54 +00:00
|
|
|
if userInfo != nil {
|
|
|
|
userID = userInfo.GetUID()
|
2020-08-06 22:14:30 +00:00
|
|
|
}
|
|
|
|
t.Step("success",
|
|
|
|
trace.Field{Key: "userID", Value: userID},
|
2020-09-21 16:37:54 +00:00
|
|
|
trace.Field{Key: "authenticated", Value: authenticated},
|
2020-08-06 22:14:30 +00:00
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
func traceValidationFailure(t *trace.Trace, msg string) {
|
|
|
|
t.Step("failure",
|
|
|
|
trace.Field{Key: "failureType", Value: "request validation"},
|
|
|
|
trace.Field{Key: "msg", Value: msg},
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
func traceFailureWithError(t *trace.Trace, failureType string, err error) {
|
|
|
|
t.Step("failure",
|
|
|
|
trace.Field{Key: "failureType", Value: failureType},
|
|
|
|
trace.Field{Key: "msg", Value: err.Error()},
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2020-09-18 22:15:04 +00:00
|
|
|
func failureResponse() *loginapi.TokenCredentialRequest {
|
2020-08-14 13:18:31 +00:00
|
|
|
m := "authentication failed"
|
2020-09-18 22:15:04 +00:00
|
|
|
return &loginapi.TokenCredentialRequest{
|
|
|
|
Status: loginapi.TokenCredentialRequestStatus{
|
2020-07-23 23:01:55 +00:00
|
|
|
Credential: nil,
|
2020-08-14 13:18:31 +00:00
|
|
|
Message: &m,
|
2020-07-23 23:01:55 +00:00
|
|
|
},
|
|
|
|
}
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|