mirror of
https://github.com/openshift/community.okd.git
synced 2026-03-26 19:03:14 +00:00
openshift admin prune auth (#130)
* openshift admin prune auth * update change scope
This commit is contained in:
abikouo
GitHub
335
plugins/module_utils/openshift_adm_prune_auth.py
Normal file
335
plugins/module_utils/openshift_adm_prune_auth.py
Normal file
@@ -0,0 +1,335 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
import traceback
|
||||
|
||||
from ansible.module_utils._text import to_native
|
||||
|
||||
try:
|
||||
from ansible_collections.kubernetes.core.plugins.module_utils.common import (
|
||||
K8sAnsibleMixin,
|
||||
get_api_client,
|
||||
)
|
||||
HAS_KUBERNETES_COLLECTION = True
|
||||
except ImportError as e:
|
||||
HAS_KUBERNETES_COLLECTION = False
|
||||
k8s_collection_import_exception = e
|
||||
K8S_COLLECTION_ERROR = traceback.format_exc()
|
||||
|
||||
try:
|
||||
from kubernetes import client
|
||||
from kubernetes.dynamic.exceptions import DynamicApiError, NotFoundError
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
|
||||
class OpenShiftAdmPruneAuth(K8sAnsibleMixin):
|
||||
def __init__(self, module):
|
||||
self.module = module
|
||||
self.fail_json = self.module.fail_json
|
||||
self.exit_json = self.module.exit_json
|
||||
|
||||
if not HAS_KUBERNETES_COLLECTION:
|
||||
self.module.fail_json(
|
||||
msg="The kubernetes.core collection must be installed",
|
||||
exception=K8S_COLLECTION_ERROR,
|
||||
error=to_native(k8s_collection_import_exception),
|
||||
)
|
||||
|
||||
super(OpenShiftAdmPruneAuth, self).__init__(self.module)
|
||||
|
||||
self.params = self.module.params
|
||||
self.check_mode = self.module.check_mode
|
||||
self.client = get_api_client(self.module)
|
||||
|
||||
def prune_resource_binding(self, kind, api_version, ref_kind, ref_namespace_names, propagation_policy=None):
|
||||
|
||||
resource = self.find_resource(kind=kind, api_version=api_version, fail=True)
|
||||
candidates = []
|
||||
for ref_namespace, ref_name in ref_namespace_names:
|
||||
try:
|
||||
result = resource.get(name=None, namespace=ref_namespace)
|
||||
result = result.to_dict()
|
||||
result = result.get('items') if 'items' in result else [result]
|
||||
for obj in result:
|
||||
namespace = obj['metadata'].get('namespace', None)
|
||||
name = obj['metadata'].get('name')
|
||||
if ref_kind and obj['roleRef']['kind'] != ref_kind:
|
||||
# skip this binding as the roleRef.kind does not match
|
||||
continue
|
||||
if obj['roleRef']['name'] == ref_name:
|
||||
# select this binding as the roleRef.name match
|
||||
candidates.append((namespace, name))
|
||||
except NotFoundError:
|
||||
continue
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to get {kind} resource due to: {msg}".format(kind=kind, msg=exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
except Exception as e:
|
||||
msg = "Failed to get {kind} due to: {msg}".format(kind=kind, msg=to_native(e))
|
||||
self.fail_json(msg=msg)
|
||||
|
||||
if len(candidates) == 0 or self.check_mode:
|
||||
return [y if x is None else x + "/" + y for x, y in candidates]
|
||||
|
||||
delete_options = client.V1DeleteOptions()
|
||||
if propagation_policy:
|
||||
delete_options.propagation_policy = propagation_policy
|
||||
|
||||
for namespace, name in candidates:
|
||||
try:
|
||||
result = resource.delete(name=name, namespace=namespace, body=delete_options)
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to delete {kind} {namespace}/{name} due to: {msg}".format(kind=kind, namespace=namespace, name=name, msg=exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
except Exception as e:
|
||||
msg = "Failed to delete {kind} {namespace}/{name} due to: {msg}".format(kind=kind, namespace=namespace, name=name, msg=to_native(e))
|
||||
self.fail_json(msg=msg)
|
||||
return [y if x is None else x + "/" + y for x, y in candidates]
|
||||
|
||||
def update_resource_binding(self, ref_kind, ref_names, namespaced=False):
|
||||
|
||||
kind = 'ClusterRoleBinding'
|
||||
api_version = "rbac.authorization.k8s.io/v1",
|
||||
if namespaced:
|
||||
kind = "RoleBinding"
|
||||
resource = self.find_resource(kind=kind, api_version=api_version, fail=True)
|
||||
result = resource.get(name=None, namespace=None).to_dict()
|
||||
result = result.get('items') if 'items' in result else [result]
|
||||
|
||||
if len(result) == 0:
|
||||
return [], False
|
||||
|
||||
def _update_user_group(binding_namespace, subjects):
|
||||
users, groups = [], []
|
||||
for x in subjects:
|
||||
if x['kind'] == 'User':
|
||||
users.append(x['name'])
|
||||
elif x['kind'] == 'Group':
|
||||
groups.append(x['name'])
|
||||
elif x['kind'] == 'ServiceAccount':
|
||||
namespace = binding_namespace
|
||||
if x.get('namespace') is not None:
|
||||
namespace = x.get('namespace')
|
||||
if namespace is not None:
|
||||
users.append("system:serviceaccount:%s:%s" % (namespace, x['name']))
|
||||
return users, groups
|
||||
|
||||
candidates = []
|
||||
changed = False
|
||||
for item in result:
|
||||
subjects = item.get('subjects', [])
|
||||
retainedSubjects = [x for x in subjects if x['kind'] == ref_kind and x['name'] in ref_names]
|
||||
if len(subjects) != len(retainedSubjects):
|
||||
updated_binding = item
|
||||
updated_binding['subjects'] = retainedSubjects
|
||||
binding_namespace = item['metadata'].get('namespace', None)
|
||||
updated_binding['userNames'], updated_binding['groupNames'] = _update_user_group(binding_namespace, retainedSubjects)
|
||||
candidates.append(binding_namespace + "/" + item['metadata']['name'] if binding_namespace else item['metadata']['name'])
|
||||
changed = True
|
||||
if not self.check_mode:
|
||||
try:
|
||||
resource.apply(updated_binding, namespace=binding_namespace)
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to apply object due to: {0}".format(exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
return candidates, changed
|
||||
|
||||
def update_security_context(self, ref_names, key):
|
||||
params = {'kind': 'SecurityContextConstraints', 'api_version': 'security.openshift.io/v1'}
|
||||
sccs = self.kubernetes_facts(**params)
|
||||
if not sccs['api_found']:
|
||||
self.fail_json(msg=sccs['msg'])
|
||||
sccs = sccs.get('resources')
|
||||
|
||||
candidates = []
|
||||
changed = False
|
||||
resource = self.find_resource(kind="SecurityContextConstraints", api_version="security.openshift.io/v1")
|
||||
for item in sccs:
|
||||
subjects = item.get(key, [])
|
||||
retainedSubjects = [x for x in subjects if x not in ref_names]
|
||||
if len(subjects) != len(retainedSubjects):
|
||||
candidates.append(item['metadata']['name'])
|
||||
changed = True
|
||||
if not self.check_mode:
|
||||
upd_sec_ctx = item
|
||||
upd_sec_ctx.update({key: retainedSubjects})
|
||||
try:
|
||||
resource.apply(upd_sec_ctx, namespace=None)
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to apply object due to: {0}".format(exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
return candidates, changed
|
||||
|
||||
def auth_prune_roles(self):
|
||||
params = {'kind': 'Role', 'api_version': 'rbac.authorization.k8s.io/v1', 'namespace': self.params.get('namespace')}
|
||||
for attr in ('name', 'label_selectors'):
|
||||
if self.params.get(attr):
|
||||
params[attr] = self.params.get(attr)
|
||||
|
||||
result = self.kubernetes_facts(**params)
|
||||
if not result['api_found']:
|
||||
self.fail_json(msg=result['msg'])
|
||||
|
||||
roles = result.get('resources')
|
||||
if len(roles) == 0:
|
||||
self.exit_json(changed=False, msg="No candidate rolebinding to prune from namespace %s." % self.params.get('namespace'))
|
||||
|
||||
ref_roles = [(x['metadata']['namespace'], x['metadata']['name']) for x in roles]
|
||||
candidates = self.prune_resource_binding(kind="RoleBinding",
|
||||
api_version="rbac.authorization.k8s.io/v1",
|
||||
ref_kind="Role",
|
||||
ref_namespace_names=ref_roles,
|
||||
propagation_policy='Foreground')
|
||||
if len(candidates) == 0:
|
||||
self.exit_json(changed=False, role_binding=candidates)
|
||||
|
||||
self.exit_json(changed=True, role_binding=candidates)
|
||||
|
||||
def auth_prune_clusterroles(self):
|
||||
params = {'kind': 'ClusterRole', 'api_version': 'rbac.authorization.k8s.io/v1'}
|
||||
for attr in ('name', 'label_selectors'):
|
||||
if self.params.get(attr):
|
||||
params[attr] = self.params.get(attr)
|
||||
|
||||
result = self.kubernetes_facts(**params)
|
||||
if not result['api_found']:
|
||||
self.fail_json(msg=result['msg'])
|
||||
|
||||
clusterroles = result.get('resources')
|
||||
if len(clusterroles) == 0:
|
||||
self.exit_json(changed=False, msg="No clusterroles found matching input criteria.")
|
||||
|
||||
ref_clusterroles = [(None, x['metadata']['name']) for x in clusterroles]
|
||||
|
||||
# Prune ClusterRoleBinding
|
||||
candidates_cluster_binding = self.prune_resource_binding(kind="ClusterRoleBinding",
|
||||
api_version="rbac.authorization.k8s.io/v1",
|
||||
ref_kind=None,
|
||||
ref_namespace_names=ref_clusterroles)
|
||||
|
||||
# Prune Role Binding
|
||||
candidates_namespaced_binding = self.prune_resource_binding(kind="RoleBinding",
|
||||
api_version="rbac.authorization.k8s.io/v1",
|
||||
ref_kind='ClusterRole',
|
||||
ref_namespace_names=ref_clusterroles)
|
||||
|
||||
self.exit_json(changed=True,
|
||||
cluster_role_binding=candidates_cluster_binding,
|
||||
role_binding=candidates_namespaced_binding)
|
||||
|
||||
def list_groups(self, params=None):
|
||||
options = {'kind': 'Group', 'api_version': 'user.openshift.io/v1'}
|
||||
if params:
|
||||
for attr in ('name', 'label_selectors'):
|
||||
if params.get(attr):
|
||||
options[attr] = params.get(attr)
|
||||
return self.kubernetes_facts(**options)
|
||||
|
||||
def auth_prune_users(self):
|
||||
params = {'kind': 'User', 'api_version': 'user.openshift.io/v1'}
|
||||
for attr in ('name', 'label_selectors'):
|
||||
if self.params.get(attr):
|
||||
params[attr] = self.params.get(attr)
|
||||
|
||||
users = self.kubernetes_facts(**params)
|
||||
if len(users) == 0:
|
||||
self.exit_json(changed=False, msg="No resource type 'User' found matching input criteria.")
|
||||
|
||||
names = [x['metadata']['name'] for x in users]
|
||||
changed = False
|
||||
# Remove the user role binding
|
||||
rolebinding, changed_role = self.update_resource_binding(ref_kind="User",
|
||||
ref_names=names,
|
||||
namespaced=True)
|
||||
changed = changed or changed_role
|
||||
# Remove the user cluster role binding
|
||||
clusterrolesbinding, changed_cr = self.update_resource_binding(ref_kind="User",
|
||||
ref_names=names)
|
||||
changed = changed or changed_cr
|
||||
|
||||
# Remove the user from security context constraints
|
||||
sccs, changed_sccs = self.update_security_context(names, 'users')
|
||||
changed = changed or changed_sccs
|
||||
|
||||
# Remove the user from groups
|
||||
groups = self.list_groups()
|
||||
deleted_groups = []
|
||||
resource = self.find_resource(kind="Group", api_version="user.openshift.io/v1")
|
||||
for grp in groups:
|
||||
subjects = grp.get('users', [])
|
||||
retainedSubjects = [x for x in subjects if x not in names]
|
||||
if len(subjects) != len(retainedSubjects):
|
||||
deleted_groups.append(grp['metadata']['name'])
|
||||
changed = True
|
||||
if not self.check_mode:
|
||||
upd_group = grp
|
||||
upd_group.update({'users': retainedSubjects})
|
||||
try:
|
||||
resource.apply(upd_group, namespace=None)
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to apply object due to: {0}".format(exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
|
||||
# Remove the user's OAuthClientAuthorizations
|
||||
oauth = self.kubernetes_facts(kind='OAuthClientAuthorization', api_version='oauth.openshift.io/v1')
|
||||
deleted_auths = []
|
||||
resource = self.find_resource(kind="OAuthClientAuthorization", api_version="oauth.openshift.io/v1")
|
||||
for authorization in oauth:
|
||||
if authorization.get('userName', None) in names:
|
||||
auth_name = authorization['metadata']['name']
|
||||
deleted_auths.append(auth_name)
|
||||
changed = True
|
||||
if not self.check_mode:
|
||||
try:
|
||||
resource.delete(name=auth_name, namespace=None, body=client.V1DeleteOptions())
|
||||
except DynamicApiError as exc:
|
||||
msg = "Failed to delete OAuthClientAuthorization {name} due to: {msg}".format(name=auth_name, msg=exc.body)
|
||||
self.fail_json(msg=msg)
|
||||
except Exception as e:
|
||||
msg = "Failed to delete OAuthClientAuthorization {name} due to: {msg}".format(name=auth_name, msg=to_native(e))
|
||||
self.fail_json(msg=msg)
|
||||
|
||||
self.exit_json(changed=changed,
|
||||
cluster_role_binding=clusterrolesbinding,
|
||||
role_binding=rolebinding,
|
||||
security_context_constraints=sccs,
|
||||
authorization=deleted_auths,
|
||||
group=deleted_groups)
|
||||
|
||||
def auth_prune_groups(self):
|
||||
groups = self.list_groups(params=self.params)
|
||||
if len(groups) == 0:
|
||||
self.exit_json(changed=False, result="No resource type 'Group' found matching input criteria.")
|
||||
|
||||
names = [x['metadata']['name'] for x in groups]
|
||||
|
||||
changed = False
|
||||
# Remove the groups role binding
|
||||
rolebinding, changed_role = self.update_resource_binding(ref_kind="Group",
|
||||
ref_names=names,
|
||||
namespaced=True)
|
||||
changed = changed or changed_role
|
||||
# Remove the groups cluster role binding
|
||||
clusterrolesbinding, changed_cr = self.update_resource_binding(ref_kind="Group",
|
||||
ref_names=names)
|
||||
changed = changed or changed_cr
|
||||
# Remove the groups security context constraints
|
||||
sccs, changed_sccs = self.update_security_context(names, 'groups')
|
||||
changed = changed or changed_sccs
|
||||
|
||||
self.exit_json(changed=changed,
|
||||
cluster_role_binding=clusterrolesbinding,
|
||||
role_binding=rolebinding,
|
||||
security_context_constraints=sccs)
|
||||
|
||||
def execute_module(self):
|
||||
auth_prune = {
|
||||
'roles': self.auth_prune_roles,
|
||||
'clusterroles': self.auth_prune_clusterroles,
|
||||
'users': self.auth_prune_users,
|
||||
'groups': self.auth_prune_groups,
|
||||
}
|
||||
auth_prune[self.params.get('resource')]()
|
||||
Reference in New Issue
Block a user