github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix golint failures in pkg/kubeapiserver/options

Browse Source
This commit is contained in:
yiduyangyi 2020-07-15 15:22:22 +08:00
parent 633ab1ca61
commit e2838df7c7
5 changed files with 42 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hack/.golint_failures
View File

@ -93,7 +93,6 @@ pkg/controller/volume/persistentvolume
pkg/controller/volume/persistentvolume/config/v1alpha1 pkg/controller/volume/persistentvolume/config/v1alpha1
pkg/features pkg/features
pkg/kubeapiserver pkg/kubeapiserver
pkg/kubeapiserver/options
pkg/kubectl/cmd/convert pkg/kubectl/cmd/convert
pkg/kubelet/apis/config/v1beta1 pkg/kubelet/apis/config/v1beta1
pkg/kubelet/cm pkg/kubelet/cm

42
pkg/kubeapiserver/options/authentication.go
View File

@ -37,6 +37,7 @@ import (
cliflag "k8s.io/component-base/cli/flag" cliflag "k8s.io/component-base/cli/flag"
"k8s.io/klog/v2" "k8s.io/klog/v2"
openapicommon "k8s.io/kube-openapi/pkg/common" openapicommon "k8s.io/kube-openapi/pkg/common"
serviceaccountcontroller "k8s.io/kubernetes/pkg/controller/serviceaccount" serviceaccountcontroller "k8s.io/kubernetes/pkg/controller/serviceaccount"
"k8s.io/kubernetes/pkg/features" "k8s.io/kubernetes/pkg/features"
kubeauthenticator "k8s.io/kubernetes/pkg/kubeapiserver/authenticator" kubeauthenticator "k8s.io/kubernetes/pkg/kubeapiserver/authenticator"
@ -44,6 +45,7 @@ import (
"k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap" "k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/bootstrap"
) )
// BuiltInAuthenticationOptions contains all build-in authentication options for APIServer
type BuiltInAuthenticationOptions struct { type BuiltInAuthenticationOptions struct {
APIAudiences []string APIAudiences []string
Anonymous *AnonymousAuthenticationOptions Anonymous *AnonymousAuthenticationOptions
@ -59,14 +61,17 @@ type BuiltInAuthenticationOptions struct {
TokenFailureCacheTTL time.Duration TokenFailureCacheTTL time.Duration
} }
// AnonymousAuthenticationOptions contains anonymous authentication options for APIServer
type AnonymousAuthenticationOptions struct { type AnonymousAuthenticationOptions struct {
Allow bool Allow bool
} }
// BootstrapTokenAuthenticationOptions contains bootstrap token authentication options for APIServer
type BootstrapTokenAuthenticationOptions struct { type BootstrapTokenAuthenticationOptions struct {
Enable bool Enable bool
} }
// OIDCAuthenticationOptions contains OIDC authentication options for APIServer
type OIDCAuthenticationOptions struct { type OIDCAuthenticationOptions struct {
CAFile string CAFile string
ClientID string ClientID string
@ -79,6 +84,7 @@ type OIDCAuthenticationOptions struct {
RequiredClaims map[string]string RequiredClaims map[string]string
} }
// ServiceAccountAuthenticationOptions contains service account authentication options for APIServer
type ServiceAccountAuthenticationOptions struct { type ServiceAccountAuthenticationOptions struct {
KeyFiles []string KeyFiles []string
Lookup bool Lookup bool
@ -88,16 +94,19 @@ type ServiceAccountAuthenticationOptions struct {
ExtendExpiration bool ExtendExpiration bool
} }
// TokenFileAuthenticationOptions contains token file authentication options for APIServer
type TokenFileAuthenticationOptions struct { type TokenFileAuthenticationOptions struct {
TokenFile string TokenFile string
} }
// WebHookAuthenticationOptions contains web hook authentication options for APIServer
type WebHookAuthenticationOptions struct { type WebHookAuthenticationOptions struct {
ConfigFile string ConfigFile string
Version string Version string
CacheTTL time.Duration CacheTTL time.Duration
} }
// NewBuiltInAuthenticationOptions create a new BuiltInAuthenticationOptions, just set default token cache TTL
func NewBuiltInAuthenticationOptions() *BuiltInAuthenticationOptions { func NewBuiltInAuthenticationOptions() *BuiltInAuthenticationOptions {
return &BuiltInAuthenticationOptions{ return &BuiltInAuthenticationOptions{
TokenSuccessCacheTTL: 10 * time.Second, TokenSuccessCacheTTL: 10 * time.Second,
@ -105,6 +114,7 @@ func NewBuiltInAuthenticationOptions() *BuiltInAuthenticationOptions {
} }
} }
// WithAll set default value for every build-in authentication option
func (s *BuiltInAuthenticationOptions) WithAll() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithAll() *BuiltInAuthenticationOptions {
return s. return s.
WithAnonymous(). WithAnonymous().
@ -117,41 +127,49 @@ func (s *BuiltInAuthenticationOptions) WithAll() *BuiltInAuthenticationOptions {
WithWebHook() WithWebHook()
} }
// WithAnonymous set default value for anonymous authentication
func (s *BuiltInAuthenticationOptions) WithAnonymous() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithAnonymous() *BuiltInAuthenticationOptions {
s.Anonymous = &AnonymousAuthenticationOptions{Allow: true} s.Anonymous = &AnonymousAuthenticationOptions{Allow: true}
return s return s
} }
// WithBootstrapToken set default value for bootstrap token authentication
func (s *BuiltInAuthenticationOptions) WithBootstrapToken() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithBootstrapToken() *BuiltInAuthenticationOptions {
s.BootstrapToken = &BootstrapTokenAuthenticationOptions{} s.BootstrapToken = &BootstrapTokenAuthenticationOptions{}
return s return s
} }
// WithClientCert set default value for client cert
func (s *BuiltInAuthenticationOptions) WithClientCert() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithClientCert() *BuiltInAuthenticationOptions {
s.ClientCert = &genericoptions.ClientCertAuthenticationOptions{} s.ClientCert = &genericoptions.ClientCertAuthenticationOptions{}
return s return s
} }
// WithOIDC set default value for OIDC authentication
func (s *BuiltInAuthenticationOptions) WithOIDC() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithOIDC() *BuiltInAuthenticationOptions {
s.OIDC = &OIDCAuthenticationOptions{} s.OIDC = &OIDCAuthenticationOptions{}
return s return s
} }
// WithRequestHeader set default value for request header authentication
func (s *BuiltInAuthenticationOptions) WithRequestHeader() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithRequestHeader() *BuiltInAuthenticationOptions {
s.RequestHeader = &genericoptions.RequestHeaderAuthenticationOptions{} s.RequestHeader = &genericoptions.RequestHeaderAuthenticationOptions{}
return s return s
} }
// WithServiceAccounts set default value for service account authentication
func (s *BuiltInAuthenticationOptions) WithServiceAccounts() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithServiceAccounts() *BuiltInAuthenticationOptions {
s.ServiceAccounts = &ServiceAccountAuthenticationOptions{Lookup: true} s.ServiceAccounts = &ServiceAccountAuthenticationOptions{Lookup: true}
return s return s
} }
// WithTokenFile set default value for token file authentication
func (s *BuiltInAuthenticationOptions) WithTokenFile() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithTokenFile() *BuiltInAuthenticationOptions {
s.TokenFile = &TokenFileAuthenticationOptions{} s.TokenFile = &TokenFileAuthenticationOptions{}
return s return s
} }
// WithWebHook set default value for web hook authentication
func (s *BuiltInAuthenticationOptions) WithWebHook() *BuiltInAuthenticationOptions { func (s *BuiltInAuthenticationOptions) WithWebHook() *BuiltInAuthenticationOptions {
s.WebHook = &WebHookAuthenticationOptions{ s.WebHook = &WebHookAuthenticationOptions{
Version: "v1beta1", Version: "v1beta1",
@ -205,6 +223,7 @@ func (s *BuiltInAuthenticationOptions) Validate() []error {
return allErrors return allErrors
} }
// AddFlags returns flags of authentication for a APIServer
func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) { func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
fs.StringSliceVar(&s.APIAudiences, "api-audiences", s.APIAudiences, ""+ fs.StringSliceVar(&s.APIAudiences, "api-audiences", s.APIAudiences, ""+
"Identifiers of the API. The service account token authenticator will validate that "+ "Identifiers of the API. The service account token authenticator will validate that "+
@ -339,6 +358,7 @@ func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
} }
} }
// ToAuthenticationConfig convert BuiltInAuthenticationOptions to kubeauthenticator.Config
func (s *BuiltInAuthenticationOptions) ToAuthenticationConfig() (kubeauthenticator.Config, error) { func (s *BuiltInAuthenticationOptions) ToAuthenticationConfig() (kubeauthenticator.Config, error) {
ret := kubeauthenticator.Config{ ret := kubeauthenticator.Config{
TokenSuccessCacheTTL: s.TokenSuccessCacheTTL, TokenSuccessCacheTTL: s.TokenSuccessCacheTTL,
@ -414,8 +434,8 @@ func (s *BuiltInAuthenticationOptions) ToAuthenticationConfig() (kubeauthenticat
} }
// ApplyTo requires already applied OpenAPIConfig and EgressSelector if present. // ApplyTo requires already applied OpenAPIConfig and EgressSelector if present.
func (o *BuiltInAuthenticationOptions) ApplyTo(authInfo *genericapiserver.AuthenticationInfo, secureServing *genericapiserver.SecureServingInfo, egressSelector *egressselector.EgressSelector, openAPIConfig *openapicommon.Config, extclient kubernetes.Interface, versionedInformer informers.SharedInformerFactory) error { func (s *BuiltInAuthenticationOptions) ApplyTo(authInfo *genericapiserver.AuthenticationInfo, secureServing *genericapiserver.SecureServingInfo, egressSelector *egressselector.EgressSelector, openAPIConfig *openapicommon.Config, extclient kubernetes.Interface, versionedInformer informers.SharedInformerFactory) error {
if o == nil { if s == nil {
return nil return nil
} }
@ -423,7 +443,7 @@ func (o *BuiltInAuthenticationOptions) ApplyTo(authInfo *genericapiserver.Authen
return errors.New("uninitialized OpenAPIConfig") return errors.New("uninitialized OpenAPIConfig")
} }
authenticatorConfig, err := o.ToAuthenticationConfig() authenticatorConfig, err := s.ToAuthenticationConfig()
if err != nil { if err != nil {
return err return err
} }
@ -439,12 +459,12 @@ func (o *BuiltInAuthenticationOptions) ApplyTo(authInfo *genericapiserver.Authen
} }
} }
authInfo.APIAudiences = o.APIAudiences authInfo.APIAudiences = s.APIAudiences
if o.ServiceAccounts != nil && o.ServiceAccounts.Issuer != "" && len(o.APIAudiences) == 0 { if s.ServiceAccounts != nil && s.ServiceAccounts.Issuer != "" && len(s.APIAudiences) == 0 {
authInfo.APIAudiences = authenticator.Audiences{o.ServiceAccounts.Issuer} authInfo.APIAudiences = authenticator.Audiences{s.ServiceAccounts.Issuer}
} }
if o.ServiceAccounts.Lookup || utilfeature.DefaultFeatureGate.Enabled(features.TokenRequest) { if s.ServiceAccounts.Lookup || utilfeature.DefaultFeatureGate.Enabled(features.TokenRequest) {
authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromClient( authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromClient(
extclient, extclient,
versionedInformer.Core().V1().Secrets().Lister(), versionedInformer.Core().V1().Secrets().Lister(),
@ -473,15 +493,15 @@ func (o *BuiltInAuthenticationOptions) ApplyTo(authInfo *genericapiserver.Authen
} }
// ApplyAuthorization will conditionally modify the authentication options based on the authorization options // ApplyAuthorization will conditionally modify the authentication options based on the authorization options
func (o *BuiltInAuthenticationOptions) ApplyAuthorization(authorization *BuiltInAuthorizationOptions) { func (s *BuiltInAuthenticationOptions) ApplyAuthorization(authorization *BuiltInAuthorizationOptions) {
if o == nil || authorization == nil || o.Anonymous == nil { if s == nil || authorization == nil || s.Anonymous == nil {
return return
} }
// authorization ModeAlwaysAllow cannot be combined with AnonymousAuth. // authorization ModeAlwaysAllow cannot be combined with AnonymousAuth.
// in such a case the AnonymousAuth is stomped to false and you get a message // in such a case the AnonymousAuth is stomped to false and you get a message
if o.Anonymous.Allow && sets.NewString(authorization.Modes...).Has(authzmodes.ModeAlwaysAllow) { if s.Anonymous.Allow && sets.NewString(authorization.Modes...).Has(authzmodes.ModeAlwaysAllow) {
klog.Warningf("AnonymousAuth is not allowed with the AlwaysAllow authorizer. Resetting AnonymousAuth to false. You should use a different authorizer") klog.Warningf("AnonymousAuth is not allowed with the AlwaysAllow authorizer. Resetting AnonymousAuth to false. You should use a different authorizer")
o.Anonymous.Allow = false s.Anonymous.Allow = false
} }
} }

5
pkg/kubeapiserver/options/authorization.go
View File

@ -29,6 +29,7 @@ import (
authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes" authzmodes "k8s.io/kubernetes/pkg/kubeapiserver/authorizer/modes"
) )
// BuiltInAuthorizationOptions contains all build-in authorization options for APIServer
type BuiltInAuthorizationOptions struct { type BuiltInAuthorizationOptions struct {
Modes []string Modes []string
PolicyFile string PolicyFile string
@ -38,6 +39,7 @@ type BuiltInAuthorizationOptions struct {
WebhookCacheUnauthorizedTTL time.Duration WebhookCacheUnauthorizedTTL time.Duration
} }
// NewBuiltInAuthorizationOptions create a BuiltInAuthorizationOptions with default value
func NewBuiltInAuthorizationOptions() *BuiltInAuthorizationOptions { func NewBuiltInAuthorizationOptions() *BuiltInAuthorizationOptions {
return &BuiltInAuthorizationOptions{ return &BuiltInAuthorizationOptions{
Modes: []string{authzmodes.ModeAlwaysAllow}, Modes: []string{authzmodes.ModeAlwaysAllow},
@ -47,6 +49,7 @@ func NewBuiltInAuthorizationOptions() *BuiltInAuthorizationOptions {
} }
} }
// Validate checks invalid config combination
func (s *BuiltInAuthorizationOptions) Validate() []error { func (s *BuiltInAuthorizationOptions) Validate() []error {
if s == nil { if s == nil {
return nil return nil
@ -89,6 +92,7 @@ func (s *BuiltInAuthorizationOptions) Validate() []error {
return allErrors return allErrors
} }
// AddFlags returns flags of authorization for a APIServer
func (s *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) { func (s *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) {
fs.StringSliceVar(&s.Modes, "authorization-mode", s.Modes, ""+ fs.StringSliceVar(&s.Modes, "authorization-mode", s.Modes, ""+
"Ordered list of plug-ins to do authorization on secure port. Comma-delimited list of: "+ "Ordered list of plug-ins to do authorization on secure port. Comma-delimited list of: "+
@ -113,6 +117,7 @@ func (s *BuiltInAuthorizationOptions) AddFlags(fs *pflag.FlagSet) {
"The duration to cache 'unauthorized' responses from the webhook authorizer.") "The duration to cache 'unauthorized' responses from the webhook authorizer.")
} }
// ToAuthorizationConfig convert BuiltInAuthorizationOptions to authorizer.Config
func (s *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) authorizer.Config { func (s *BuiltInAuthorizationOptions) ToAuthorizationConfig(versionedInformerFactory versionedinformers.SharedInformerFactory) authorizer.Config {
return authorizer.Config{ return authorizer.Config{
AuthorizationModes: s.Modes, AuthorizationModes: s.Modes,

4
pkg/kubeapiserver/options/cloudprovider.go
View File

@ -20,20 +20,24 @@ import (
"github.com/spf13/pflag" "github.com/spf13/pflag"
) )
// CloudProviderOptions contains cloud provider config
type CloudProviderOptions struct { type CloudProviderOptions struct {
CloudConfigFile string CloudConfigFile string
CloudProvider string CloudProvider string
} }
// NewCloudProviderOptions create a default CloudProviderOptions
func NewCloudProviderOptions() *CloudProviderOptions { func NewCloudProviderOptions() *CloudProviderOptions {
return &CloudProviderOptions{} return &CloudProviderOptions{}
} }
// Validate checks invalid config
func (s *CloudProviderOptions) Validate() []error { func (s *CloudProviderOptions) Validate() []error {
allErrors := []error{} allErrors := []error{}
return allErrors return allErrors
} }
// AddFlags returns flags of cloud provider for a APIServer
func (s *CloudProviderOptions) AddFlags(fs *pflag.FlagSet) { func (s *CloudProviderOptions) AddFlags(fs *pflag.FlagSet) {
fs.StringVar(&s.CloudProvider, "cloud-provider", s.CloudProvider, fs.StringVar(&s.CloudProvider, "cloud-provider", s.CloudProvider,
"The provider for cloud services. Empty string for no provider.") "The provider for cloud services. Empty string for no provider.")

3
pkg/kubeapiserver/options/options.go
View File

@ -26,6 +26,7 @@ import (
var DefaultServiceNodePortRange = utilnet.PortRange{Base: 30000, Size: 2768} var DefaultServiceNodePortRange = utilnet.PortRange{Base: 30000, Size: 2768}
// DefaultServiceIPCIDR is a CIDR notation of IP range from which to allocate service cluster IPs // DefaultServiceIPCIDR is a CIDR notation of IP range from which to allocate service cluster IPs
var DefaultServiceIPCIDR net.IPNet = net.IPNet{IP: net.ParseIP("10.0.0.0"), Mask: net.CIDRMask(24, 32)} var DefaultServiceIPCIDR = net.IPNet{IP: net.ParseIP("10.0.0.0"), Mask: net.CIDRMask(24, 32)}
// DefaultEtcdPathPrefix is the default key prefix of etcd for APIServer
const DefaultEtcdPathPrefix = "/registry" const DefaultEtcdPathPrefix = "/registry"