Golang Volume.Secret方法代码示例

func writePodVolume(m map[string]interface{}, item *api.Volume) {

	if x, ok := m["name"].(string); ok {
		item.Name = x
	}

	if n, ok := extractSingleMap(m["host_path"]); ok {
		item.HostPath = &api.HostPathVolumeSource{}
		if x, ok := n["path"].(string); ok {
			item.HostPath.Path = x
		}
	}

	if n, ok := extractSingleMap(m["empty_dir"]); ok {
		item.EmptyDir = &api.EmptyDirVolumeSource{}
		if x, ok := n["medium"].(string); ok {
			item.EmptyDir.Medium = api.StorageMedium(x)
		}
	}

	if n, ok := extractSingleMap(m["gce_persistent_disk"]); ok {
		item.GCEPersistentDisk = &api.GCEPersistentDiskVolumeSource{}
		if x, ok := n["pd_name"].(string); ok {
			item.GCEPersistentDisk.PDName = x
		}
		if x, ok := n["fs_type"].(string); ok {
			item.GCEPersistentDisk.FSType = x
		}
		if x, ok := n["partition"].(int); ok {
			item.GCEPersistentDisk.Partition = x
		}
		if x, ok := n["read_only"].(bool); ok {
			item.GCEPersistentDisk.ReadOnly = x
		}
	}

	if n, ok := extractSingleMap(m["aws_elastic_block_store"]); ok {
		item.AWSElasticBlockStore = &api.AWSElasticBlockStoreVolumeSource{}
		if x, ok := n["volume_id"].(string); ok {
			item.AWSElasticBlockStore.VolumeID = x
		}
		if x, ok := n["fs_type"].(string); ok {
			item.AWSElasticBlockStore.FSType = x
		}
		if x, ok := n["partition"].(int); ok {
			item.AWSElasticBlockStore.Partition = x
		}
		if x, ok := n["read_only"].(bool); ok {
			item.AWSElasticBlockStore.ReadOnly = x
		}
	}

	if n, ok := extractSingleMap(m["git_repo"]); ok {
		item.GitRepo = &api.GitRepoVolumeSource{}
		if x, ok := n["repository"].(string); ok {
			item.GitRepo.Repository = x
		}
		if x, ok := n["revision"].(string); ok {
			item.GitRepo.Revision = x
		}
		if x, ok := n["directory"].(string); ok {
			item.GitRepo.Directory = x
		}
	}

	if n, ok := extractSingleMap(m["secret"]); ok {
		item.Secret = &api.SecretVolumeSource{}
		if x, ok := n["secret_name"].(string); ok {
			item.Secret.SecretName = x
		}
	}

	// TODO:
	// NFS *NFSVolumeSource
	// ISCSI *ISCSIVolumeSource
	// Glusterfs *GlusterfsVolumeSource
	// PersistentVolumeClaim *PersistentVolumeClaimVolumeSource
	// RBD *RBDVolumeSource
	// FlexVolume *FlexVolumeSource
	// Cinder *CinderVolumeSource
	// CephFS *CephFSVolumeSource
	// Flocker *FlockerVolumeSource
	// DownwardAPI *DownwardAPIVolumeSource
	// FC *FCVolumeSource
	// AzureFile *AzureFileVolumeSource
	// ConfigMap *ConfigMapVolumeSource
}

func setVolumeSourceByType(kv *kapi.Volume, opts *AddVolumeOptions) error {
	switch strings.ToLower(opts.Type) {
	case "emptydir":
		kv.EmptyDir = &kapi.EmptyDirVolumeSource{}
	case "hostpath":
		kv.HostPath = &kapi.HostPathVolumeSource{
			Path: opts.Path,
		}
	case "secret":
		kv.Secret = &kapi.SecretVolumeSource{
			SecretName: opts.SecretName,
		}
	case "configmap":
		kv.ConfigMap = &kapi.ConfigMapVolumeSource{
			LocalObjectReference: kapi.LocalObjectReference{
				Name: opts.ConfigMapName,
			},
		}
	case "persistentvolumeclaim", "pvc":
		kv.PersistentVolumeClaim = &kapi.PersistentVolumeClaimVolumeSource{
			ClaimName: opts.ClaimName,
		}
	default:
		return fmt.Errorf("invalid volume type: %s", opts.Type)
	}
	return nil
}

func TestEnforcingServiceAccount(t *testing.T) {
	masterConfig, err := testserver.DefaultMasterOptions()
	masterConfig.ServiceAccountConfig.LimitSecretReferences = false
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	clusterAdminConfig, err := testserver.StartConfiguredMaster(masterConfig)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	clusterAdminKubeClient, err := testutil.GetClusterAdminKubeClient(clusterAdminConfig)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	// Get a service account token
	saToken, err := waitForServiceAccountToken(clusterAdminKubeClient, api.NamespaceDefault, serviceaccountadmission.DefaultServiceAccountName, 20, time.Second)
	if err != nil {
		t.Errorf("unexpected error: %v", err)
	}
	if len(saToken) == 0 {
		t.Errorf("token was not created")
	}

	pod := &api.Pod{}
	pod.Name = "foo"
	pod.Namespace = api.NamespaceDefault
	pod.Spec.ServiceAccountName = serviceaccountadmission.DefaultServiceAccountName

	container := api.Container{}
	container.Name = "foo"
	container.Image = "openshift/hello-openshift"
	pod.Spec.Containers = []api.Container{container}

	secretVolume := api.Volume{}
	secretVolume.Name = "bar-vol"
	secretVolume.Secret = &api.SecretVolumeSource{}
	secretVolume.Secret.SecretName = "bar"
	pod.Spec.Volumes = []api.Volume{secretVolume}

	err = wait.Poll(100*time.Millisecond, 5*time.Second, func() (bool, error) {
		if _, err := clusterAdminKubeClient.Pods(api.NamespaceDefault).Create(pod); err != nil {
			// The SA admission controller cache seems to take forever to update.  This check comes after the limit check, so until we get it sorted out
			// check if we're getting this particular error
			if strings.Contains(err.Error(), "no API token found for service account") {
				return true, nil
			}

			t.Log(err)
			return false, nil
		}

		return true, nil
	})
	if err != nil {
		t.Errorf("unexpected error: %v", err)
	}

	clusterAdminKubeClient.Pods(api.NamespaceDefault).Delete(pod.Name, nil)

	sa, err := clusterAdminKubeClient.ServiceAccounts(api.NamespaceDefault).Get(bootstrappolicy.DeployerServiceAccountName)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if sa.Annotations == nil {
		sa.Annotations = map[string]string{}
	}
	sa.Annotations[serviceaccountadmission.EnforceMountableSecretsAnnotation] = "true"

	time.Sleep(5)

	_, err = clusterAdminKubeClient.ServiceAccounts(api.NamespaceDefault).Update(sa)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	expectedMessage := "is not allowed because service account deployer does not reference that secret"
	pod.Spec.ServiceAccountName = bootstrappolicy.DeployerServiceAccountName

	err = wait.Poll(100*time.Millisecond, 5*time.Second, func() (bool, error) {
		if _, err := clusterAdminKubeClient.Pods(api.NamespaceDefault).Create(pod); err == nil || !strings.Contains(err.Error(), expectedMessage) {
			clusterAdminKubeClient.Pods(api.NamespaceDefault).Delete(pod.Name, nil)
			return false, nil
		}

		return true, nil
	})
	if err != nil {
		t.Errorf("unexpected error: %v", err)
	}

}