image-server: adding authentication

Author: Erez Freiberger

pkg/cmd/types.go

@@ -2,6 +2,14 @@ package cmd
 
 import (
 	"fmt"
+	server "github.com/simon3z/image-inspector/pkg/imageserver"
+)
+
+var (
+	serverAuthOptions = []string{
+		string(server.AllowAll),
+		string(server.KubernetesToken),
+	}
 )
 
 // ImageInspectorOptions is the main inspector implementation and holds the configuration
@@ -24,19 +32,22 @@ type ImageInspectorOptions struct {
 	// PasswordFile is the location of the file containing the password for authentication to the
 	// docker registry.
 	PasswordFile string
+	// ServerAuthType is the type of authentication used to access the server
+	ServerAuthType string
 }
 
 // NewDefaultImageInspectorOptions provides a new ImageInspectorOptions with default values.
 func NewDefaultImageInspectorOptions() *ImageInspectorOptions {
 	return &ImageInspectorOptions{
-		URI:          "unix:///var/run/docker.sock",
-		Image:        "",
-		DstPath:      "",
-		Serve:        "",
-		Chroot:       false,
-		DockerCfg:    "",
-		Username:     "",
-		PasswordFile: "",
+		URI:            "unix:///var/run/docker.sock",
+		Image:          "",
+		DstPath:        "",
+		Serve:          "",
+		Chroot:         false,
+		DockerCfg:      "",
+		Username:       "",
+		PasswordFile:   "",
+		ServerAuthType: "None",
 	}
 }
 
@@ -57,5 +68,17 @@ func (i *ImageInspectorOptions) Validate() error {
 	if len(i.Serve) == 0 && i.Chroot {
 		return fmt.Errorf("Change root can be used only when serving the image through webdav")
 	}
+	if !stringInSlice(i.ServerAuthType, serverAuthOptions) {
+		return fmt.Errorf("server-auth-type can only be one of %v", serverAuthOptions)
+	}
 	return nil
 }
+
+func stringInSlice(str string, list []string) bool {
+	for _, t := range list {
+		if t == str {
+			return true
+		}
+	}
+	return false
+}

pkg/imageserver/types.go

@@ -4,6 +4,13 @@ import (
 	docker "github.com/fsouza/go-dockerclient"
 )
 
+type AuthenticationType string
+
+const (
+	AllowAll        AuthenticationType = "None"
+	KubernetesToken AuthenticationType = "KubenetesToken"
+)
+
 // ImageServer abstracts the serving of image information.
 type ImageServer interface {
 	// ServeImage Serves the image
@@ -34,4 +41,6 @@ type ImageServerOptions struct {
 	// NOTE: if the image server supports a chroot the server implementation will perform
 	// the chroot based on this URL.
 	ImageServeURL string
+	// AuthType is the type of authentication used to access the server
+	AuthType AuthenticationType
 }

pkg/imageserver/webdav.go

@@ -10,6 +10,10 @@ import (
 	"golang.org/x/net/webdav"
 
 	docker "github.com/fsouza/go-dockerclient"
+
+	kauthapi "k8s.io/kubernetes/pkg/apis/authorization"
+	krestclient "k8s.io/kubernetes/pkg/client/restclient"
+	kclient "k8s.io/kubernetes/pkg/client/unversioned"
 )
 
 const (
@@ -55,29 +59,93 @@ func (s *webdavImageServer) ServeImage(imageMetadata *docker.Image) error {
 		w.Write([]byte("ok\n"))
 	})
 
-	http.HandleFunc(s.opts.APIURL, func(w http.ResponseWriter, r *http.Request) {
+	http.HandleFunc(s.opts.APIURL, s.handlerFuncAuth(func(w http.ResponseWriter, r *http.Request) {
 		body, err := json.MarshalIndent(s.opts.APIVersions, "", "  ")
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
 		w.Write(body)
-	})
+	}))
 
-	http.HandleFunc(s.opts.MetadataURL, func(w http.ResponseWriter, r *http.Request) {
+	http.HandleFunc(s.opts.MetadataURL, s.handlerFuncAuth(func(w http.ResponseWriter, r *http.Request) {
 		body, err := json.MarshalIndent(imageMetadata, "", "  ")
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
 		w.Write(body)
-	})
+	}))
 
-	http.Handle(s.opts.ContentURL, &webdav.Handler{
+	http.Handle(s.opts.ContentURL, s.newAuthenticatedHandler(&webdav.Handler{
 		Prefix:     s.opts.ContentURL,
 		FileSystem: webdav.Dir(servePath),
 		LockSystem: webdav.NewMemLS(),
-	})
+	}))
 
 	return http.ListenAndServe(s.opts.ServePath, nil)
 }
+
+func (s *webdavImageServer) authenticate(r *http.Request) (bool, error) {
+	authenticator, ok := map[AuthenticationType]func(r *http.Request) (bool, error){
+		AllowAll:        allowAll,
+		KubernetesToken: kubernetesTokenAuth,
+	}[s.opts.AuthType]
+	if !ok {
+		return false, fmt.Errorf("%s is not a recognize authentication method", s.opts.AuthType)
+	}
+	return authenticator(r)
+}
+
+func allowAll(r *http.Request) (bool, error) {
+	return true, nil
+}
+
+func kubernetesTokenAuth(r *http.Request) (bool, error) {
+	conf, err := krestclient.InClusterConfig()
+	if err != nil {
+		return false, err
+	}
+	conf.BearerToken = r.Header.Get("Authorization")
+	kc, err := kclient.New(conf)
+	if err != nil {
+		return false, err
+	}
+	result := &kauthapi.SubjectAccessReview{}
+	sar := &kauthapi.SubjectAccessReview{}
+	sar.Kind = "SubjectAccessReview"
+	sar.APIVersion = "v1"
+	sar.Spec.ResourceAttributes.Verb = "GET"
+	sar.Spec.ResourceAttributes.Resource = "images"
+	err = kc.Get().Resource("subjectAccessReview").Body(sar).Do().Into(result)
+	if err != nil {
+		return false, err
+	}
+	return result.Status.Allowed, nil
+}
+
+func (s *webdavImageServer) handlerFuncAuth(f http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if allowed, err := s.authenticate(r); allowed && err == nil {
+			f(w, r)
+		} else {
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+			} else {
+				http.Error(w, "Unauthorazied Access!", http.StatusForbidden)
+			}
+		}
+	}
+}
+
+type authenticatedHandler struct {
+	serveHttp func(http.ResponseWriter, *http.Request)
+}
+
+func (ah *authenticatedHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ah.serveHttp(w, r)
+}
+
+func (s *webdavImageServer) newAuthenticatedHandler(h http.Handler) http.Handler {
+	return &authenticatedHandler{serveHttp: s.handlerFuncAuth(h.ServeHTTP)}
+}

pkg/inspector/image-inspector.go

@@ -60,6 +60,7 @@ func NewDefaultImageInspector(opts iicmd.ImageInspectorOptions) ImageInspector {
 			MetadataURL:   METADATA_URL_PATH,
 			ContentURL:    CONTENT_URL_PREFIX,
 			ImageServeURL: opts.DstPath,
+			AuthType:      opts.ServerAuthType,
 		}
 		inspector.imageServer = apiserver.NewWebdavImageServer(imageServerOpts, opts.Chroot)
 	}