Support Groups as Subject Kind for Tenant Namespace RoleBindings created by Capsule (#71)

Modified CRD to support Owner struct.

Added Tenant name validation webhook.

Rewrote owner_reference hook logic.

Updated and added new e2e tests.

Co-authored-by: Maksim Fedotov <m_fedotov@wargaming.net>

pkg/indexer/tenant/owner.go

@@ -21,6 +21,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/clastix/capsule/api/v1alpha1"
+	"github.com/clastix/capsule/pkg/utils"
 )
 
 type OwnerReference struct {
@@ -31,12 +32,12 @@ func (o OwnerReference) Object() runtime.Object {
 }
 
 func (o OwnerReference) Field() string {
-	return ".spec.owner"
+	return ".spec.owner.ownerkind"
 }
 
 func (o OwnerReference) Func() client.IndexerFunc {
 	return func(object runtime.Object) []string {
 		tenant := object.(*v1alpha1.Tenant)
-		return []string{tenant.Spec.Owner}
+		return []string{utils.GetOwnerWithKind(tenant)}
 	}
 }

pkg/utils/owner.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package utils
+
+import "github.com/clastix/capsule/api/v1alpha1"
+
+func GetOwnerWithKind(tenant *v1alpha1.Tenant) string {
+	return tenant.Spec.Owner.Kind.String() + ":" + tenant.Spec.Owner.Name
+}

pkg/webhook/owner_reference/patching.go

@@ -19,18 +19,21 @@ package owner_reference
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
+	"strings"
 
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
+	"github.com/clastix/capsule/api/v1alpha1"
 	capsulev1alpha1 "github.com/clastix/capsule/api/v1alpha1"
 	capsulewebhook "github.com/clastix/capsule/pkg/webhook"
+	authenticationv1 "k8s.io/api/authentication/v1"
 )
 
 // +kubebuilder:webhook:path=/mutate-v1-namespace-owner-reference,mutating=true,failurePolicy=fail,groups="",resources=namespaces,verbs=create,versions=v1,name=owner.namespace.capsule.clastix.io
@@ -56,10 +59,13 @@ func (w *webhook) GetPath() string {
 }
 
 type handler struct {
+	forceTenantPrefix bool
 }
 
-func Handler() capsulewebhook.Handler {
-	return &handler{}
+func Handler(forceTenantPrefix bool) capsulewebhook.Handler {
+	return &handler{
+		forceTenantPrefix: forceTenantPrefix,
+	}
 }
 
 func (h *handler) OnCreate(clt client.Client, decoder *admission.Decoder) capsulewebhook.Func {
@@ -68,12 +74,12 @@ func (h *handler) OnCreate(clt client.Client, decoder *admission.Decoder) capsul
 		if err := decoder.Decode(req, ns); err != nil {
 			return admission.Errored(http.StatusBadRequest, err)
 		}
-
+		ln, err := capsulev1alpha1.GetTypeLabel(&capsulev1alpha1.Tenant{})
+		if err != nil {
+			return admission.Errored(http.StatusBadRequest, err)
+		}
+		// If we already had TenantName label on NS -> assign to it
 		if len(ns.ObjectMeta.Labels) > 0 {
-			ln, err := capsulev1alpha1.GetTypeLabel(&capsulev1alpha1.Tenant{})
-			if err != nil {
-				return admission.Errored(http.StatusBadRequest, err)
-			}
 			l, ok := ns.ObjectMeta.Labels[ln]
 			// assigning namespace to Tenant in case of label
 			if ok {
@@ -83,7 +89,7 @@ func (h *handler) OnCreate(clt client.Client, decoder *admission.Decoder) capsul
 					return admission.Errored(http.StatusBadRequest, err)
 				}
 				// Tenant owner must adhere to user that asked for NS creation
-				if t.Spec.Owner != req.UserInfo.Username {
+				if !h.isTenantOwner(t.Spec.Owner, req.UserInfo) {
 					return admission.Denied("Cannot assign the desired namespace to a non-owned Tenant")
 				}
 				// Patching the response
@@ -91,16 +97,52 @@ func (h *handler) OnCreate(clt client.Client, decoder *admission.Decoder) capsul
 			}
 
 		}
-
-		tl := &capsulev1alpha1.TenantList{}
-		if err := clt.List(ctx, tl, client.MatchingFieldsSelector{
-			Selector: fields.OneTermEqualSelector(".spec.owner", req.UserInfo.Username),
-		}); err != nil {
-			return admission.Errored(http.StatusBadRequest, err)
+		// If we forceTenantPrefix -> find Tenant from NS name
+		if h.forceTenantPrefix {
+			t := &v1alpha1.Tenant{}
+			tenantName := strings.Split(ns.GetName(), "-")[0]
+			if err := clt.Get(ctx, types.NamespacedName{Name: tenantName}, t); err != nil {
+				return admission.Errored(http.StatusBadRequest, err)
+			}
+			return h.patchResponseForOwnerRef(t, ns)
 		}
 
-		if len(tl.Items) > 0 {
-			return h.patchResponseForOwnerRef(&tl.Items[0], ns)
+		tenants := []*capsulev1alpha1.Tenant{}
+
+		// Find tenants belonging to user
+		tlu, err := h.listTenantsForOwnerKind(ctx, "User", req.UserInfo.Username, clt)
+		if err != nil {
+			return admission.Errored(http.StatusBadRequest, err)
+		}
+		// No groups single tenant short-circuit
+		if len(req.UserInfo.Groups) == 0 && len(tlu.Items) == 1 {
+			return h.patchResponseForOwnerRef(&tlu.Items[0], ns)
+		}
+
+		switch userTenants := len(tlu.Items); {
+		case userTenants > 1:
+			return admission.Denied("Unable to assign namespace to tenant. Please use " + ln + " label when creating a namespace")
+		case userTenants == 1:
+			tenants = append(tenants, &tlu.Items[0])
+		}
+
+		for _, group := range req.UserInfo.Groups {
+			tl, err := h.listTenantsForOwnerKind(ctx, "Group", group, clt)
+			if err != nil {
+				return admission.Errored(http.StatusBadRequest, err)
+			}
+			for _, item := range tl.Items {
+				tenants = append(tenants, &item)
+			}
+			// more than one tenant found, returning error
+			if len(tenants) > 1 {
+				return admission.Denied("Unable to assign namespace to tenant. Please use " + ln + " label when creating a namespace")
+			}
+		}
+
+		// Single tenant found for group
+		if len(tenants) == 1 {
+			return h.patchResponseForOwnerRef(tenants[0], ns)
 		}
 
 		return admission.Denied("You do not have any Tenant assigned: please, reach out the system administrators")
@@ -131,3 +173,26 @@ func (h *handler) patchResponseForOwnerRef(tenant *capsulev1alpha1.Tenant, ns *c
 	c, _ := json.Marshal(ns)
 	return admission.PatchResponseFromRaw(o, c)
 }
+
+func (h *handler) listTenantsForOwnerKind(ctx context.Context, ownerKind string, ownerName string, clt client.Client) (*v1alpha1.TenantList, error) {
+	tl := &v1alpha1.TenantList{}
+	f := client.MatchingFields{
+		".spec.owner.ownerkind": fmt.Sprintf("%s:%s", ownerKind, ownerName),
+	}
+	err := clt.List(ctx, tl, f)
+	return tl, err
+}
+
+func (h *handler) isTenantOwner(os v1alpha1.OwnerSpec, userInfo authenticationv1.UserInfo) bool {
+	if os.Kind == "User" && userInfo.Username == os.Name {
+		return true
+	}
+	if os.Kind == "Group" {
+		for _, group := range userInfo.Groups {
+			if group == os.Name {
+				return true
+			}
+		}
+	}
+	return false
+}

pkg/webhook/tenant_name/validating.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tenant_name
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+	capsulewebhook "github.com/clastix/capsule/pkg/webhook"
+)
+
+// +kubebuilder:webhook:path=/validating-v1-tenant-name,mutating=false,failurePolicy=fail,groups="capsule.clastix.io",resources=tenants,verbs=create,versions=v1alpha1,name=tenant.name.capsule.clastix.io
+
+type webhook struct {
+	handler capsulewebhook.Handler
+}
+
+func Webhook(handler capsulewebhook.Handler) capsulewebhook.Webhook {
+	return &webhook{handler: handler}
+}
+
+func (w webhook) GetName() string {
+	return "TenantName"
+}
+
+func (w webhook) GetPath() string {
+	return "/validating-v1-tenant-name"
+}
+
+func (w webhook) GetHandler() capsulewebhook.Handler {
+	return w.handler
+}
+
+type handler struct {
+}
+
+func Handler() capsulewebhook.Handler {
+	return &handler{}
+}
+
+func (r *handler) OnCreate(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) admission.Response {
+		tnt := &v1alpha1.Tenant{}
+		if err := decoder.Decode(req, tnt); err != nil {
+			return admission.Errored(http.StatusBadRequest, err)
+		}
+
+		matched, _ := regexp.MatchString(`^[a-z0-9]([a-z0-9]*[a-z0-9])?$`, tnt.GetName())
+		if !matched {
+			return admission.Denied("Tenant name has forbidden characters")
+		}
+		return admission.Allowed("")
+	}
+}
+
+func (h *handler) OnDelete(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) admission.Response {
+		return admission.Allowed("")
+	}
+}
+
+func (h *handler) OnUpdate(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
+	return func(ctx context.Context, req admission.Request) admission.Response {
+		return admission.Allowed("")
+	}
+}