mirror of
https://github.com/dapr/dapr.git
synced 2026-10-28 08:35:25 +08:00
Add components namespace and id scopes (#1200)
* add components namespace and id scopes * remove wrong output dir * linter * fix typo
This commit is contained in:
Yaron Schneider authored and GitHub committed
1 parent
db85f76bdc
commit
3f1e286833
7 files changed
+183
-7
No files matched your search
@@ -12,6 +12,7 @@ require (
|
||||
github.com/dapr/go-sdk v0.0.0-20200121181907-48249cda2fad
|
||||
github.com/fsnotify/fsnotify v1.4.7
|
||||
github.com/ghodss/yaml v1.0.0
|
||||
github.com/gogo/protobuf v1.3.1 // indirect
|
||||
github.com/golang/mock v1.4.0
|
||||
github.com/golang/protobuf v1.3.3
|
||||
github.com/google/uuid v1.1.1
|
||||
@@ -36,18 +37,20 @@ require (
|
||||
github.com/tidwall/pretty v1.0.1 // indirect
|
||||
github.com/tmc/grpc-websocket-proxy v0.0.0-20200122045848-3419fae592fc // indirect
|
||||
github.com/valyala/fasthttp v1.6.0
|
||||
go.etcd.io/etcd v3.3.17+incompatible
|
||||
go.opencensus.io v0.22.3
|
||||
google.golang.org/grpc v1.26.0
|
||||
gopkg.in/couchbase/gocbcore.v7 v7.1.16 // indirect
|
||||
gopkg.in/couchbaselabs/gojcbmock.v1 v1.0.4 // indirect
|
||||
gopkg.in/yaml.v2 v2.2.7
|
||||
gopkg.in/yaml.v2 v2.2.8
|
||||
k8s.io/api v0.17.0
|
||||
k8s.io/apimachinery v0.17.0
|
||||
k8s.io/cli-runtime v0.17.0
|
||||
k8s.io/client-go v0.17.0
|
||||
k8s.io/code-generator v0.0.0-20190912042602-ebc0eb3a5c23
|
||||
k8s.io/code-generator v0.17.3
|
||||
k8s.io/gengo v0.0.0-20200114144118-36b2048a9120 // indirect
|
||||
k8s.io/klog v1.0.0
|
||||
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c // indirect
|
||||
sigs.k8s.io/yaml v1.2.0 // indirect
|
||||
)
|
||||
|
||||
replace (
|
||||
|
||||
@@ -276,6 +276,8 @@ github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09Vjb
|
||||
github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
|
||||
github.com/gogo/protobuf v1.3.0 h1:G8O7TerXerS4F6sx9OV7/nRfJdnXgHZu/S/7F2SN+UE=
|
||||
github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
|
||||
github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
|
||||
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
|
||||
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
|
||||
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
|
||||
github.com/golang/gddo v0.0.0-20190815223733-287de01127ef h1:4NNI5xhPnmBogD0yj/BV20wSHOg+7YcxX+JyX1tGVn8=
|
||||
@@ -898,6 +900,7 @@ golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgw
|
||||
golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
|
||||
golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200117161641-43d50277825c h1:2EA2K0k9bcvvEDlqD8xdlOhCOqq+O/p9Voqi4x9W1YU=
|
||||
@@ -1004,6 +1007,8 @@ gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
|
||||
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
|
||||
gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
|
||||
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
@@ -1025,9 +1030,13 @@ k8s.io/client-go v0.17.0 h1:8QOGvUGdqDMFrm9sD6IUFl256BcffynGoe80sxgTEDg=
|
||||
k8s.io/client-go v0.17.0/go.mod h1:TYgR6EUHs6k45hb6KWjVD6jFZvJV4gHDikv/It0xz+k=
|
||||
k8s.io/code-generator v0.0.0-20190912042602-ebc0eb3a5c23 h1:2oyDSO/D/4/bch5ZhL+sF5CPxO0GMrXhsIKFFOV6/uo=
|
||||
k8s.io/code-generator v0.0.0-20190912042602-ebc0eb3a5c23/go.mod h1:V5BD6M4CyaN5m+VthcclXWsVcT1Hu+glwa1bi3MIsyE=
|
||||
k8s.io/code-generator v0.17.3 h1:q/hDMk2cvFzSxol7k/VA1qCssR7VSMXHQHhzuX29VJ8=
|
||||
k8s.io/code-generator v0.17.3/go.mod h1:l8BLVwASXQZTo2xamW5mQNFCe1XPiAesVq7Y1t7PiQQ=
|
||||
k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
|
||||
k8s.io/gengo v0.0.0-20190822140433-26a664648505 h1:ZY6yclUKVbZ+SdWnkfY+Je5vrMpKOxmGeKRbsXVmqYM=
|
||||
k8s.io/gengo v0.0.0-20190822140433-26a664648505/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
|
||||
k8s.io/gengo v0.0.0-20200114144118-36b2048a9120 h1:RPscN6KhmG54S33L+lr3GS+oD1jmchIU0ll519K6FA4=
|
||||
k8s.io/gengo v0.0.0-20200114144118-36b2048a9120/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
|
||||
k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
|
||||
k8s.io/klog v0.3.0 h1:0VPpR+sizsiivjIfIAQH/rl8tan6jvWkS7lU+0di3lE=
|
||||
k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
|
||||
@@ -1041,6 +1050,8 @@ k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf h1:EYm5AW/UUDbnmnI+gK0TJD
|
||||
k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
|
||||
k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a h1:UcxjrRMyNx/i/y8G7kPvLyy7rfbeuf1PYyBf973pgyU=
|
||||
k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
|
||||
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c h1:/KUFqjjqAcY4Us6luF5RDNZ16KJtb49HfR3ZHB9qYXM=
|
||||
k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
|
||||
k8s.io/utils v0.0.0-20190221042446-c2654d5206da/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
|
||||
k8s.io/utils v0.0.0-20191114184206-e782cd3c129f h1:GiPwtSzdP43eI1hpPCbROQCCIgCuiMMNF8YUVLF3vJo=
|
||||
k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
|
||||
@@ -1060,5 +1071,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
|
||||
sigs.k8s.io/kustomize v2.0.3+incompatible h1:JUufWFNlI44MdtnjUqVnvh29rR37PQFzPbLXqhyOyX0=
|
||||
sigs.k8s.io/kustomize v2.0.3+incompatible/go.mod h1:MkjgH3RdOWrievjo6c9T245dYlB5QeXV4WCbnt/PEpU=
|
||||
sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
|
||||
sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
|
||||
sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
|
||||
sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
|
||||
sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
|
||||
sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
|
||||
@@ -22,6 +22,8 @@ type Component struct {
|
||||
Spec ComponentSpec `json:"spec,omitempty"`
|
||||
// +optional
|
||||
Auth `json:"auth,omitempty"`
|
||||
// +optional
|
||||
Scopes []string `json:"scopes,omitempty"`
|
||||
}
|
||||
|
||||
// ComponentSpec is the spec for a component
|
||||
|
||||
+34
-3
@@ -90,6 +90,7 @@ type DaprRuntime struct {
|
||||
actorStateStoreName string
|
||||
actorStateStoreCount int
|
||||
authenticator security.Authenticator
|
||||
namespace string
|
||||
}
|
||||
|
||||
// NewDaprRuntime returns a new runtime with the given runtime config and global config
|
||||
@@ -140,11 +141,16 @@ func (a *DaprRuntime) Run(opts ...Option) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *DaprRuntime) getNamespace() string {
|
||||
return os.Getenv("NAMESPACE")
|
||||
}
|
||||
|
||||
func (a *DaprRuntime) initRuntime(opts *runtimeOpts) error {
|
||||
err := a.establishSecurity(a.runtimeConfig.ID, a.runtimeConfig.SentryServiceAddress)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
a.namespace = a.getNamespace()
|
||||
|
||||
err = a.loadComponents(opts)
|
||||
if err != nil {
|
||||
@@ -289,7 +295,7 @@ func (a *DaprRuntime) beginReadInputBindings() error {
|
||||
func (a *DaprRuntime) initDirectMessaging(resolver servicediscovery.Resolver) {
|
||||
a.directMessaging = messaging.NewDirectMessaging(
|
||||
a.runtimeConfig.ID,
|
||||
os.Getenv("NAMESPACE"),
|
||||
a.namespace,
|
||||
a.runtimeConfig.GRPCPort,
|
||||
a.runtimeConfig.Mode,
|
||||
a.appChannel,
|
||||
@@ -337,7 +343,7 @@ func (a *DaprRuntime) OnComponentUpdated(component components_v1alpha1.Component
|
||||
//TODO: implement update for input bindings too
|
||||
binding, err := a.bindingsRegistry.CreateOutputBinding(component.Spec.Type)
|
||||
if err != nil {
|
||||
log.Errorf("Failed to create output binding: %s", err)
|
||||
log.Errorf("failed to create output binding: %s", err)
|
||||
return
|
||||
}
|
||||
|
||||
@@ -838,6 +844,31 @@ func (a *DaprRuntime) initActors() error {
|
||||
return err
|
||||
}
|
||||
|
||||
func (a *DaprRuntime) getAuthorizedComponents(components []components_v1alpha1.Component) []components_v1alpha1.Component {
|
||||
authorized := []components_v1alpha1.Component{}
|
||||
|
||||
for _, c := range components {
|
||||
if a.namespace == "" || (a.namespace != "" && c.ObjectMeta.Namespace == a.namespace) {
|
||||
// scopes are defined, make sure this runtime ID is authorized
|
||||
if len(c.Scopes) > 0 {
|
||||
found := false
|
||||
for _, s := range c.Scopes {
|
||||
if s == a.runtimeConfig.ID {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !found {
|
||||
continue
|
||||
}
|
||||
}
|
||||
authorized = append(authorized, c)
|
||||
}
|
||||
}
|
||||
return authorized
|
||||
}
|
||||
|
||||
func (a *DaprRuntime) loadComponents(opts *runtimeOpts) error {
|
||||
var loader components.ComponentLoader
|
||||
|
||||
@@ -854,7 +885,7 @@ func (a *DaprRuntime) loadComponents(opts *runtimeOpts) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
a.components = comps
|
||||
a.components = a.getAuthorizedComponents(comps)
|
||||
|
||||
// Register and initialize secret stores
|
||||
a.secretStoresRegistry.Register(opts.secretStores...)
|
||||
|
||||
@@ -610,3 +610,112 @@ func TestReadInputBindings(t *testing.T) {
|
||||
assert.Equal(t, "test", b.data)
|
||||
})
|
||||
}
|
||||
|
||||
func TestNamespace(t *testing.T) {
|
||||
t.Run("empty namespace", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
ns := rt.getNamespace()
|
||||
|
||||
assert.Empty(t, ns)
|
||||
})
|
||||
|
||||
t.Run("non-empty namespace", func(t *testing.T) {
|
||||
os.Setenv("NAMESPACE", "a")
|
||||
defer os.Clearenv()
|
||||
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
ns := rt.getNamespace()
|
||||
|
||||
assert.Equal(t, "a", ns)
|
||||
})
|
||||
}
|
||||
|
||||
func TestAuthorizedComponents(t *testing.T) {
|
||||
name := "test"
|
||||
|
||||
t.Run("standalone mode, no namespce", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 1)
|
||||
assert.Equal(t, name, comps[0].Name)
|
||||
})
|
||||
|
||||
t.Run("namespace mismatch", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = "test"
|
||||
component.ObjectMeta.Namespace = "b"
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 0)
|
||||
})
|
||||
|
||||
t.Run("namespace match", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
component.ObjectMeta.Namespace = "a"
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 1)
|
||||
})
|
||||
|
||||
t.Run("in scope, namespace match", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
component.ObjectMeta.Namespace = "a"
|
||||
component.Scopes = []string{TestRuntimeConfigID}
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 1)
|
||||
})
|
||||
|
||||
t.Run("not in scope, namespace match", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
component.ObjectMeta.Namespace = "a"
|
||||
component.Scopes = []string{"other"}
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 0)
|
||||
})
|
||||
|
||||
t.Run("in scope, namespace mismatch", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
component.ObjectMeta.Namespace = "b"
|
||||
component.Scopes = []string{TestRuntimeConfigID}
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 0)
|
||||
})
|
||||
|
||||
t.Run("not in scope, namespace mismatch", func(t *testing.T) {
|
||||
rt := NewTestDaprRuntime(modes.StandaloneMode)
|
||||
rt.namespace = "a"
|
||||
|
||||
component := components_v1alpha1.Component{}
|
||||
component.ObjectMeta.Name = name
|
||||
component.ObjectMeta.Namespace = "b"
|
||||
component.Scopes = []string{"other"}
|
||||
|
||||
comps := rt.getAuthorizedComponents([]components_v1alpha1.Component{component})
|
||||
assert.True(t, len(comps) == 0)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
/*
|
||||
Copyright The Dapr Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
+3
-1
@@ -8,8 +8,10 @@ set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
|
||||
|
||||
CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
|
||||
|
||||
bash ".${CODEGEN_PKG}"/generate-groups.sh "deepcopy,client,informer,lister" \
|
||||
"github.com/dapr/dapr/pkg/client" "github.com/dapr/dapr/pkg/apis" \
|
||||
"components:v1alpha1 configuration:v1alpha1"
|
||||
"components:v1alpha1 configuration:v1alpha1" \
|
||||
--go-header-file ./boilerplate.go.txt
|
||||
Reference in new issue
Block a user