From e595879da9497bdff442b54849128346526c672f Mon Sep 17 00:00:00 2001 From: Somefive Date: Mon, 25 Jul 2022 22:03:10 +0800 Subject: [PATCH] Feat: add featuregates to disallow url in ref-objects (#4446) Signed-off-by: Somefive --- pkg/appfile/parser.go | 5 +++++ pkg/features/controller_features.go | 3 +++ 2 files changed, 8 insertions(+) diff --git a/pkg/appfile/parser.go b/pkg/appfile/parser.go index d7c3dd78e..8d64f5a58 100644 --- a/pkg/appfile/parser.go +++ b/pkg/appfile/parser.go @@ -28,6 +28,7 @@ import ( "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" ktypes "k8s.io/apimachinery/pkg/types" + utilfeature "k8s.io/apiserver/pkg/util/feature" "sigs.k8s.io/controller-runtime/pkg/client" "github.com/oam-dev/kubevela/apis/core.oam.dev/common" @@ -38,6 +39,7 @@ import ( "github.com/oam-dev/kubevela/pkg/component" "github.com/oam-dev/kubevela/pkg/cue/definition" "github.com/oam-dev/kubevela/pkg/cue/packages" + "github.com/oam-dev/kubevela/pkg/features" monitorContext "github.com/oam-dev/kubevela/pkg/monitor/context" "github.com/oam-dev/kubevela/pkg/monitor/metrics" "github.com/oam-dev/kubevela/pkg/oam" @@ -350,6 +352,9 @@ func (p *Parser) parseReferredObjects(ctx context.Context, af *Appfile) error { } af.ReferredObjects = component.AppendUnstructuredObjects(af.ReferredObjects, objs...) } + if utilfeature.DefaultMutableFeatureGate.Enabled(features.DisableReferObjectsFromURL) && len(spec.URLs) > 0 { + return fmt.Errorf("referring objects from url is disabled") + } for _, url := range spec.URLs { objs, err := utilscommon.HTTPGetKubernetesObjects(ctx, url) if err != nil { diff --git a/pkg/features/controller_features.go b/pkg/features/controller_features.go index 5b19781be..95ed23c04 100644 --- a/pkg/features/controller_features.go +++ b/pkg/features/controller_features.go @@ -40,6 +40,8 @@ const ( // LegacyResourceOwnerValidation if enabled, the resource dispatch will allow existing resource not to have owner // application and the current application will take over it LegacyResourceOwnerValidation featuregate.Feature = "LegacyResourceOwnerValidation" + // DisableReferObjectsFromURL if set, the url ref objects will be disallowed + DisableReferObjectsFromURL featuregate.Feature = "DisableReferObjectsFromURL" // Edge Features @@ -55,6 +57,7 @@ var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{ EnableSuspendOnFailure: {Default: false, PreRelease: featuregate.Alpha}, LegacyComponentRevision: {Default: false, PreRelease: featuregate.Alpha}, LegacyResourceOwnerValidation: {Default: false, PreRelease: featuregate.Alpha}, + DisableReferObjectsFromURL: {Default: false, PreRelease: featuregate.Alpha}, AuthenticateApplication: {Default: false, PreRelease: featuregate.Alpha}, }