1. convert all traditional csv-format policies into k8s crd format.
2. modified all e2e test cases to use crd resources instead of csv policy
3. implement some simple command-line script to automatically convert a csv policy file into k8s yaml configuration files

This pr contains the following thing:

1. migrate project into kubebuilder, which is recommended by kubesphere community
2. implemented a controller for model CRD. It can automatically generate and apply the corresponding CRD definition of associated policy, when a model (which represent a rule) is applied.

PR information

feat: implement crd adapter for casbin Signed-off-by: Товарищ программист [email protected]

Overview of This CRD Adapter

This adapter saves policys into k8s cluster as CRD resource. More specifically, this adapter saves policies of one model into one kind of CRD resource, and saves one line of policy into one CRD object.

Example of using CRD resource to save policy

In this example , we will see how to convert a external_ip.csv into crd resource , which is able to be read and modified with this adapter. The external_ip.csv is given as follow.

p,default,10.10.10.10,allow
p,default,10.10.10.11, allow

1. create a special namespace for saving policies.

(It's because that in the definition of out CustomResourceDefinition for saving the policy, we declare the "scope: Namespaced")

kubectl create policy

The name"policy" can be modified as you wish.

2. create the CustomResourceDefinition for saving the policy

save the following content into a file named "crd_example.yaml"

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  ##EDIT HERE
  # name must match the spec fields below, and be in the form: <plural>.<group>
  name: type1policies.stable.example.com
  namespace: policy
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: stable.example.com
  # list of versions supported by this CustomResourceDefinition
  versions:
    - name: v1
      # Each version can be enabled/disabled by Served flag.
      served: true
      # One and only one version must be marked as the storage version.
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                policyItem:
                  ##EDIT HERE
                  #this policyItem contains a line of policy. multiple lines of policy is forbiddened
                  type: string
                
  # either Namespaced or Cluster
  scope: Namespaced
  names:
    ## EDIT HERE: change the plural,singular and kind of the name to your own policy name.
    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
    plural: type1policies
    # singular name to be used as an alias on the CLI and for display
    singular: type1policy
    # kind is normally the CamelCased singular type. Your resource manifests use this.
    kind: Type1Policy

change the names(type1policies...) as you wish.

and execute the following command: kubectl --namespace=policy apply -f crd_example.yaml

3. create several policy

save the following content into a file named "type1policy_1.yaml"

apiVersion: "stable.example.com/v1"
kind: Type1Policy
metadata:
  name: policy2
spec:
  policyItem: |
    p,default,10.10.10.10, allow

NOTE: this policyItem contains a single line of policy. multiple lines of policy is forbiddened!

imitate the example above and create some objects according to the external_ip.csv, then execute kubectl --namespace=policy get type1policies, you will see

NAME                               AGE
policy1                            10m
policy2                            10m

each crd object is a line of policy.

To be more precise, execute kubectl --namespace=policy get type1policies -o yaml you will see

apiVersion: v1
items:
- apiVersion: stable.example.com/v1
  kind: Type1Policy
  metadata:
    creationTimestamp: "2021-09-13T06:04:08Z"
    generation: 2
    name: 50870b6a200ab49bd79be54cf7c685a1
    namespace: policy
    resourceVersion: "1735"
    uid: 34ab1d3a-1568-481a-9bd4-65025c70cd2e
  spec:
    policyItem: p,default,1.1.1.4,allow
- apiVersion: stable.example.com/v1
  kind: Type1Policy
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"stable.example.com/v1","kind":"Type1Policy","metadata":{"annotations":{},"name":"policy1","namespace":"policy"},"spec":{"policyItem":"p,default,10.10.10.10, allow\n"}}
    creationTimestamp: "2021-09-13T06:46:08Z"
    generation: 1
    name: policy1
    namespace: policy
    resourceVersion: "3496"
    uid: 8de5483e-8deb-4dfb-bfa8-39565c7bcacc
  spec:
    policyItem: |
      p,default,10.10.10.10, allow
- apiVersion: stable.example.com/v1
  kind: Type1Policy
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"stable.example.com/v1","kind":"Type1Policy","metadata":{"annotations":{},"name":"policy2","namespace":"policy"},"spec":{"policyItem":"p,default,10.10.10.11, allow\n"}}
    creationTimestamp: "2021-09-13T06:46:17Z"
    generation: 1
    name: policy2
    namespace: policy
    resourceVersion: "3503"
    uid: b2c55235-aa36-4967-9150-823f66b34c71
  spec:
    policyItem: |
      p,default,10.10.10.11, allow
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

a crd object contains one line of policy, corresponding one line of external_ip.csv
the whole crd resource contains all policy, corresponding to the external_ip.csv

feat: implement rule replica-limits&required_annotations&required-labels&required_probes

Signed-off-by: Товарищ программист [email protected]

feat: implement rules 10&11&12

This pr contains following contents:

• ks-admission-general-external-ip
• ks-admission-general-https-only
• ks-admission-general-image-digests Signed-off-by: Товарищ программист [email protected]

feat: implement rules ks-admission-general-container-resource-ratios&k8s-admission-general-disallowed-tags

This pr includes the following content:

• implementation of rule ks-admission-general-container-resource-ratios
• implemention of rule &k8s-admission-general-disallowed-tags
• fix for a tiny bug in ks-admission-general-container-allowed-repos
• formating some files, which was forgotten in previous pr
• renaming some functions, for the convenience of further development

Signed-off-by: Товарищ программист [email protected]

After starting to integrate this casbinkubesphere-authz, this plugin has been massively modified, and the readme.md is severely outdated. It's time to rewrite the README.MD to fulfill the document.

Proposal: https://github.com/kubesphere/kubesphere/issues/4139

Roadmap:

1. Add model and policy for ks-admission rules

2. Support manage the model and policy through CRD

   • [x] Model and Policy CRD definition
   • [x] Policy CRD adaptor
   • [ ] Use Kubebuilder(Controller) to manager model and policy

3. Other helpful features

   • [ ] Audit the enforce result.

4. Configure CI and e2e test on Github Actions

   • [x] Configure CI
   • [ ] Push dev/release image on CI
   • [x] Add e2e test on CI

5. Complete build/install tools, client SDK and docs

   • [ ] Support helm install
   • [ ] Provide Client SDK
   • [ ] Sample and Developer Docs

We have several options to integrate this repo into the kubesphere ecosystem, like code integration, listing in the 3rd-party authorization middleware list, etc. See how we did it for apisix middleware: https://github.com/casbin-lua/apisix-authz/issues/5 . apisix-authz has already integrated its code into apisix's main trunk. I think this is a very good example.