kube-apiserver 权限控制

func (authHandler *unionAuthRequestHandler) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
	var errlist []error
	// 遍历 Handlers数组
	for _, currAuthRequestHandler := range authHandler.Handlers {
		// 执行每个每个认证器对应的 AuthenticateRequest()方法对请求进行认证
		resp, ok, err := currAuthRequestHandler.AuthenticateRequest(req)
		if err != nil {
			if authHandler.FailOnError {
				return resp, ok, err
			}
			errlist = append(errlist, err)
				continue
		}
		
		if ok {
			returnresp, ok, err
		}
	}
	
	return nil, false, utilerrors.NewAggregate(errlist)
}

Authenticator 的执行

func WithAuthentication(handler http.Handler, auth authenticator.Request, failed http.Handler, apiAuds authenticator.Audiences, requestHeaderConfig *authenticatorfactory.RequestHeaderConfig) http.Handler {
	return withAuthentication(handler, auth, failed, apiAuds, requestHeaderConfig, recordAuthenticationMetrics)
}
func withAuthentication(handler http.Handler, auth authenticator.Request, failed http.Handler, apiAuds authenticator.Audiences, requestHeaderConfig *authenticatorfactory.RequestHeaderConfig, metricsauthenticationRecordMetricsFunc) http.Handler {
	if auth == nil {
		klog.Warning("Authenticationisdisabled")
		return handler
	}
	...
	// 定义并返回认证处理函数
	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		authenticationStart := time.Now()
		
		if len(apiAuds) > 0 {
			req = req.WithContext(authenticator.WithAudiences(req.Context(), apiAuds))
		}
		// 执行认证器处理函数，认证器的实例化在上面有过分析
		resp, ok, err := auth.AuthenticateRequest(req)
		authenticationFinish := time.Now()
		
		defer func() {
			metrics(req.Context(), resp, ok, err, apiAuds, authenticationStart, authenticationFinish)
		}()
		// 认证失败，返回错误
		if err != nil || !ok {
			if err != nil {
				klog.ErrorS(err, "Unabletoauthenticatetherequest")
			}
			failed.ServeHTTP(w, req)
			return
		}
		...
		req = req.WithContext(genericapirequest.WithUser(req.Context(), resp.User))
		handler.ServeHTTP(w, req)
	})
}

DefaultBuildHandlerChain()函数中会调用认证、授权等功能相应的函数对http.Handler请求处理函数进行封装，对认证处理器的封装由调用WithAuthentication()函数完成。

func DefaultBuildHandlerChain(apiHandler http.Handler, c *Config) http.Handler {
	handler := apiHandler
	...
	// 调用 WithAuthorization()函数获取授权器处理函数，授权器 c.Authorization.Authorizer作为参数
	handler = genericapifilters.WithAuthorization(handler, c.Authorization.Authorizer, c.Serializer)
	...
	// 调用 WithAuthentication()函数获取认证器处理函数，认证器 c.Authentication.Authenticator作为参数
	handler = genericapifilters.WithAuthentication(handler, c.Authentication.Authenticator, failedHandler, c.Authentication.APIAudiences, c.Authentication.RequestHeaderConfig)
}

// 函数调用过程：NewConfig()->CreateKubeAPIServerConfig()->BuildGenericConfig()->genericapiserver.NewConfig()
func NewConfig(codecs serializer.CodecFactory) *Config {
	...
	// 实例化 Config
	return &Config{
		...
		BuildHandlerChainFunc: DefaultBuildHandlerChain, // 指定Config.BuildHandlerChainFunc为DefaultBuildHandlerChain
		...
	}
	
}

在创建APIExtensionsSerer、KubeAPIServer、AggregatorServer 3个服务时都首先会调用GenericConfig.New()创建通用服务GenericAPIServer。

func (c completedConfig) New(name string, delegationTarget DelegationTarget) (*GenericAPIServer, error) {
	...
	// 调用 c.BuildHandlerChainFunc()返回认证器处理函数
	handlerChainBuilder := func(handler http.Handler)http.Handler {
		return c.BuildHandlerChainFunc(handler, c.Config)
	}
	...
	// 实例化 apiServerHandler，设置 apiServerHandler.FullHandlerChain为 Config.BuildHandlerChainFunc
	apiServerHandler := NewAPIServerHandler(name, c.Serializer, handlerChainBuilder, delegationTarget.UnprotectedHandler())
	// 将 GenericAPIServer.Handler赋值为 apiServerHandler
	s := &GenericAPIServer {
		...
		Handler: apiServerHandler,
		...
	}
}

func (s preparedGenericAPIServer) NonBlockingRun(stopCh <-chan struct{}, shutdownTimeout time.Duration) (<-chanstruct{}, <-chan struct{}, error) {
	...
	// 执行 Serve函数，apiServerHandler被为参数
	stoppedCh, listenerStoppedCh, err = s.SecureServingInfo.Serve(s.Handler, shutdownTimeout, internalStopCh)
	if err != nil {
		close(internalStopCh)
		return nil, nil, err
	}
	...
}

func (s *SecureServingInfo) Serve(handler http.Handler, shutdownTimeout time.Duration, stopCh <-chan struct{}) (<-chan struct{}, <-chanstruct{}, error) {
	...
	secureServer := &http.Server {
		Addr: s.Listener.Addr().String(),
		Handler: handler,    // 指定 server.Handler为 apiServerHandler
		MaxHeaderBytes: 1 << 20,
		TLSConfig: tlsConfig,
		
		IdleTimeout: 90 * time.Second,
		ReadHeaderTimeout: 32 * time.Second,
	}
}

// 函数调用过程：prepared.Run()->preparedGenericAPIServer.Run()->NonBlockingRun()->SecureServingInfo.Serve()->RunServer()->server.Serve()
func (srv *Server) Serve(l net.Listener) error {
	...
	// 循环处理客户端请求
	for{
		rw, err := l.Accept()
		c := srv.newConn(rw)
		c.setState(c.rwc, StateNew, runHooks) // before Serve can return
		// 为每一个连接开启一个goroutines
		go c.serve(connCtx)
	}
	
}


func(c *conn) serve(ctx context.Context) {
	// 读取数据和其他的流程忽略
	...
	// 执行 APIServerHandler.ServeHTTP
	serverHandler{c.server}.ServeHTTP(w,w.req)
}

授权

type unionAuthzHandler []authorizer.Authorizer

//Authorizesagainstachainofauthorizer.Authorizerobjectsandreturnsnilifsuccessfulandreturnserrorifunsuccessful
func (authzHandler unionAuthzHandler) Authorize(ctx context.Context, a authorizer.Attributes)(authorizer.Decision, string, error) {
	var(
		errlist []error
		reasonlist []string
	)
	// 遍历授权器列表
	for _, currAuthzHandler := range authzHandler {
		// 执行授权器
		decision, reason, err := currAuthzHandler.Authorize(ctx, a)
	
		if err != nil {
			errlist = append(errlist, err)
		}
		if len(reason) != 0 {
			reasonlist = append(reasonlist, reason)
		}
		switch decision {
			case authorizer.DecisionAllow, authorizer.DecisionDeny:
				// 只要有一个授权器通过，则返回授权成功
				return decision, reason, err
			case authorizer.DecisionNoOpinion:
				// continue to the next authorizer
		}
	}
	
	return authorizer.DecisionNoOpinion, strings.Join(reasonlist, "\n"), utilerrors.NewAggregate(errlist)
}

授权器的执行

func WithAuthorization(hhandler http.Handler,auth authorizer.Authorizer,s runtime.NegotiatedSerializer) http.Handler {
	return withAuthorization(hhandler, auth, s, recordAuthorizationMetrics)
}

func withAuthorization(handler http.Handler,a authorizer.Authorizer, sruntime.NegotiatedSerializer, metrics recordAuthorizationMetricsFunc) http.Handler {
	// 如果a授权器为空， 则说明kubeapiserver未启用任何授权功能
	if a == nil {
		klog.Warning("Authorization is disabled")
		return handler
	}
	return http.HandlerFunc(func (w http.ResponseWriter, req *http.Request) {
		ctx := req.Context()
		authorizationStart := time.Now()
		// 从HTTP请求中获取客户端信息
		attributes, err := GetAuthorizerAttributes(ctx)
		if err != nil {
			responsewriters.InternalError(w,req,err)
			return
		}
		// 对请求进行授权
		authorized, reason, err := a.Authorize(ctx, attributes)
		
		authorizationFinish := time.Now()
		defer func() {
			metrics(ctx, authorized, err, authorizationStart, authorizationFinish)
		}()
		
		//an authorizer like RBAC could encounter evaluation errors and still allow the request, so authorizer decision is checked befor eerror here.
		if authorized == authorizer.DecisionAllow {
			audit.AddAuditAnnotations(ctx,
				decisionAnnotationKey, decisionAllow,
				reasonAnnotationKey, reason)
			handler.ServeHTTP(w, req)
			return
		}
		if err != nil {
			// 返回 HTTP 401 Unauthorized
			audit.AddAuditAnnotation(ctx, reasonAnnotationKey, reasonError)
			responsewriters.InternalError(w, req, err)
			return
		}
		
		klog.V(4).InfoS("Forbidden", "URI", req.RequestURI, "reason", reason)
		audit.AddAuditAnnotations(ctx,
			decisionAnnotationKey, decisionForbid,
			reasonAnnotationKey, reason)
		responsewriters.Forbidden(ctx, attributes, w, req, reason, s)
	})
}

准入控制器

type Interface interface {
	Handles(operation Operation) bool
}
type MutationInterface interface{
	Interface
	Admit(ctx context.Context, a Attributes, o ObjectInterfaces) (err error)
}
type ValidationInterface interface {
	Interface
	Validate(ctx context.Context, a Attributes, o ObjectInterfaces) (err error)
}

kube-apiserver中的所有已启用的准入控制器（Admit方法及Validate方法）由 vendor/k8s.io/apiserver/pkg/admission/chain.go下的chainAdmissionHandler []Interface数据结构管理。

func (a*AdmissionOptions) ApplyTo(
	c *server.Config,
	informers informers.SharedInformerFactory,
	kubeClient kubernetes.Interface,
	dynamicClient dynamic.Interface,
	features featuregate.FeatureGate,
	pluginInitializers ...admission.PluginInitializer,
)error {
	if a == nil {
		return nil
	}
	...
	// 所有插件名称
	pluginNames := a.enabledPluginNames()
	...
	// 注册插件
	admissionChain, err := a.Plugins.NewFromPlugins(pluginNames, pluginsConfigProvider, initializersChain, a.Decorators)
	if err != nil {
		return err
	}
	
	c.AdmissionControl = admissionmetrics.WithStepMetrics(admissionChain)
	return nil
}