Feat/casbin

casbin/model.conf

@@ -0,0 +1,18 @@
+# Request definition - this is set by Argo and cannot be changed
+[request_definition]
+r = sub, obj, act
+
+# Policy definition - this set by the operator and can be anything you want
+[policy_definition]
+p = sub, resource, namespace, name, act
+
+[role_definition]
+g = _, _
+
+# Policy effect
+[policy_effect]
+e = some(where (p.eft == allow))
+
+# Matchers
+[matchers]
+m = g(r.sub, p.sub) && globMatch(r.act, p.act) && globMatch(r.obj.Resource, p.resource) && globMatch(r.obj.Namespace, p.namespace) && globMatch(r.obj.Name, p.name)

casbin/policy.csv

@@ -0,0 +1,23 @@
+# Built-in policy which defines two roles: role:read-only and role:admin,
+# additionally assigns the admin user to the role:admin role
+# and the anonymous user to the role:read-only role.
+# Policy formats:
+# p, <user/group>, <resource>, <namespace>, <name>, <action>
+# The following types of resource exist:
+# workflows, workflowtemplate, clusterworkflowtemplates, cronworkflows
+
+p, role:read-only, *, *, *, list
+p, role:read-only, *, *, *, get
+p, role:read-only, *, *, *, watch
+
+p, role:admin, *, *, *, create
+p, role:admin, *, *, *, update
+p, role:admin, *, *, *, patch
+p, role:admin, *, *, *, delete
+p, role:admin, *, *, *, deletecollection
+
+p, role:read-only, workflows, argo, omniscient-octopus*, create
+
+g, role:admin, role:read-only
+g, anonymous, role:read-only
+g, authors, role:read-only

go.mod

@@ -14,8 +14,10 @@ require (
 	github.com/argoproj/pkg v0.11.0
 	github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
 	github.com/blushft/go-diagrams v0.0.0-20201006005127-c78c821223d9
+	github.com/casbin/casbin/v2 v2.36.1
 	github.com/colinmarc/hdfs v1.1.4-0.20180805212432-9746310a4d31
 	github.com/coreos/go-oidc v2.2.1+incompatible
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c // indirect
 	github.com/doublerebel/bellows v0.0.0-20160303004610-f177d92a03d3
 	github.com/emicklei/go-restful v2.15.0+incompatible // indirect

go.sum

@@ -209,6 +209,8 @@ github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx2
 github.com/bombsimon/logrusr v1.1.0/go.mod h1:Jq0nHtvxabKE5EMwAAdgTaz7dfWE8C4i11NOltxGQpc=
 github.com/boynton/repl v0.0.0-20170116235056-348863958e3e/go.mod h1:Crc/GCZ3NXDVCio7Yr0o+SSrytpcFhLmVCIzi0s49t4=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
+github.com/casbin/casbin/v2 v2.36.1 h1:6b7PQuOEcNR4ZGvQcN82+E1o/n2KMNSUk+np9iryU8A=
+github.com/casbin/casbin/v2 v2.36.1/go.mod h1:vByNa/Fchek0KZUgG5wEsl7iFsiviAYKRtgrQfcJqHg=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
@@ -260,6 +262,7 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
@@ -502,6 +505,7 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0 h1:jlYHihg//f7RRwuPfptm04yp4s7O6Kw8EZiVYIGcH0g=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=

server/auth/casbin/ClusterWorkflowTemplatesEnforced.go

@@ -0,0 +1,79 @@
+package casbin
+
+import (
+	"context"
+	wfv1 "github.com/argoproj/argo-workflows/v3/pkg/apis/workflow/v1alpha1"
+	"github.com/argoproj/argo-workflows/v3/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+const (
+	ClusterWorkflowTemplates = "clusterworkflowtemplates"
+)
+
+type ClusterWorkflowTemplatesEnforced struct {
+	delegate v1alpha1.ClusterWorkflowTemplateInterface
+	enforcer *CustomEnforcer
+}
+
+func (c WorkflowEnforcedInterface) ClusterWorkflowTemplates() v1alpha1.ClusterWorkflowTemplateInterface {
+	return &ClusterWorkflowTemplatesEnforced{c.delegate.ArgoprojV1alpha1().ClusterWorkflowTemplates(), GetCustomEnforcerInstance()}
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Create(ctx context.Context, clusterWorkflowTemplate *wfv1.ClusterWorkflowTemplate, opts metav1.CreateOptions) (*wfv1.ClusterWorkflowTemplate, error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", clusterWorkflowTemplate.Name, ActionCreate); err != nil {
+		return nil, err
+	}
+	return c.delegate.Create(ctx, clusterWorkflowTemplate, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Update(ctx context.Context, clusterWorkflowTemplate *wfv1.ClusterWorkflowTemplate, opts metav1.UpdateOptions) (*wfv1.ClusterWorkflowTemplate, error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", clusterWorkflowTemplate.Name, ActionUpdate); err != nil {
+		return nil, err
+	}
+	return c.delegate.Update(ctx, clusterWorkflowTemplate, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", name, ActionDelete); err != nil {
+		return nil
+	}
+	return c.delegate.Delete(ctx, name, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", listOpts.FieldSelector, ActionDeleteCollection); err != nil {
+		return nil
+	}
+	return c.delegate.DeleteCollection(ctx, opts, listOpts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Get(ctx context.Context, name string, opts metav1.GetOptions) (*wfv1.ClusterWorkflowTemplate, error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", name, ActionGet); err != nil {
+		return nil, err
+	}
+	return c.delegate.Get(ctx, name, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) List(ctx context.Context, opts metav1.ListOptions) (*wfv1.ClusterWorkflowTemplateList, error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", opts.FieldSelector, ActionList); err != nil {
+		return nil, err
+	}
+	return c.delegate.List(ctx, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", opts.FieldSelector, ActionWatch); err != nil {
+		return nil, err
+	}
+	return c.delegate.Watch(ctx, opts)
+}
+
+func (c ClusterWorkflowTemplatesEnforced) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *wfv1.ClusterWorkflowTemplate, err error) {
+	if err := c.enforcer.enforce(ctx, ClusterWorkflowTemplates, "*", name, ActionPatch); err != nil {
+		return nil, err
+	}
+	return c.delegate.Patch(ctx, name, pt, data, opts, subresources...)
+}

server/auth/casbin/CronWorkflowsEnforced.go

@@ -0,0 +1,80 @@
+package casbin
+
+import (
+	"context"
+	wfv1 "github.com/argoproj/argo-workflows/v3/pkg/apis/workflow/v1alpha1"
+	"github.com/argoproj/argo-workflows/v3/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+type CronWorkflowsEnforced struct {
+	delegate v1alpha1.CronWorkflowInterface
+	namespace string
+	enforcer *CustomEnforcer
+}
+
+const (
+	CronWorkflows = "cronworkflows"
+)
+
+func (c WorkflowEnforcedInterface) CronWorkflows(namespace string) v1alpha1.CronWorkflowInterface {
+	return &CronWorkflowsEnforced{c.delegate.ArgoprojV1alpha1().CronWorkflows(namespace), namespace,GetCustomEnforcerInstance()}
+}
+
+func (c CronWorkflowsEnforced) Create(ctx context.Context, cronWorkflow *wfv1.CronWorkflow, opts metav1.CreateOptions) (*wfv1.CronWorkflow, error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, cronWorkflow.Name, ActionCreate); err != nil {
+		return nil, err
+	}
+	return c.delegate.Create(ctx, cronWorkflow, opts)
+}
+
+func (c CronWorkflowsEnforced) Update(ctx context.Context, cronWorkflow *wfv1.CronWorkflow, opts metav1.UpdateOptions) (*wfv1.CronWorkflow, error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, cronWorkflow.Name, ActionUpdate); err != nil {
+		return nil, err
+	}
+	return c.delegate.Update(ctx, cronWorkflow, opts)
+}
+
+func (c CronWorkflowsEnforced) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, name, ActionDelete); err != nil {
+		return err
+	}
+	return c.delegate.Delete(ctx, name, opts)
+}
+
+func (c CronWorkflowsEnforced) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, listOpts.FieldSelector, ActionDeleteCollection); err != nil {
+		return err
+	}
+	return c.delegate.DeleteCollection(ctx, opts, listOpts)
+}
+
+func (c CronWorkflowsEnforced) Get(ctx context.Context, name string, opts metav1.GetOptions) (*wfv1.CronWorkflow, error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, name, ActionGet); err != nil {
+		return nil, err
+	}
+	return c.delegate.Get(ctx, name, opts)
+}
+
+func (c CronWorkflowsEnforced) List(ctx context.Context, opts metav1.ListOptions) (*wfv1.CronWorkflowList, error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, "*", ActionList); err != nil {
+		return nil, err
+	}
+	return c.delegate.List(ctx, opts)
+}
+
+func (c CronWorkflowsEnforced) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, "*", ActionWatch); err != nil {
+		return nil, err
+	}
+	return c.delegate.Watch(ctx, opts)
+}
+
+func (c CronWorkflowsEnforced) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *wfv1.CronWorkflow, err error) {
+	if err := c.enforcer.enforce(ctx, CronWorkflows, c.namespace, name, ActionPatch); err != nil {
+		return nil, err
+	}
+	return c.delegate.Patch(ctx, name, pt, data, opts, subresources...)
+}

server/auth/casbin/CustomEnforcer.go

@@ -0,0 +1,84 @@
+package casbin
+
+import (
+	"context"
+	authclaims "github.com/argoproj/argo-workflows/v3/server/auth/types"
+	"github.com/casbin/casbin/v2"
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"os"
+	"sync"
+)
+
+
+const (
+	ActionGet      = "get"
+	ActionCreate   = "create"
+	ActionUpdate   = "update"
+	ActionDelete   = "delete"
+	ActionList     = "list"
+	ActionPatch    = "patch"
+	ActionWatch    = "watch"
+	ActionDeleteCollection   = "deletecollection"
+)
+
+type CustomEnforcer struct {
+	enforcer casbin.Enforcer
+}
+
+var (
+	GetClaims func(ctx context.Context) *authclaims.Claims
+	instance *CustomEnforcer
+	onlyOnce = sync.Once{}
+)
+
+func GetCustomEnforcerInstance() *CustomEnforcer {
+	onlyOnce.Do(func () {
+		log.Debug("Initializing custom enforcer.")
+
+		e, err := casbin.NewEnforcer("casbin/model.conf", "casbin/policy.csv")
+		if os.IsNotExist(err) {
+			log.WithError(err).Info("Casbin RBAC disabled")
+			e.EnableEnforce(false)
+		}
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		// TODO - add config
+		e.EnableLog(false)
+		instance = &CustomEnforcer{enforcer: *e}
+	})
+
+	return instance
+}
+
+func (e *CustomEnforcer) enforce(ctx context.Context, resource, namespace, name, verb string) error {
+	claims := GetClaims(ctx)
+
+	sub := Sub{Sub: "anonymous"}
+	if claims != nil {
+		sub.Sub = claims.Subject
+		sub.Groups = claims.Groups
+	}
+
+	obj := Obj{Resource: resource, Namespace: namespace, Name: name}
+	act := verb
+
+	logCtx := log.WithFields(log.Fields{"subject": sub.String(), "resource": obj.Resource, "namespace": obj.Namespace, "name": obj.Name,"action": act})
+
+	logCtx.Debug("Enforcing")
+	for _, group := range append([]string{sub.Sub}, sub.Groups...) {
+		if ok, err := e.enforcer.Enforce(group, obj, act); err != nil {
+			return err
+		} else if ok {
+			logCtx.Info("permission granted")
+			return nil
+		}
+	}
+
+	logCtx.Info("permission denied")
+	return status.Error(codes.PermissionDenied, "not allowed")
+
+}

server/auth/casbin/DynamicEnforcedInterface.go

@@ -0,0 +1,63 @@
+package casbin
+
+import (
+	"context"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/dynamic"
+)
+
+type DynamicEnforcedInterface struct {
+	delegate dynamic.Interface
+}
+
+func (d DynamicEnforcedInterface) Namespace(s string) dynamic.ResourceInterface {
+	return d
+}
+
+func (d DynamicEnforcedInterface) Create(ctx context.Context, obj *unstructured.Unstructured, options metav1.CreateOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Update(ctx context.Context, obj *unstructured.Unstructured, options metav1.UpdateOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) UpdateStatus(ctx context.Context, obj *unstructured.Unstructured, options metav1.UpdateOptions) (*unstructured.Unstructured, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Delete(ctx context.Context, name string, options metav1.DeleteOptions, subresources ...string) error {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) DeleteCollection(ctx context.Context, options metav1.DeleteOptions, listOptions metav1.ListOptions) error {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Get(ctx context.Context, name string, options metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) List(ctx context.Context, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, options metav1.PatchOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	panic("implement me")
+}
+
+func (d DynamicEnforcedInterface) Resource(resource schema.GroupVersionResource) dynamic.NamespaceableResourceInterface {
+	return d
+}
+
+func WrapDynamicInterface(d dynamic.Interface) dynamic.Interface {
+	return &DynamicEnforcedInterface{ d }
+}