|
| 1 | +/* |
| 2 | +Copyright 2025 The KCP Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package authorizer |
| 18 | + |
| 19 | +import ( |
| 20 | + "context" |
| 21 | + "fmt" |
| 22 | + "slices" |
| 23 | + "strings" |
| 24 | + |
| 25 | + "k8s.io/apimachinery/pkg/labels" |
| 26 | + "k8s.io/apiserver/pkg/authorization/authorizer" |
| 27 | + genericapirequest "k8s.io/apiserver/pkg/endpoints/request" |
| 28 | + |
| 29 | + kcpkubernetesclientset "github.com/kcp-dev/client-go/kubernetes" |
| 30 | + "github.com/kcp-dev/logicalcluster/v3" |
| 31 | + |
| 32 | + dynamiccontext "github.com/kcp-dev/kcp/pkg/virtual/framework/dynamic/context" |
| 33 | + apisv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/apis/v1alpha1" |
| 34 | + apisv1alpha1informers "github.com/kcp-dev/kcp/sdk/client/informers/externalversions/apis/v1alpha1" |
| 35 | +) |
| 36 | + |
| 37 | +type boundAPIAuthorizer struct { |
| 38 | + getAPIBindingByExport func(clusterName, apiExportName, apiExportCluster string) (*apisv1alpha1.APIBinding, error) |
| 39 | + |
| 40 | + delegate authorizer.Authorizer |
| 41 | +} |
| 42 | + |
| 43 | +var readOnlyVerbs = []string{"get", "list", "watch"} |
| 44 | + |
| 45 | +func NewBoundAPIAuthorizer(delegate authorizer.Authorizer, apiBindingInformer apisv1alpha1informers.APIBindingClusterInformer, kubeClusterClient kcpkubernetesclientset.ClusterInterface) authorizer.Authorizer { |
| 46 | + apiBindingLister := apiBindingInformer.Lister() |
| 47 | + |
| 48 | + return &boundAPIAuthorizer{ |
| 49 | + delegate: delegate, |
| 50 | + getAPIBindingByExport: func(clusterName, apiExportName, apiExportCluster string) (*apisv1alpha1.APIBinding, error) { |
| 51 | + bindings, err := apiBindingLister.Cluster(logicalcluster.Name(clusterName)).List(labels.Everything()) |
| 52 | + if err != nil { |
| 53 | + return nil, err |
| 54 | + } |
| 55 | + |
| 56 | + for _, binding := range bindings { |
| 57 | + if binding == nil { |
| 58 | + continue |
| 59 | + } |
| 60 | + |
| 61 | + if binding.Spec.Reference.Export != nil && binding.Spec.Reference.Export.Name == apiExportName && binding.Status.APIExportClusterName == apiExportCluster { |
| 62 | + return binding, nil |
| 63 | + } |
| 64 | + } |
| 65 | + |
| 66 | + return nil, fmt.Errorf("no suitable binding found") |
| 67 | + }, |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +func (a *boundAPIAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) { |
| 72 | + targetCluster, err := genericapirequest.ValidClusterFrom(ctx) |
| 73 | + if err != nil { |
| 74 | + return authorizer.DecisionNoOpinion, "", fmt.Errorf("error getting valid cluster from context: %w", err) |
| 75 | + } |
| 76 | + |
| 77 | + if targetCluster.Wildcard || attr.GetResource() == "" { |
| 78 | + // if the target is the wildcard cluster or it's a non-resurce URL request, |
| 79 | + // we can skip checking the APIBinding in the target cluster. |
| 80 | + return a.delegate.Authorize(ctx, attr) |
| 81 | + } |
| 82 | + |
| 83 | + apiDomainKey := dynamiccontext.APIDomainKeyFrom(ctx) |
| 84 | + parts := strings.Split(string(apiDomainKey), "/") |
| 85 | + if len(parts) < 2 { |
| 86 | + return authorizer.DecisionNoOpinion, "", fmt.Errorf("invalid API domain key") |
| 87 | + } |
| 88 | + apiExportCluster, apiExportName := parts[0], parts[1] |
| 89 | + |
| 90 | + apiBinding, err := a.getAPIBindingByExport(targetCluster.Name.String(), apiExportName, apiExportCluster) |
| 91 | + if err != nil { |
| 92 | + return authorizer.DecisionDeny, "could not find suitable APIBinding in target logical cluster", nil //nolint:nilerr // this is on purpose, we want to deny, not return a server error |
| 93 | + } |
| 94 | + |
| 95 | + // check if request is for a bound resource. |
| 96 | + for _, resource := range apiBinding.Status.BoundResources { |
| 97 | + if resource.Group == attr.GetAPIGroup() && resource.Resource == attr.GetResource() { |
| 98 | + return a.delegate.Authorize(ctx, attr) |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | + // check if a resource claim for this resource has been accepted. |
| 103 | + for _, permissionClaim := range apiBinding.Spec.PermissionClaims { |
| 104 | + if permissionClaim.State != apisv1alpha1.ClaimAccepted { |
| 105 | + // if the claim is not accepted it cannot be used. |
| 106 | + continue |
| 107 | + } |
| 108 | + |
| 109 | + if permissionClaim.Group == attr.GetAPIGroup() && permissionClaim.Resource == attr.GetResource() { |
| 110 | + return a.delegate.Authorize(ctx, attr) |
| 111 | + } |
| 112 | + } |
| 113 | + |
| 114 | + // special case: APIBindings are always available from an APIExport VW, |
| 115 | + // but the provider should only be allowed to access them read-only to avoid privilege escalation. |
| 116 | + if attr.GetAPIGroup() == apisv1alpha1.SchemeGroupVersion.Group && attr.GetResource() == "apibindings" { |
| 117 | + if !slices.Contains(readOnlyVerbs, attr.GetVerb()) { |
| 118 | + return authorizer.DecisionNoOpinion, "write access to APIBinding is not allowed from virtual workspace", nil |
| 119 | + } |
| 120 | + |
| 121 | + return a.delegate.Authorize(ctx, attr) |
| 122 | + } |
| 123 | + |
| 124 | + // if we cannot find the API bound to the logical cluster, we deny. |
| 125 | + // The APIExport owner has not been invited in. |
| 126 | + return authorizer.DecisionDeny, "failed to find suitable reason to allow access in APIBinding", nil |
| 127 | +} |
0 commit comments