Support proxy object in k8s access expression

Author: LEDfan

src/main/java/eu/openanalytics/containerproxy/backend/kubernetes/KubernetesBackend.java

@@ -331,7 +331,7 @@ public Proxy startContainer(Authentication user, Container initialContainer, Con
             rContainerBuilder.addRuntimeValue(new RuntimeValue(BackendContainerNameKey.inst, effectiveKubeNamespace + "/" + patchedPod.getMetadata().getName()), false);
 
             // create additional manifests -> use the effective (i.e. patched) namespace if no namespace is provided
-            createAdditionalManifests(user, proxySpec, proxy, specExtension, effectiveKubeNamespace);
+            createAdditionalManifests(user, proxySpec, proxy, specExtension, effectiveKubeNamespace, initialContainer);
 
             // tell the status service we are starting the pod/container
             proxyStartupLogBuilder.startingContainer(initialContainer.getIndex());
@@ -513,12 +513,12 @@ private JsonPatch readPatchFromSpec(String patchAsString) throws JsonProcessingE
      *
      * The resource will only be created if it does not already exist.
      */
-    private void createAdditionalManifests(Authentication auth, ProxySpec proxySpec, Proxy proxy, KubernetesSpecExtension specExtension, String namespace) throws JsonProcessingException {
+    private void createAdditionalManifests(Authentication auth, ProxySpec proxySpec, Proxy proxy, KubernetesSpecExtension specExtension, String namespace, Container container) throws JsonProcessingException {
         for (GenericKubernetesResource fullObject : parseAdditionalManifests(proxy, namespace, specExtension.getKubernetesAdditionalManifests(), false)) {
             applyAdditionalManifest(proxy, fullObject);
         }
         for (AuthorizedAdditionalManifests authorizedAdditionalManifests : specExtension.kubernetesAuthorizedAdditionalManifests) {
-            if (accessControlEvaluationService.checkAccess(auth, proxySpec, authorizedAdditionalManifests.accessControl)) {
+            if (accessControlEvaluationService.checkAccess(auth, proxySpec, authorizedAdditionalManifests.accessControl, proxy, container)) {
                 for (GenericKubernetesResource fullObject : parseAdditionalManifests(proxy, namespace, authorizedAdditionalManifests.manifests, false)) {
                     applyAdditionalManifest(proxy, fullObject);
                 }
@@ -528,7 +528,7 @@ private void createAdditionalManifests(Authentication auth, ProxySpec proxySpec,
             applyAdditionalManifest(proxy, fullObject);
         }
         for (AuthorizedAdditionalManifests authorizedAdditionalManifests : specExtension.kubernetesAuthorizedAdditionalPersistentManifests) {
-            if (accessControlEvaluationService.checkAccess(auth, proxySpec, authorizedAdditionalManifests.accessControl)) {
+            if (accessControlEvaluationService.checkAccess(auth, proxySpec, authorizedAdditionalManifests.accessControl, proxy, container)) {
                 for (GenericKubernetesResource fullObject : parseAdditionalManifests(proxy, namespace, authorizedAdditionalManifests.manifests, true)) {
                     applyAdditionalManifest(proxy, fullObject);
                 }

src/main/java/eu/openanalytics/containerproxy/service/AccessControlEvaluationService.java

@@ -25,6 +25,7 @@
 import eu.openanalytics.containerproxy.model.spec.ProxySpec;
 import eu.openanalytics.containerproxy.spec.expression.SpecExpressionContext;
 import eu.openanalytics.containerproxy.spec.expression.SpecExpressionResolver;
+import org.apache.commons.lang3.ArrayUtils;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.core.Authentication;
@@ -44,7 +45,7 @@ public AccessControlEvaluationService(@Lazy IAuthenticationBackend authBackend,
         this.specExpressionResolver = specExpressionResolver;
     }
 
-    public boolean checkAccess(Authentication auth, ProxySpec spec, AccessControl accessControl) {
+    public boolean checkAccess(Authentication auth, ProxySpec spec, AccessControl accessControl, Object... objects) {
         if (auth instanceof AnonymousAuthenticationToken) {
             // if anonymous -> only allow access if the backend has no authorization enabled
             return !authBackend.hasAuthorization();
@@ -62,7 +63,7 @@ public boolean checkAccess(Authentication auth, ProxySpec spec, AccessControl ac
             return true;
         }
 
-        return allowedByExpression(auth, spec, accessControl);
+        return allowedByExpression(auth, spec, accessControl, objects);
     }
 
     public boolean hasAccessControl(AccessControl accessControl) {
@@ -101,12 +102,13 @@ public boolean allowedByUsers(Authentication auth, AccessControl accessControl)
         return false;
     }
 
-    public boolean allowedByExpression(Authentication auth, ProxySpec spec, AccessControl accessControl) {
+    public boolean allowedByExpression(Authentication auth, ProxySpec spec, AccessControl accessControl, Object... objects) {
         if (!accessControl.hasExpressionAccess()) {
             // no expression defined -> this user has no access based on the expression
             return false;
         }
-        SpecExpressionContext context = SpecExpressionContext.create(auth, auth.getPrincipal(), auth.getCredentials(), spec);
+        Object[] args = ArrayUtils.addAll(new Object[]{auth, auth.getPrincipal(), auth.getCredentials(), spec}, objects);
+        SpecExpressionContext context = SpecExpressionContext.create(args);
         return specExpressionResolver.evaluateToBoolean(accessControl.getExpression(), context);
     }