Separate authorization checks for the operator and domain namespaces (#2138)

* Separate authorization checks for the operator and domain namespaces

* Add unit-test

Author: rjeberhard

docs/charts/index.yaml

@@ -3,17 +3,17 @@ entries:
   weblogic-operator:
   - apiVersion: v1
     appVersion: 3.2.0
-    created: "2021-01-04T15:48:07.645132-05:00"
+    created: "2021-01-13T12:37:48.514056-05:00"
     description: Helm chart for configuring the WebLogic operator.
-    digest: faeabc3c35c580909ff3d35b44b0467bd7cb4376bbd54689df92a44295d9b37f
+    digest: 77bf9ae96371e779d6fd6faae1966d057d54571f651ec11babd8bc1d86e590af
     name: weblogic-operator
     type: application
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.2.0.tgz
     version: 3.2.0
   - apiVersion: v1
     appVersion: 3.1.1
-    created: "2021-01-04T15:48:07.64427-05:00"
+    created: "2021-01-13T12:37:48.513192-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 202d148fd3db1ce45d22d4eab3e84bea9bf774addd9e0bc65f9312207a6e4968
     name: weblogic-operator
@@ -23,7 +23,7 @@ entries:
     version: 3.1.1
   - apiVersion: v1
     appVersion: 3.1.0
-    created: "2021-01-04T15:48:07.643256-05:00"
+    created: "2021-01-13T12:37:48.512149-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: acf600d0951dc3d8a0b05b35f3b9b1e62d827ef483fa863b0e37054ebb61f853
     name: weblogic-operator
@@ -32,123 +32,123 @@ entries:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.1.0.tgz
     version: 3.1.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.642209-05:00"
+    created: "2021-01-13T12:37:48.510828-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 5d3a79a55132c33afd5d2d30e398c3cc508d77c9352129f2e8e127db5f1dcf19
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.4.tgz
     version: 3.0.4
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.641293-05:00"
+    created: "2021-01-13T12:37:48.510041-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: c6aeefca88eaa0d431dba66ee5705391c92468f26b27c5af92815ec3c3000406
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.3.tgz
     version: 3.0.3
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.640176-05:00"
+    created: "2021-01-13T12:37:48.508963-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 84b5989fe8f2392d2b3b0f721bdab1562566d7d885324beafd9fc9e658b13cd3
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.2.tgz
     version: 3.0.2
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.639261-05:00"
+    created: "2021-01-13T12:37:48.508139-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: e7654ad3f2168f54b3a4b133bf8a86ea12bc474e5ee1d3ab14e1cf53012e9772
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.1.tgz
     version: 3.0.1
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.638382-05:00"
+    created: "2021-01-13T12:37:48.507336-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 5c7c0d3ae797e98592b6fd2191b104f515d6649d0060af0a3ffef215d4c69864
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.0.tgz
     version: 3.0.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.637498-05:00"
+    created: "2021-01-13T12:37:48.506585-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 5f4cd8f4f3282b52b5e90a1169f26986e8272671845053606ade9c855fb04151
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-3.0.0-rc1.tgz
     version: 3.0.0-rc1
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.636461-05:00"
+    created: "2021-01-13T12:37:48.505796-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: d441888a8deae1b1339e7585e3b437dfd2533303e46e842d7378e16db665e234
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.6.0.tgz
     version: 2.6.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.635531-05:00"
+    created: "2021-01-13T12:37:48.50504-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: fe41421b7dc45dc8a3b2888d3a626a37f5d3c8e1fa292fb6699deedc5e1db33d
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.5.0.tgz
     version: 2.5.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.633853-05:00"
+    created: "2021-01-13T12:37:48.504032-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: b36bd32083f67453a62d089a2c09ce38e6655d88ac8a7b38691230c55c40e672
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.4.0.tgz
     version: 2.4.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.632814-05:00"
+    created: "2021-01-13T12:37:48.503154-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: a3eafe4c2c6ff49384e56421201e59a3737d651af8d5b605b87a19eb1f6f1dc3
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.3.1.tgz
     version: 2.3.1
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.630402-05:00"
+    created: "2021-01-13T12:37:48.49981-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: cbc6caaa6eb28e3c7e906ede14b2ae511a0b35fc12a8e3ab629155b09993e8b2
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.3.0.tgz
     version: 2.3.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.629526-05:00"
+    created: "2021-01-13T12:37:48.498485-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 23d5a1c554fa8211cc1e86b7ade09460917cb2069e68fb4bfdddafc8db44fdcd
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.2.1.tgz
     version: 2.2.1
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.628426-05:00"
+    created: "2021-01-13T12:37:48.497434-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: bba303686cb55d84fe8c0d693a2436e7e686b028085b56e012f6381699a3911f
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.2.0.tgz
     version: 2.2.0
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.626313-05:00"
+    created: "2021-01-13T12:37:48.494398-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 391e23c0969ada5f0cd2a088ddc6f11f237f57521801ed3925db2149a8437a0d
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.1.tgz
     version: "2.1"
   - apiVersion: v1
-    created: "2021-01-04T15:48:07.6254-05:00"
+    created: "2021-01-13T12:37:48.493567-05:00"
     description: Helm chart for configuring the WebLogic operator.
     digest: 298acda78ab73db6b7ba6f2752311bfa40c65874e03fb196b70976192211c1a5
     name: weblogic-operator
     urls:
     - https://oracle.github.io/weblogic-kubernetes-operator/charts/weblogic-operator-2.0.1.tgz
     version: 2.0.1
-generated: "2021-01-04T15:48:07.623889-05:00"
+generated: "2021-01-13T12:37:48.491609-05:00"

docs/charts/weblogic-operator-3.2.0.tgz

@@ -17,7 +17,7 @@
 {{-   $args := include "utils.cloneDictionary" . | fromYaml -}}
 {{- /*
       Split terms on commas not contained in parentheses. Unfortunately, the regular expression
-      support included with Helm tempalates does not include lookarounds.
+      support included with Helm templates does not include lookarounds.
 */ -}}
 {{-   $working := dict "rejected" (list) "terms" (list $args.domainNamespaceLabelSelector) }}
 {{-   if contains "," $args.domainNamespaceLabelSelector }}

kubernetes/charts/weblogic-operator/templates/_domain-namespaces.tpl

@@ -12,6 +12,9 @@ metadata:
     weblogic.operatorName: {{ .Release.Namespace | quote }}
 rules:
 - apiGroups: [""]
-  resources: ["secrets", "configmaps", "events"]
+  resources: ["secrets", "configmaps"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["events"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
 {{- end }}

kubernetes/charts/weblogic-operator/templates/_operator-role.tpl

@@ -10,13 +10,15 @@
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import javax.annotation.Nonnull;
 
 import io.kubernetes.client.openapi.models.V1Namespace;
 import io.kubernetes.client.openapi.models.V1NamespaceList;
 import io.kubernetes.client.openapi.models.V1ObjectMeta;
+import io.kubernetes.client.openapi.models.V1SubjectRulesReviewStatus;
 import oracle.kubernetes.operator.calls.CallResponse;
 import oracle.kubernetes.operator.helpers.CallBuilder;
 import oracle.kubernetes.operator.helpers.EventHelper;
@@ -61,11 +63,11 @@ class DomainRecheck {
   }
 
   NamespaceRulesReviewStep createOperatorNamespaceReview() {
-    return new NamespaceRulesReviewStep(getOperatorNamespace());
+    return new NamespaceRulesReviewStep(getOperatorNamespace(), false);
   }
 
   NamespaceRulesReviewStep createNamespaceReview(String namespace) {
-    return new NamespaceRulesReviewStep(namespace);
+    return new NamespaceRulesReviewStep(namespace, true);
   }
 
   Step createReadNamespacesStep() {
@@ -78,9 +80,11 @@ Step createReadNamespacesStep() {
    */
   class NamespaceRulesReviewStep extends Step {
     private final String ns;
+    private final boolean isDomainNamespace;
 
-    private NamespaceRulesReviewStep(@Nonnull String ns) {
+    private NamespaceRulesReviewStep(@Nonnull String ns, boolean isDomainNamespace) {
       this.ns = ns;
+      this.isDomainNamespace = isDomainNamespace;
     }
 
     @Override
@@ -93,19 +97,24 @@ public NextAction apply(Packet packet) {
           LoggingContext.LOGGING_CONTEXT_KEY,
           Component.createFor(new LoggingContext().namespace(ns)));
 
-      nss.getRulesReviewStatus().updateAndGet(prev -> {
+      V1SubjectRulesReviewStatus status = nss.getRulesReviewStatus().updateAndGet(prev -> {
         if (prev != null) {
           return prev;
         }
 
         try {
-          return HealthCheckHelper.getAccessAuthorizations(ns);
+          return HealthCheckHelper.getSelfSubjectRulesReviewStatus(ns);
         } catch (Throwable e) {
           LOGGER.warning(MessageKeys.EXCEPTION, e);
         }
         return null;
       });
 
+      AtomicBoolean guard = isDomainNamespace ? nss.verifiedAsDomainNamespace() : nss.verifiedAsOperatorNamespace();
+      if (!guard.getAndSet(true)) {
+        HealthCheckHelper.verifyAccess(status, ns, isDomainNamespace);
+      }
+
       return doNext(packet);
     }
 

operator/src/main/java/oracle/kubernetes/operator/DomainRecheck.java

@@ -11,11 +11,21 @@
 public class NamespaceStatus {
   private final AtomicBoolean isNamespaceStarting = new AtomicBoolean(false);
   private final AtomicReference<V1SubjectRulesReviewStatus> rulesReviewStatus = new AtomicReference<>();
+  private final AtomicBoolean verifiedAsOperatorNamespace = new AtomicBoolean(false);
+  private final AtomicBoolean verifiedAsDomainNamespace = new AtomicBoolean(false);
 
   public AtomicBoolean isNamespaceStarting() {
     return isNamespaceStarting;
   }
 
+  public AtomicBoolean verifiedAsOperatorNamespace() {
+    return verifiedAsOperatorNamespace;
+  }
+
+  public AtomicBoolean verifiedAsDomainNamespace() {
+    return verifiedAsDomainNamespace;
+  }
+
   public AtomicReference<V1SubjectRulesReviewStatus> getRulesReviewStatus() {
     return rulesReviewStatus;
   }