From f4ef77b2b318f6f193289146b21cc33236a523d4 Mon Sep 17 00:00:00 2001 From: Somefive Date: Thu, 26 May 2022 17:41:22 +0800 Subject: [PATCH] Chore: remove useless features and roles Signed-off-by: Somefive --- apis/types/types.go | 5 ---- .../cluster-gateway/cluster-gateway.yaml | 9 +++----- .../templates/kubevela-controller.yaml | 3 --- .../templates/rbac/x-definition.yaml | 23 ------------------- .../templates/cluster-gateway.yaml | 10 ++++---- .../templates/kubevela-controller.yaml | 3 --- cmd/core/main.go | 11 --------- pkg/auth/round_trippers.go | 6 +---- pkg/auth/round_trippers_test.go | 9 ++++---- pkg/features/controller_features.go | 3 --- .../v1alpha2/application/mutating_handler.go | 11 ++++----- 11 files changed, 16 insertions(+), 77 deletions(-) delete mode 100644 charts/vela-core/templates/rbac/x-definition.yaml diff --git a/apis/types/types.go b/apis/types/types.go index faf8c339b..ba476f387 100644 --- a/apis/types/types.go +++ b/apis/types/types.go @@ -169,8 +169,3 @@ const ( // VelaCoreConfig is to mark application, config and its secret or Terraform provider lelong to a KubeVela config VelaCoreConfig = "velacore-config" ) - -const ( - // ClusterGatewayAccessorGroup the group to impersonate which allows the access to the cluster-gateway - ClusterGatewayAccessorGroup = "cluster-gateway-accessor" -) diff --git a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml index d624bc845..b7af88adc 100644 --- a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml +++ b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml @@ -129,7 +129,7 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-role + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy rules: - apiGroups: [ "cluster.core.oam.dev" ] resources: [ "clustergateways/proxy" ] @@ -138,15 +138,12 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-rolebinding + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-role + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy subjects: - - kind: Group - name: cluster-gateway-accessor - apiGroup: rbac.authorization.k8s.io - kind: Group name: kubevela:client apiGroup: rbac.authorization.k8s.io diff --git a/charts/vela-core/templates/kubevela-controller.yaml b/charts/vela-core/templates/kubevela-controller.yaml index ce81b03ec..ba94201ea 100644 --- a/charts/vela-core/templates/kubevela-controller.yaml +++ b/charts/vela-core/templates/kubevela-controller.yaml @@ -25,9 +25,6 @@ subjects: - kind: ServiceAccount name: {{ include "kubevela.serviceAccountName" . }} namespace: {{ .Release.Namespace }} - - kind: Group - name: core.oam.dev - apiGroup: rbac.authorization.k8s.io --- # permissions to do leader election. diff --git a/charts/vela-core/templates/rbac/x-definition.yaml b/charts/vela-core/templates/rbac/x-definition.yaml deleted file mode 100644 index ebf204418..000000000 --- a/charts/vela-core/templates/rbac/x-definition.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{ if .Values.authentication.enabled }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: kubevela:x-definition:reader -rules: - - apiGroups: [ "core.oam.dev" ] - resources: [ "componentdefinitions", "traitdefinitions", "workloaddefinitions", "workflowstepdefinitions", "policydefinitions", "definitionrevisions" ] - verbs: [ "get", "list", "watch" ] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubevela:x-definition:reader-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubevela:x-definition:reader -subjects: - - kind: Group - name: kubevela:x-definition:reader - apiGroup: rbac.authorization.k8s.io -{{ end }} \ No newline at end of file diff --git a/charts/vela-minimal/templates/cluster-gateway.yaml b/charts/vela-minimal/templates/cluster-gateway.yaml index dfdcbd3db..ec7ffcc2f 100644 --- a/charts/vela-minimal/templates/cluster-gateway.yaml +++ b/charts/vela-minimal/templates/cluster-gateway.yaml @@ -194,24 +194,22 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-role + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy rules: - apiGroups: [ "cluster.core.oam.dev" ] resources: [ "clustergateways/proxy" ] verbs: [ "get", "list", "watch", "create", "update", "patch", "delete" ] -{{ end }} --- -{{ if and .Values.multicluster.enabled }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-rolebinding + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "kubevela.fullname" . }}:cluster-gateway-access-role + name: {{ include "kubevela.fullname" . }}:cluster-gateway:proxy subjects: - kind: Group - name: cluster-gateway-accessor + name: kubevela:client apiGroup: rbac.authorization.k8s.io {{ end }} \ No newline at end of file diff --git a/charts/vela-minimal/templates/kubevela-controller.yaml b/charts/vela-minimal/templates/kubevela-controller.yaml index 237c53d6e..ebea018f1 100644 --- a/charts/vela-minimal/templates/kubevela-controller.yaml +++ b/charts/vela-minimal/templates/kubevela-controller.yaml @@ -27,9 +27,6 @@ subjects: - kind: ServiceAccount name: {{ include "kubevela.serviceAccountName" . }} namespace: {{ .Release.Namespace }} - - kind: Group - name: core.oam.dev - apiGroup: rbac.authorization.k8s.io --- # permissions to do leader election. diff --git a/cmd/core/main.go b/cmd/core/main.go index c205d30fb..bee60cc9b 100644 --- a/cmd/core/main.go +++ b/cmd/core/main.go @@ -36,7 +36,6 @@ import ( ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/healthz" - apicommon "github.com/oam-dev/kubevela/apis/core.oam.dev/common" "github.com/oam-dev/kubevela/apis/types" "github.com/oam-dev/kubevela/pkg/auth" ctrlClient "github.com/oam-dev/kubevela/pkg/client" @@ -46,13 +45,11 @@ import ( oamv1alpha2 "github.com/oam-dev/kubevela/pkg/controller/core.oam.dev/v1alpha2" "github.com/oam-dev/kubevela/pkg/controller/utils" "github.com/oam-dev/kubevela/pkg/cue/packages" - "github.com/oam-dev/kubevela/pkg/features" _ "github.com/oam-dev/kubevela/pkg/monitor/metrics" "github.com/oam-dev/kubevela/pkg/multicluster" "github.com/oam-dev/kubevela/pkg/oam" "github.com/oam-dev/kubevela/pkg/oam/discoverymapper" "github.com/oam-dev/kubevela/pkg/resourcekeeper" - pkgutils "github.com/oam-dev/kubevela/pkg/utils" "github.com/oam-dev/kubevela/pkg/utils/common" "github.com/oam-dev/kubevela/pkg/utils/system" "github.com/oam-dev/kubevela/pkg/utils/util" @@ -205,18 +202,10 @@ func main() { restConfig.QPS = float32(qps) restConfig.Burst = burst restConfig.Wrap(auth.NewImpersonatingRoundTripper) - if utilfeature.DefaultMutableFeatureGate.Enabled(features.ControllerAutoImpersonation) { - restConfig.Impersonate.UserName = types.VelaCoreName - restConfig.Impersonate.Groups = []string{apicommon.Group} - pkgutils.AutoSetSelfImpersonationInConfig(restConfig) - } klog.InfoS("Kubernetes Config Loaded", "UserAgent", restConfig.UserAgent, "QPS", restConfig.QPS, "Burst", restConfig.Burst, - "Auto-Impersonation", utilfeature.DefaultMutableFeatureGate.Enabled(features.ControllerAutoImpersonation), - "Impersonate-User", restConfig.Impersonate.UserName, - "Impersonate-Group", strings.Join(restConfig.Impersonate.Groups, ","), ) // wrapper the round tripper by multi cluster rewriter diff --git a/pkg/auth/round_trippers.go b/pkg/auth/round_trippers.go index ca2bd283b..f012d9d45 100644 --- a/pkg/auth/round_trippers.go +++ b/pkg/auth/round_trippers.go @@ -25,7 +25,6 @@ import ( "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/client-go/transport" - "github.com/oam-dev/kubevela/apis/types" "github.com/oam-dev/kubevela/pkg/utils" ) @@ -54,11 +53,8 @@ func (rt *impersonatingRoundTripper) RoundTrip(req *http.Request) (*http.Respons if exists && userInfo != nil { if name := userInfo.GetName(); name != "" { req.Header.Set(transport.ImpersonateUserHeader, name) - req.Header.Set(transport.ImpersonateGroupHeader, types.ClusterGatewayAccessorGroup) for _, group := range userInfo.GetGroups() { - if group != types.ClusterGatewayAccessorGroup { - req.Header.Add(transport.ImpersonateGroupHeader, group) - } + req.Header.Add(transport.ImpersonateGroupHeader, group) } q := req.URL.Query() q.Add(impersonateKey, "true") diff --git a/pkg/auth/round_trippers_test.go b/pkg/auth/round_trippers_test.go index 080e5ec46..4b514e6a7 100644 --- a/pkg/auth/round_trippers_test.go +++ b/pkg/auth/round_trippers_test.go @@ -31,7 +31,6 @@ import ( featuregatetesting "k8s.io/component-base/featuregate/testing" "github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1" - "github.com/oam-dev/kubevela/apis/types" "github.com/oam-dev/kubevela/pkg/features" "github.com/oam-dev/kubevela/pkg/oam" ) @@ -66,21 +65,21 @@ func TestImpersonatingRoundTripper(t *testing.T) { return ContextWithUserInfo(ctx, app) }, expectedUser: "system:serviceaccount:vela-system:default", - expectedGroup: []string{types.ClusterGatewayAccessorGroup}, + expectedGroup: []string{}, }, "without service account and app": { ctxFn: func(ctx context.Context) context.Context { return ContextWithUserInfo(ctx, nil) }, expectedUser: "", - expectedGroup: []string{types.ClusterGatewayAccessorGroup}, + expectedGroup: []string{}, }, "without service account": { ctxFn: func(ctx context.Context) context.Context { return ContextWithUserInfo(ctx, &v1beta1.Application{}) }, expectedUser: AuthenticationDefaultUser, - expectedGroup: []string{types.ClusterGatewayAccessorGroup}, + expectedGroup: []string{}, }, "with user and groups": { ctxFn: func(ctx context.Context) context.Context { @@ -92,7 +91,7 @@ func TestImpersonatingRoundTripper(t *testing.T) { return ContextWithUserInfo(ctx, app) }, expectedUser: "username", - expectedGroup: []string{types.ClusterGatewayAccessorGroup, "kubevela:group1", "kubevela:group2"}, + expectedGroup: []string{"kubevela:group1", "kubevela:group2"}, }, } for name, ts := range testSets { diff --git a/pkg/features/controller_features.go b/pkg/features/controller_features.go index 05fc28f3b..eec989cea 100644 --- a/pkg/features/controller_features.go +++ b/pkg/features/controller_features.go @@ -36,8 +36,6 @@ const ( // Edge Features - // ControllerAutoImpersonation enable the auto impersonation for controller (to use explicit identity for requests) - ControllerAutoImpersonation featuregate.Feature = "ControllerAutoImpersonation" // AuthenticateApplication enable the authentication for application AuthenticateApplication featuregate.Feature = "AuthenticateApplication" ) @@ -47,7 +45,6 @@ var defaultFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{ LegacyObjectTypeIdentifier: {Default: false, PreRelease: featuregate.Alpha}, DeprecatedObjectLabelSelector: {Default: false, PreRelease: featuregate.Alpha}, LegacyResourceTrackerGC: {Default: true, PreRelease: featuregate.Alpha}, - ControllerAutoImpersonation: {Default: true, PreRelease: featuregate.Alpha}, AuthenticateApplication: {Default: false, PreRelease: featuregate.Alpha}, } diff --git a/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler.go b/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler.go index 3e5d2c8f5..483777a12 100644 --- a/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler.go +++ b/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler.go @@ -30,7 +30,6 @@ import ( "sigs.k8s.io/controller-runtime/pkg/webhook" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" - "github.com/oam-dev/kubevela/apis/core.oam.dev/common" "github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1" "github.com/oam-dev/kubevela/pkg/auth" "github.com/oam-dev/kubevela/pkg/features" @@ -52,7 +51,7 @@ func (h *MutatingHandler) Handle(ctx context.Context, req admission.Request) adm return admission.Patched("") } - if slices.Contains(req.UserInfo.Groups, common.Group) || slices.Contains(h.skipUsers, req.UserInfo.Username) { + if slices.Contains(h.skipUsers, req.UserInfo.Username) { return admission.Patched("") } @@ -86,11 +85,9 @@ func (h *MutatingHandler) InjectDecoder(d *admission.Decoder) error { func RegisterMutatingHandler(mgr manager.Manager) { server := mgr.GetWebhookServer() handler := &MutatingHandler{} - if !utilfeature.DefaultMutableFeatureGate.Enabled(features.ControllerAutoImpersonation) { - if userInfo := utils.GetUserInfoFromConfig(mgr.GetConfig()); userInfo != nil { - klog.Infof("[ApplicationMutatingHandler] add skip user %s", userInfo.Username) - handler.skipUsers = []string{userInfo.Username} - } + if userInfo := utils.GetUserInfoFromConfig(mgr.GetConfig()); userInfo != nil { + klog.Infof("[ApplicationMutatingHandler] add skip user %s", userInfo.Username) + handler.skipUsers = []string{userInfo.Username} } server.Register("/mutating-core-oam-dev-v1beta1-applications", &webhook.Admission{Handler: handler}) }