Compare commits
7 Commits
v0.3.0
...
upgrade-op
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
7fa3279a93 | ||
|
|
b631ab38d0 | ||
|
|
16c25c0880 | ||
|
|
5dbdf35295 | ||
|
|
5ecb311f79 | ||
|
|
e432183bd6 | ||
|
|
008075133a |
@@ -1,6 +1,6 @@
|
||||
node_modules/
|
||||
dist/
|
||||
target/
|
||||
console
|
||||
!console/
|
||||
mcs
|
||||
!mcs/
|
||||
portal-ui/node_modules/
|
||||
|
||||
2
.github/workflows/go.yml
vendored
2
.github/workflows/go.yml
vendored
@@ -33,4 +33,4 @@ jobs:
|
||||
run: |
|
||||
make verifiers
|
||||
make test
|
||||
make console
|
||||
make mcs
|
||||
|
||||
6
.gitignore
vendored
6
.gitignore
vendored
@@ -19,8 +19,8 @@ vendor/
|
||||
|
||||
# Ignore executables
|
||||
target/
|
||||
console
|
||||
!console/
|
||||
mcs
|
||||
!mcs/
|
||||
|
||||
dist/
|
||||
|
||||
@@ -31,4 +31,4 @@ public.crt
|
||||
# Ignore VsCode files
|
||||
.vscode/
|
||||
*.code-workspace
|
||||
*~
|
||||
*~
|
||||
@@ -1,6 +1,6 @@
|
||||
# This is an example goreleaser.yaml file with some sane defaults.
|
||||
# Make sure to check the documentation at http://goreleaser.com
|
||||
project_name: console
|
||||
project_name: mcs
|
||||
|
||||
before:
|
||||
hooks:
|
||||
@@ -18,12 +18,12 @@ builds:
|
||||
- arm64
|
||||
env:
|
||||
- CGO_ENABLED=0
|
||||
main: ./cmd/console/
|
||||
main: ./cmd/mcs/
|
||||
flags:
|
||||
- -trimpath
|
||||
- --tags=kqueue
|
||||
ldflags:
|
||||
- -s -w -X github.com/minio/console/pkg.ReleaseTag={{.Tag}} -X github.com/minio/console/pkg.CommitID={{.FullCommit}} -X github.com/minio/console/pkg.Version={{.Version}} -X github.com/minio/console/pkg.ShortCommitID={{.ShortCommit}} -X github.com/minio/console/pkg.ReleaseTime={{.Date}}
|
||||
- -s -w -X github.com/minio/mcs/pkg.ReleaseTag={{.Tag}} -X github.com/minio/mcs/pkg.CommitID={{.FullCommit}} -X github.com/minio/mcs/pkg.Version={{.Version}} -X github.com/minio/mcs/pkg.ShortCommitID={{.ShortCommit}} -X github.com/minio/mcs/pkg.ReleaseTime={{.Date}}
|
||||
archives:
|
||||
-
|
||||
replacements:
|
||||
@@ -51,7 +51,7 @@ changelog:
|
||||
nfpms:
|
||||
-
|
||||
vendor: MinIO Inc.
|
||||
homepage: https://github.com/minio/console
|
||||
homepage: https://github.com/minio/mcs
|
||||
maintainer: MinIO <minio@minio.io>
|
||||
description: MinIO Console Server
|
||||
license: GNU Affero General Public License v3.0
|
||||
@@ -71,5 +71,5 @@ dockers:
|
||||
goarch: amd64
|
||||
dockerfile: Dockerfile.release
|
||||
image_templates:
|
||||
- "minio/console:{{ .Tag }}"
|
||||
- "minio/console:latest"
|
||||
- "minio/mcs:{{ .Tag }}"
|
||||
- "minio/mcs:latest"
|
||||
|
||||
@@ -20,7 +20,7 @@ make swagger-gen
|
||||
|
||||
This will update all the necessary code.
|
||||
|
||||
`./restapi/configure_console.go` is a file that contains the handlers to be used by the application, here is the only place where we need to update our code to support the new apis. This file is not affected when running the swagger generator and it is safe to edit.
|
||||
`./restapi/configure_mcs.go` is a file that contains the handlers to be used by the application, here is the only place where we need to update our code to support the new apis. This file is not affected when running the swagger generator and it is safe to edit.
|
||||
|
||||
## Unit Tests
|
||||
`./restapi/handlers_test.go` needs to be updated with the proper tests for the new api.
|
||||
@@ -47,7 +47,7 @@ $ git push origin my-new-feature
|
||||
Pull requests can be created via GitHub. Refer to [this document](https://help.github.com/articles/creating-a-pull-request/) for detailed steps on how to create a pull request. After a Pull Request gets peer reviewed and approved, it will be merged.
|
||||
|
||||
## FAQs
|
||||
### How does ``console`` manages dependencies?
|
||||
### How does ``mcs`` manages dependencies?
|
||||
``MinIO`` uses `go mod` to manage its dependencies.
|
||||
- Run `go get foo/bar` in the source folder to add the dependency to `go.mod` file.
|
||||
|
||||
@@ -55,5 +55,5 @@ To remove a dependency
|
||||
- Edit your code and remove the import reference.
|
||||
- Run `go mod tidy` in the source folder to remove dependency from `go.mod` file.
|
||||
|
||||
### What are the coding guidelines for console?
|
||||
``console`` is fully conformant with Golang style. Refer: [Effective Go](https://github.com/golang/go/wiki/CodeReviewComments) article from Golang project. If you observe offending code, please feel free to send a pull request or ping us on [Slack](https://slack.min.io).
|
||||
### What are the coding guidelines for mcs?
|
||||
``mcs`` is fully conformant with Golang style. Refer: [Effective Go](https://github.com/golang/go/wiki/CodeReviewComments) article from Golang project. If you observe offending code, please feel free to send a pull request or ping us on [Slack](https://slack.min.io).
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# LDAP authentication with Console
|
||||
# LDAP authentication with MCS
|
||||
|
||||
## Setup
|
||||
|
||||
@@ -32,13 +32,13 @@ dn: ou=groups,dc=example,dc=org
|
||||
objectclass:organizationalunit
|
||||
ou: groups
|
||||
description: generic groups branch
|
||||
# create consoleAdmin group (this already exists on minio and have a policy of s3::*)
|
||||
dn: cn=consoleAdmin,ou=groups,dc=example,dc=org
|
||||
# create mcsAdmin group (this already exists on minio and have a policy of s3::*)
|
||||
dn: cn=mcsAdmin,ou=groups,dc=example,dc=org
|
||||
objectClass: top
|
||||
objectClass: posixGroup
|
||||
gidNumber: 678
|
||||
# Assing group to new user
|
||||
dn: cn=consoleAdmin,ou=groups,dc=example,dc=org
|
||||
dn: cn=mcsAdmin,ou=groups,dc=example,dc=org
|
||||
changetype: modify
|
||||
add: memberuid
|
||||
memberuid: billy
|
||||
@@ -48,7 +48,7 @@ $ docker cp billy.ldif my-openldap-container:/container/service/slapd/assets/tes
|
||||
$ docker exec my-openldap-container ldapadd -x -D "cn=admin,dc=example,dc=org" -w admin -f /container/service/slapd/assets/test/billy.ldif -H ldap://localhost -ZZ
|
||||
```
|
||||
|
||||
Query the ldap server to check the user billy was created correctly and got assigned to the consoleAdmin group, you should get a list
|
||||
Query the ldap server to check the user billy was created correctly and got assigned to the mcsAdmin group, you should get a list
|
||||
containing ldap users and groups.
|
||||
|
||||
```
|
||||
@@ -73,9 +73,9 @@ Re-enter new password:
|
||||
Enter LDAP Password:
|
||||
```
|
||||
|
||||
### Add the consoleAdmin policy to user billy on MinIO
|
||||
### Add the mcsAdmin policy to user billy on MinIO
|
||||
```
|
||||
$ cat > consoleAdmin.json << EOF
|
||||
$ cat > mcsAdmin.json << EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
@@ -99,8 +99,8 @@ $ cat > consoleAdmin.json << EOF
|
||||
]
|
||||
}
|
||||
EOF
|
||||
$ mc admin policy add myminio consoleAdmin consoleAdmin.json
|
||||
$ mc admin policy set myminio consoleAdmin user=billy
|
||||
$ mc admin policy add myminio mcsAdmin mcsAdmin.json
|
||||
$ mc admin policy set myminio mcsAdmin user=billy
|
||||
```
|
||||
|
||||
## Run MinIO
|
||||
@@ -116,12 +116,12 @@ export MINIO_IDENTITY_LDAP_SERVER_INSECURE=on
|
||||
./minio server ~/Data
|
||||
```
|
||||
|
||||
## Run Console
|
||||
## Run MCS
|
||||
|
||||
```
|
||||
export CONSOLE_ACCESS_KEY=minio
|
||||
export CONSOLE_SECRET_KEY=minio123
|
||||
export MCS_ACCESS_KEY=minio
|
||||
export MCS_SECRET_KEY=minio123
|
||||
...
|
||||
export CONSOLE_LDAP_ENABLED=on
|
||||
./console server
|
||||
export MCS_LDAP_ENABLED=on
|
||||
./mcs server
|
||||
```
|
||||
|
||||
16
Dockerfile
16
Dockerfile
@@ -2,25 +2,25 @@ FROM golang:1.13
|
||||
|
||||
RUN apt-get update -y && apt-get install -y ca-certificates
|
||||
|
||||
ADD go.mod /go/src/github.com/minio/console/go.mod
|
||||
ADD go.sum /go/src/github.com/minio/console/go.sum
|
||||
WORKDIR /go/src/github.com/minio/console/
|
||||
ADD go.mod /go/src/github.com/minio/mcs/go.mod
|
||||
ADD go.sum /go/src/github.com/minio/mcs/go.sum
|
||||
WORKDIR /go/src/github.com/minio/mcs/
|
||||
|
||||
# Get dependencies - will also be cached if we won't change mod/sum
|
||||
RUN go mod download
|
||||
|
||||
ADD . /go/src/github.com/minio/console/
|
||||
WORKDIR /go/src/github.com/minio/console/
|
||||
ADD . /go/src/github.com/minio/mcs/
|
||||
WORKDIR /go/src/github.com/minio/mcs/
|
||||
|
||||
ENV CGO_ENABLED=0
|
||||
|
||||
RUN go build -ldflags "-w -s" -a -o console ./cmd/console
|
||||
RUN go build -ldflags "-w -s" -a -o mcs ./cmd/mcs
|
||||
|
||||
FROM scratch
|
||||
MAINTAINER MinIO Development "dev@min.io"
|
||||
EXPOSE 9090
|
||||
|
||||
COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
||||
COPY --from=0 /go/src/github.com/minio/console/console .
|
||||
COPY --from=0 /go/src/github.com/minio/mcs/mcs .
|
||||
|
||||
CMD ["/console"]
|
||||
CMD ["/mcs"]
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM scratch
|
||||
MAINTAINER MinIO Development "dev@min.io"
|
||||
EXPOSE 9090
|
||||
COPY console /console
|
||||
COPY mcs /mcs
|
||||
|
||||
ENTRYPOINT ["/console"]
|
||||
ENTRYPOINT ["/mcs"]
|
||||
|
||||
32
Makefile
32
Makefile
@@ -3,19 +3,19 @@ GOPATH := $(shell go env GOPATH)
|
||||
# Sets the build version based on the output of the following command, if we are building for a tag, that's the build else it uses the current git branch as the build
|
||||
BUILD_VERSION:=$(shell git describe --exact-match --tags $(git log -n1 --pretty='%h') 2>/dev/null || git rev-parse --abbrev-ref HEAD 2>/dev/null)
|
||||
BUILD_TIME:=$(shell date 2>/dev/null)
|
||||
TAG ?= "minio/console:$(VERSION)-dev"
|
||||
TAG ?= "minio/m3:$(VERSION)-dev"
|
||||
|
||||
default: console
|
||||
default: mcs
|
||||
|
||||
.PHONY: console
|
||||
console:
|
||||
@echo "Building Console binary to './console'"
|
||||
@(GO111MODULE=on CGO_ENABLED=0 go build -trimpath --tags=kqueue --ldflags "-s -w" -o console ./cmd/console)
|
||||
.PHONY: mcs
|
||||
mcs:
|
||||
@echo "Building mcs binary to './mcs'"
|
||||
@(GO111MODULE=on CGO_ENABLED=0 go build -trimpath --tags=kqueue --ldflags "-s -w" -o mcs ./cmd/mcs)
|
||||
|
||||
k8sdev:
|
||||
@docker build -t $(TAG) --build-arg build_version=$(BUILD_VERSION) --build-arg build_time='$(BUILD_TIME)' .
|
||||
@kind load docker-image $(TAG)
|
||||
@echo "Done, now restart your console deployment"
|
||||
@echo "Done, now restart your mcs deployment"
|
||||
|
||||
getdeps:
|
||||
@mkdir -p ${GOPATH}/bin
|
||||
@@ -33,32 +33,32 @@ lint:
|
||||
@GO111MODULE=on ${GOPATH}/bin/golangci-lint cache clean
|
||||
@GO111MODULE=on ${GOPATH}/bin/golangci-lint run --timeout=5m --config ./.golangci.yml
|
||||
|
||||
install: console
|
||||
@echo "Installing console binary to '$(GOPATH)/bin/console'"
|
||||
@mkdir -p $(GOPATH)/bin && cp -f $(PWD)/console $(GOPATH)/bin/console
|
||||
@echo "Installation successful. To learn more, try \"console --help\"."
|
||||
install: mcs
|
||||
@echo "Installing mcs binary to '$(GOPATH)/bin/mcs'"
|
||||
@mkdir -p $(GOPATH)/bin && cp -f $(PWD)/mcs $(GOPATH)/bin/mcs
|
||||
@echo "Installation successful. To learn more, try \"mcs --help\"."
|
||||
|
||||
swagger-gen:
|
||||
@echo "Generating swagger server code from yaml"
|
||||
@rm -rf models
|
||||
@rm -rf restapi/operations
|
||||
@swagger generate server -A console --main-package=console --exclude-main -P models.Principal -f ./swagger.yml -r NOTICE
|
||||
@swagger generate server -A mcs --main-package=mcs --exclude-main -P models.Principal -f ./swagger.yml -r NOTICE
|
||||
|
||||
assets:
|
||||
@(cd portal-ui; yarn install; make build-static; cd ..)
|
||||
|
||||
test:
|
||||
@(GO111MODULE=on go test -race -v github.com/minio/console/restapi/...)
|
||||
@(GO111MODULE=on go test -race -v github.com/minio/console/pkg/...)
|
||||
@(GO111MODULE=on go test -race -v github.com/minio/mcs/restapi/...)
|
||||
@(GO111MODULE=on go test -race -v github.com/minio/mcs/pkg/...)
|
||||
|
||||
coverage:
|
||||
@(GO111MODULE=on go test -v -coverprofile=coverage.out github.com/minio/console/restapi/... && go tool cover -html=coverage.out && open coverage.html)
|
||||
@(GO111MODULE=on go test -v -coverprofile=coverage.out github.com/minio/mcs/restapi/... && go tool cover -html=coverage.out && open coverage.html)
|
||||
|
||||
clean:
|
||||
@echo "Cleaning up all the generated files"
|
||||
@find . -name '*.test' | xargs rm -fv
|
||||
@find . -name '*~' | xargs rm -fv
|
||||
@rm -vf console
|
||||
@rm -vf mcs
|
||||
|
||||
docker:
|
||||
@docker build -t $(TAG) --build-arg build_version=$(BUILD_VERSION) --build-arg build_time='$(BUILD_TIME)' .
|
||||
|
||||
46
README.md
46
README.md
@@ -9,20 +9,20 @@ A graphical user interface for [MinIO](https://github.com/minio/minio)
|
||||
|
||||
## Setup
|
||||
|
||||
All `console` needs is a MinIO user with admin privileges and URL pointing to your MinIO deployment.
|
||||
All `mcs` needs is a MinIO user with admin privileges and URL pointing to your MinIO deployment.
|
||||
> Note: We don't recommend using MinIO's Operator Credentials
|
||||
|
||||
1. Create a user for `console` using `mc`.
|
||||
1. Create a user for `mcs` using `mc`.
|
||||
```
|
||||
$ set +o history
|
||||
$ mc admin user add myminio console YOURCONSOLESECRET
|
||||
$ mc admin user add myminio mcs YOURMCSSECRET
|
||||
$ set -o history
|
||||
```
|
||||
|
||||
2. Create a policy for `console` with access to everything (for testing and debugging)
|
||||
2. Create a policy for `mcs` with access to everything (for testing and debugging)
|
||||
|
||||
```
|
||||
$ cat > consoleAdmin.json << EOF
|
||||
$ cat > mcsAdmin.json << EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [{
|
||||
@@ -45,18 +45,18 @@ $ cat > consoleAdmin.json << EOF
|
||||
]
|
||||
}
|
||||
EOF
|
||||
$ mc admin policy add myminio consoleAdmin consoleAdmin.json
|
||||
$ mc admin policy add myminio mcsAdmin mcsAdmin.json
|
||||
```
|
||||
|
||||
3. Set the policy for the new `console` user
|
||||
3. Set the policy for the new `mcs` user
|
||||
|
||||
```
|
||||
$ mc admin policy set myminio consoleAdmin user=console
|
||||
$ mc admin policy set myminio mcsAdmin user=mcs
|
||||
```
|
||||
|
||||
|
||||
### Note
|
||||
Additionally, you can create policies to limit the privileges for `console` users, for example, if you want the user to only have access to dashboard, buckets, notifications and watch page, the policy should look like this:
|
||||
Additionally, you can create policies to limit the privileges for `mcs` users, for example, if you want the user to only have access to dashboard, buckets, notifications and watch page, the policy should look like this:
|
||||
```
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
@@ -97,34 +97,34 @@ Additionally, you can create policies to limit the privileges for `console` user
|
||||
}
|
||||
```
|
||||
|
||||
## Run Console server
|
||||
## Run MCS server
|
||||
To run the server:
|
||||
|
||||
```
|
||||
export CONSOLE_HMAC_JWT_SECRET=YOURJWTSIGNINGSECRET
|
||||
export MCS_HMAC_JWT_SECRET=YOURJWTSIGNINGSECRET
|
||||
|
||||
#required to encrypt jwet payload
|
||||
export CONSOLE_PBKDF_PASSPHRASE=SECRET
|
||||
export MCS_PBKDF_PASSPHRASE=SECRET
|
||||
|
||||
#required to encrypt jwet payload
|
||||
export CONSOLE_PBKDF_SALT=SECRET
|
||||
export MCS_PBKDF_SALT=SECRET
|
||||
|
||||
export CONSOLE_ACCESS_KEY=console
|
||||
export CONSOLE_SECRET_KEY=YOURCONSOLESECRET
|
||||
export CONSOLE_MINIO_SERVER=http://localhost:9000
|
||||
./console server
|
||||
export MCS_ACCESS_KEY=mcs
|
||||
export MCS_SECRET_KEY=YOURMCSSECRET
|
||||
export MCS_MINIO_SERVER=http://localhost:9000
|
||||
./mcs server
|
||||
```
|
||||
|
||||
## Connect Console to a Minio using TLS and a self-signed certificate
|
||||
## Connect MCS to a Minio using TLS and a self-signed certificate
|
||||
|
||||
```
|
||||
...
|
||||
export CONSOLE_MINIO_SERVER_TLS_ROOT_CAS=<certificate_file_name>
|
||||
export CONSOLE_MINIO_SERVER=https://localhost:9000
|
||||
./console server
|
||||
export MCS_MINIO_SERVER_TLS_ROOT_CAS=<certificate_file_name>
|
||||
export MCS_MINIO_SERVER=https://localhost:9000
|
||||
./mcs server
|
||||
```
|
||||
|
||||
You can verify that the apis work by doing the request on `localhost:9090/api/v1/...`
|
||||
|
||||
# Contribute to console Project
|
||||
Please follow console [Contributor's Guide](https://github.com/minio/console/blob/master/CONTRIBUTING.md)
|
||||
# Contribute to mcs Project
|
||||
Please follow mcs [Contributor's Guide](https://github.com/minio/mcs/blob/master/CONTRIBUTING.md)
|
||||
|
||||
@@ -2,12 +2,12 @@
|
||||
|
||||
## Supported Versions
|
||||
|
||||
We always provide security updates for the [latest release](https://github.com/minio/console/releases/latest).
|
||||
We always provide security updates for the [latest release](https://github.com/minio/mcs/releases/latest).
|
||||
Whenever there is a security update you just need to upgrade to the latest version.
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
All security bugs in [minio/console](https://github,com/minio/console) (or other minio/* repositories)
|
||||
All security bugs in [minio/mcs](https://github,com/minio/mcs) (or other minio/* repositories)
|
||||
should be reported by email to security@min.io. Your email will be acknowledged within 48 hours,
|
||||
and you'll receive a more detailed response to your email within 72 hours indicating the next steps
|
||||
in handling your report.
|
||||
|
||||
@@ -39,19 +39,19 @@ func GetK8sAPIServer() string {
|
||||
// if console is not running inside k8s by default will look for the k8s api server on localhost:8001 (kubectl proxy)
|
||||
// NOTE: using kubectl proxy is for local development only, since every request send to localhost:8001 will bypass service account authentication
|
||||
// more info here: https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#directly-accessing-the-rest-api
|
||||
// you can override this using CONSOLE_K8S_API_SERVER, ie use the k8s cluster from `kubectl config view`
|
||||
// you can override this using MCS_K8S_API_SERVER, ie use the k8s cluster from `kubectl config view`
|
||||
host, port := env.Get("KUBERNETES_SERVICE_HOST", ""), env.Get("KUBERNETES_SERVICE_PORT", "")
|
||||
apiServerAddress := "http://localhost:8001"
|
||||
if host != "" && port != "" {
|
||||
apiServerAddress = "https://" + net.JoinHostPort(host, port)
|
||||
}
|
||||
return env.Get(ConsoleK8sAPIServer, apiServerAddress)
|
||||
return env.Get(McsK8sAPIServer, apiServerAddress)
|
||||
}
|
||||
|
||||
// If CONSOLE_K8S_API_SERVER_TLS_ROOT_CA is true console will load the certificate into the
|
||||
// If MCS_K8S_API_SERVER_TLS_ROOT_CA is true mcs will load the certificate into the
|
||||
// http.client rootCAs pool, this is useful for testing an k8s ApiServer or when working with self-signed certificates
|
||||
func getK8sAPIServerTLSRootCA() string {
|
||||
return strings.TrimSpace(env.Get(ConsoleK8SAPIServerTLSRootCA, ""))
|
||||
return strings.TrimSpace(env.Get(McsK8SAPIServerTLSRootCA, ""))
|
||||
}
|
||||
|
||||
// GetNsFromFile assumes console is running inside a k8s pod and extract the current namespace from the
|
||||
@@ -69,7 +69,7 @@ var namespace = GetNsFromFile()
|
||||
|
||||
// Returns the namespace in which the controller is installed
|
||||
func GetNs() string {
|
||||
return env.Get(ConsoleNamespace, namespace)
|
||||
return env.Get(McsNamespace, namespace)
|
||||
}
|
||||
|
||||
// getLatestMinIOImage returns the latest docker image for MinIO if found on the internet
|
||||
@@ -106,7 +106,7 @@ var latestMinIOImage, errLatestMinIOImage = getLatestMinIOImage(
|
||||
// a preferred image to be used (configured via ENVIRONMENT VARIABLES) GetMinioImage will return that
|
||||
// if not, GetMinioImage will try to obtain the image URL for the latest version of MinIO and return that
|
||||
func GetMinioImage() (*string, error) {
|
||||
image := strings.TrimSpace(env.Get(ConsoleMinioImage, ""))
|
||||
image := strings.TrimSpace(env.Get(McsMinioImage, ""))
|
||||
// if there is a preferred image configured by the user we'll always return that
|
||||
if image != "" {
|
||||
return &image, nil
|
||||
@@ -156,7 +156,7 @@ func getLatestMCImage() (*string, error) {
|
||||
var latestMCImage, errLatestMCImage = getLatestMCImage()
|
||||
|
||||
func GetMCImage() (*string, error) {
|
||||
image := strings.TrimSpace(env.Get(ConsoleMCImage, ""))
|
||||
image := strings.TrimSpace(env.Get(McsMCImage, ""))
|
||||
// if there is a preferred image configured by the user we'll always return that
|
||||
if image != "" {
|
||||
return &image, nil
|
||||
|
||||
@@ -17,9 +17,9 @@
|
||||
package cluster
|
||||
|
||||
const (
|
||||
ConsoleK8sAPIServer = "CONSOLE_K8S_API_SERVER"
|
||||
ConsoleK8SAPIServerTLSRootCA = "CONSOLE_K8S_API_SERVER_TLS_ROOT_CA"
|
||||
ConsoleMinioImage = "CONSOLE_MINIO_IMAGE"
|
||||
ConsoleMCImage = "CONSOLE_MC_IMAGE"
|
||||
ConsoleNamespace = "CONSOLE_NAMESPACE"
|
||||
McsK8sAPIServer = "MCS_K8S_API_SERVER"
|
||||
McsK8SAPIServerTLSRootCA = "MCS_K8S_API_SERVER_TLS_ROOT_CA"
|
||||
McsMinioImage = "MCS_MINIO_IMAGE"
|
||||
McsMCImage = "MCS_MC_IMAGE"
|
||||
McsNamespace = "MCS_NAMESPACE"
|
||||
)
|
||||
|
||||
@@ -23,7 +23,7 @@ import (
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
"github.com/minio/console/pkg"
|
||||
"github.com/minio/mcs/pkg"
|
||||
|
||||
"github.com/minio/minio/pkg/console"
|
||||
"github.com/minio/minio/pkg/trie"
|
||||
@@ -32,8 +32,8 @@ import (
|
||||
"github.com/minio/cli"
|
||||
)
|
||||
|
||||
// Help template for Console.
|
||||
var consoleHelpTemplate = `NAME:
|
||||
// Help template for mcs.
|
||||
var mcsHelpTemplate = `NAME:
|
||||
{{.Name}} - {{.Usage}}
|
||||
|
||||
DESCRIPTION:
|
||||
@@ -57,10 +57,10 @@ var appCmds = []cli.Command{
|
||||
}
|
||||
|
||||
func newApp(name string) *cli.App {
|
||||
// Collection of console commands currently supported are.
|
||||
// Collection of mcs commands currently supported are.
|
||||
var commands []cli.Command
|
||||
|
||||
// Collection of console commands currently supported in a trie tree.
|
||||
// Collection of mcs commands currently supported in a trie tree.
|
||||
commandsTree := trie.NewTrie()
|
||||
|
||||
// registerCommand registers a cli command.
|
||||
@@ -112,9 +112,9 @@ func newApp(name string) *cli.App {
|
||||
app.Compiled, _ = time.Parse(time.RFC3339, pkg.ReleaseTime)
|
||||
app.Commands = commands
|
||||
app.HideHelpCommand = true // Hide `help, h` command, we already have `minio --help`.
|
||||
app.CustomAppHelpTemplate = consoleHelpTemplate
|
||||
app.CustomAppHelpTemplate = mcsHelpTemplate
|
||||
app.CommandNotFound = func(ctx *cli.Context, command string) {
|
||||
console.Printf("‘%s’ is not a console sub-command. See ‘console --help’.\n", command)
|
||||
console.Printf("‘%s’ is not a mcs sub-command. See ‘mcs --help’.\n", command)
|
||||
closestCommands := findClosestCommands(command)
|
||||
if len(closestCommands) > 0 {
|
||||
console.Println()
|
||||
@@ -24,15 +24,15 @@ import (
|
||||
"github.com/go-openapi/loads"
|
||||
"github.com/jessevdk/go-flags"
|
||||
"github.com/minio/cli"
|
||||
"github.com/minio/console/restapi"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/mcs/restapi"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
)
|
||||
|
||||
// starts the server
|
||||
var serverCmd = cli.Command{
|
||||
Name: "server",
|
||||
Aliases: []string{"srv"},
|
||||
Usage: "starts Console server",
|
||||
Usage: "starts mcs server",
|
||||
Action: startServer,
|
||||
Flags: []cli.Flag{
|
||||
cli.StringFlag{
|
||||
@@ -75,7 +75,7 @@ func startServer(ctx *cli.Context) error {
|
||||
log.Fatalln(err)
|
||||
}
|
||||
|
||||
api := operations.NewConsoleAPI(swaggerSpec)
|
||||
api := operations.NewMcsAPI(swaggerSpec)
|
||||
server := restapi.NewServer(api)
|
||||
defer server.Shutdown()
|
||||
|
||||
@@ -112,7 +112,7 @@ func startServer(ctx *cli.Context) error {
|
||||
if tlsCertificatePath != "" && tlsCertificateKeyPath != "" {
|
||||
server.TLSCertificate = flags.Filename(tlsCertificatePath)
|
||||
server.TLSCertificateKey = flags.Filename(tlsCertificateKeyPath)
|
||||
// If TLS certificates are provided enforce the HTTPS schema, meaning console will redirect
|
||||
// If TLS certificates are provided enforce the HTTPS schema, meaning mcs will redirect
|
||||
// plain HTTP connections to HTTPS server
|
||||
server.EnabledListeners = []string{"http", "https"}
|
||||
server.TLSPort = ctx.Int("tls-port")
|
||||
@@ -1,39 +0,0 @@
|
||||
# Running Console in Operator mode
|
||||
|
||||
`Console` will authenticate against `Kubernetes`using bearer tokens via HTTP `Authorization` header. The user will provide this token once
|
||||
in the login form, Console will validate it against Kubernetes (list apis) and if valid will generate and return a new Console sessions
|
||||
with encrypted claims (the user Service account token will be inside the JWT in the data field)
|
||||
|
||||
# Kubernetes
|
||||
|
||||
The provided `JWT token` corresponds to the `Kubernetes service account` that `Console` will use to run tasks on behalf of the
|
||||
user, ie: list, create, edit, delete tenants, storage class, etc.
|
||||
|
||||
|
||||
# Development
|
||||
|
||||
If console is running inside a k8s pod `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` will contain the k8s api server apiServerAddress
|
||||
if console is not running inside k8s by default will look for the k8s api server on `localhost:8001` (kubectl proxy)
|
||||
|
||||
If you are running console in your local environment and wish to make request to `Kubernetes` you can set `CONSOLE_K8S_API_SERVER`, if
|
||||
the environment variable is not present by default `Console` will use `"http://localhost:8001"`, additionally you will need to set the
|
||||
`CONSOLE_OPERATOR_MODE=on` variable to make Console display the Operator UI.
|
||||
|
||||
NOTE: using `kubectl` proxy is for local development only, since every request send to localhost:8001 will bypass service account authentication
|
||||
more info here: https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#directly-accessing-the-rest-api
|
||||
you can override this using `CONSOLE_K8S_API_SERVER`, ie use the k8s cluster from `kubectl config view`
|
||||
|
||||
## Extract the Service account token and use it with Console
|
||||
|
||||
For local development you can use the jwt associated to the `console-sa` service account, you can get the token running
|
||||
the following command in your terminal:
|
||||
|
||||
```
|
||||
kubectl get secret $(kubectl get serviceaccount console-sa -o jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64 --decode
|
||||
```
|
||||
|
||||
Then run the Console server
|
||||
|
||||
```
|
||||
CONSOLE_OPERATOR_MODE=on ./console server
|
||||
```
|
||||
39
docs/mcs_operator_mode.md
Normal file
39
docs/mcs_operator_mode.md
Normal file
@@ -0,0 +1,39 @@
|
||||
# Running MCS in Operator mode
|
||||
|
||||
`MCS` will authenticate against `Kubernetes`using bearer tokens via HTTP `Authorization` header. The user will provide this token once
|
||||
in the login form, MCS will validate it against Kubernetes (list apis) and if valid will generate and return a new MCS sessions
|
||||
with encrypted claims (the user Service account token will be inside the JWT in the data field)
|
||||
|
||||
# Kubernetes
|
||||
|
||||
The provided `JWT token` corresponds to the `Kubernetes service account` that `MCS` will use to run tasks on behalf of the
|
||||
user, ie: list, create, edit, delete tenants, storage class, etc.
|
||||
|
||||
|
||||
# Development
|
||||
|
||||
If console is running inside a k8s pod `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` will contain the k8s api server apiServerAddress
|
||||
if console is not running inside k8s by default will look for the k8s api server on `localhost:8001` (kubectl proxy)
|
||||
|
||||
If you are running mcs in your local environment and wish to make request to `Kubernetes` you can set `MCS_K8S_API_SERVER`, if
|
||||
the environment variable is not present by default `MCS` will use `"http://localhost:8001"`, additionally you will need to set the
|
||||
`MCS_OPERATOR_MODE=on` variable to make MCS display the Operator UI.
|
||||
|
||||
NOTE: using `kubectl` proxy is for local development only, since every request send to localhost:8001 will bypass service account authentication
|
||||
more info here: https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#directly-accessing-the-rest-api
|
||||
you can override this using `MCS_K8S_API_SERVER`, ie use the k8s cluster from `kubectl config view`
|
||||
|
||||
## Extract the Service account token and use it with MCS
|
||||
|
||||
For local development you can use the jwt associated to the `mcs-sa` service account, you can get the token running
|
||||
the following command in your terminal:
|
||||
|
||||
```
|
||||
kubectl get secret $(kubectl get serviceaccount mcs-sa -o jsonpath="{.secrets[0].name}") -o jsonpath="{.data.token}" | base64 --decode
|
||||
```
|
||||
|
||||
Then run the mcs server
|
||||
|
||||
```
|
||||
MCS_OPERATOR_MODE=on ./mcs server
|
||||
```
|
||||
2
go.mod
2
go.mod
@@ -1,4 +1,4 @@
|
||||
module github.com/minio/console
|
||||
module github.com/minio/mcs
|
||||
|
||||
go 1.13
|
||||
|
||||
|
||||
@@ -25,7 +25,7 @@ go get -d k8s.io/code-generator/...
|
||||
# Checkout code-generator to compatible version
|
||||
#(cd $GOPATH/src/k8s.io/code-generator && git checkout origin/release-1.14 -B release-1.14)
|
||||
|
||||
REPOSITORY=github.com/minio/console
|
||||
REPOSITORY=github.com/minio/mcs
|
||||
$GOPATH/src/k8s.io/code-generator/generate-groups.sh all \
|
||||
$REPOSITORY/pkg/clientgen $REPOSITORY/pkg/apis networking.gke.io:v1beta2 \
|
||||
--go-header-file $SCRIPT_ROOT/hack/header.go.txt
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: console-env
|
||||
data:
|
||||
CONSOLE_PORT: "9090"
|
||||
CONSOLE_TLS_PORT: "9443"
|
||||
@@ -2,10 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# beginning of customizations
|
||||
resources:
|
||||
- console-service-account.yaml
|
||||
- console-cluster-role.yaml
|
||||
- console-cluster-role-binding.yaml
|
||||
- console-configmap.yaml
|
||||
- console-service.yaml
|
||||
- console-deployment.yaml
|
||||
- mcs-service-account.yaml
|
||||
- mcs-cluster-role.yaml
|
||||
- mcs-cluster-role-binding.yaml
|
||||
- mcs-configmap.yaml
|
||||
- mcs-service.yaml
|
||||
- mcs-deployment.yaml
|
||||
- minio-operator.yaml
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: console-sa-binding
|
||||
name: mcs-sa-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: console-sa-role
|
||||
name: mcs-sa-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: console-sa
|
||||
name: mcs-sa
|
||||
namespace: default
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: console-sa-role
|
||||
name: mcs-sa-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
7
k8s/console/base/mcs-configmap.yaml
Normal file
7
k8s/console/base/mcs-configmap.yaml
Normal file
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mcs-env
|
||||
data:
|
||||
MCS_PORT: "9090"
|
||||
MCS_TLS_PORT: "9443"
|
||||
@@ -1,24 +1,24 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: console
|
||||
name: mcs
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: console
|
||||
app: mcs
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: console
|
||||
app: mcs
|
||||
spec:
|
||||
serviceAccountName: console-sa
|
||||
serviceAccountName: mcs-sa
|
||||
containers:
|
||||
- name: console
|
||||
image: minio/console:latest
|
||||
- name: mcs
|
||||
image: minio/mcs:latest
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
args:
|
||||
- /console
|
||||
- /mcs
|
||||
- server
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
@@ -1,5 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: console-sa
|
||||
name: mcs-sa
|
||||
namespace: default
|
||||
@@ -1,9 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: console
|
||||
name: mcs
|
||||
labels:
|
||||
name: console
|
||||
name: mcs
|
||||
spec:
|
||||
ports:
|
||||
- port: 9090
|
||||
@@ -11,4 +11,4 @@ spec:
|
||||
- port: 9443
|
||||
name: https
|
||||
selector:
|
||||
app: console
|
||||
app: mcs
|
||||
@@ -1,16 +1,16 @@
|
||||
#!/bin/bash
|
||||
|
||||
# setup environment variables based on flags to see if we should build the docker containers again
|
||||
CONSOLE_DOCKER="true"
|
||||
MCS_DOCKER="true"
|
||||
|
||||
# evaluate flags
|
||||
# `-m` for console
|
||||
# `-m` for mcs
|
||||
|
||||
|
||||
while getopts ":m:" opt; do
|
||||
case $opt in
|
||||
m)
|
||||
CONSOLE_DOCKER="$OPTARG"
|
||||
MCS_DOCKER="$OPTARG"
|
||||
;;
|
||||
\?)
|
||||
echo "Invalid option: -$OPTARG" >&2
|
||||
@@ -34,11 +34,11 @@ echo "install metrics server"
|
||||
kubectl apply -f metrics-dev.yaml
|
||||
|
||||
# Whether or not to build the m3 container and load it to kind or just load it
|
||||
if [[ $CONSOLE_DOCKER == "true" ]]; then
|
||||
if [[ $MCS_DOCKER == "true" ]]; then
|
||||
# Build mkube
|
||||
make --directory=".." k8sdev TAG=minio/console:latest
|
||||
make --directory=".." k8sdev TAG=minio/mcs:latest
|
||||
else
|
||||
kind load docker-image minio/console:latest
|
||||
kind load docker-image minio/mcs:latest
|
||||
fi
|
||||
|
||||
echo "done"
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: console-env
|
||||
data:
|
||||
CONSOLE_PORT: "9090"
|
||||
CONSOLE_TLS_PORT: "9443"
|
||||
@@ -2,10 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
# beginning of customizations
|
||||
resources:
|
||||
- console-service-account.yaml
|
||||
- console-cluster-role.yaml
|
||||
- console-cluster-role-binding.yaml
|
||||
- console-configmap.yaml
|
||||
- console-service.yaml
|
||||
- console-deployment.yaml
|
||||
- mcs-service-account.yaml
|
||||
- mcs-cluster-role.yaml
|
||||
- mcs-cluster-role-binding.yaml
|
||||
- mcs-configmap.yaml
|
||||
- mcs-service.yaml
|
||||
- mcs-deployment.yaml
|
||||
- minio-operator.yaml
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: console-sa-binding
|
||||
name: mcs-sa-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: console-sa-role
|
||||
name: mcs-sa-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: console-sa
|
||||
name: mcs-sa
|
||||
namespace: default
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: console-sa-role
|
||||
name: mcs-sa-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
7
k8s/operator-console/base/mcs-configmap.yaml
Normal file
7
k8s/operator-console/base/mcs-configmap.yaml
Normal file
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mcs-env
|
||||
data:
|
||||
MCS_PORT: "9090"
|
||||
MCS_TLS_PORT: "9443"
|
||||
@@ -1,27 +1,27 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: console
|
||||
name: mcs
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: console
|
||||
app: mcs
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: console
|
||||
app: mcs
|
||||
spec:
|
||||
serviceAccountName: console-sa
|
||||
serviceAccountName: mcs-sa
|
||||
containers:
|
||||
- name: console
|
||||
image: minio/console:latest
|
||||
- name: mcs
|
||||
image: minio/mcs:latest
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
env:
|
||||
- name: CONSOLE_OPERATOR_MODE
|
||||
- name: MCS_OPERATOR_MODE
|
||||
value: "on"
|
||||
args:
|
||||
- /console
|
||||
- /mcs
|
||||
- server
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
@@ -1,5 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: console-sa
|
||||
name: mcs-sa
|
||||
namespace: default
|
||||
@@ -1,9 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: console
|
||||
name: mcs
|
||||
labels:
|
||||
name: console
|
||||
name: mcs
|
||||
spec:
|
||||
ports:
|
||||
- port: 9090
|
||||
@@ -11,4 +11,4 @@ spec:
|
||||
- port: 9443
|
||||
name: https
|
||||
selector:
|
||||
app: console
|
||||
app: mcs
|
||||
@@ -26,8 +26,8 @@ CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-
|
||||
# k8s.io/kubernetes. The output-base is needed for the generators to output into the vendor dir
|
||||
# instead of the $GOPATH directly. For normal projects this can be dropped.
|
||||
bash "${CODEGEN_PKG}"/generate-groups.sh "all" \
|
||||
github.com/minio/console/pkg/generated \
|
||||
github.com/minio/console/pkg/apis \
|
||||
github.com/minio/mcs/pkg/generated \
|
||||
github.com/minio/mcs/pkg/apis \
|
||||
mkube:v1 \
|
||||
--go-header-file "${SCRIPT_ROOT}"/k8s/boilerplate.go.txt
|
||||
|
||||
|
||||
@@ -22,7 +22,7 @@ import (
|
||||
"github.com/minio/minio/pkg/env"
|
||||
)
|
||||
|
||||
// GetOperatorMode gets Console Operator mode status set on env variable or default one
|
||||
// GetOperatorMode gets MCS Operator mode status set on env variable or default one
|
||||
func GetOperatorMode() bool {
|
||||
return strings.ToLower(env.Get(consoleOperatorMode, "off")) == "on"
|
||||
return strings.ToLower(env.Get(mcsOperatorMode, "off")) == "on"
|
||||
}
|
||||
|
||||
@@ -17,5 +17,5 @@
|
||||
package acl
|
||||
|
||||
const (
|
||||
consoleOperatorMode = "CONSOLE_OPERATOR_MODE"
|
||||
mcsOperatorMode = "MCS_OPERATOR_MODE"
|
||||
)
|
||||
|
||||
@@ -19,7 +19,7 @@ package auth
|
||||
import (
|
||||
"context"
|
||||
|
||||
"github.com/minio/console/pkg/auth/idp/oauth2"
|
||||
"github.com/minio/mcs/pkg/auth/idp/oauth2"
|
||||
)
|
||||
|
||||
// IdentityProviderClient interface with all functions to be implemented
|
||||
|
||||
@@ -19,29 +19,29 @@
|
||||
package oauth2
|
||||
|
||||
import (
|
||||
"github.com/minio/console/pkg/auth/utils"
|
||||
"github.com/minio/mcs/pkg/auth/utils"
|
||||
"github.com/minio/minio/pkg/env"
|
||||
)
|
||||
|
||||
func GetIdpURL() string {
|
||||
return env.Get(ConsoleIdpURL, "")
|
||||
return env.Get(McsIdpURL, "")
|
||||
}
|
||||
|
||||
func GetIdpClientID() string {
|
||||
return env.Get(ConsoleIdpClientID, "")
|
||||
return env.Get(McsIdpClientID, "")
|
||||
}
|
||||
|
||||
func GetIdpSecret() string {
|
||||
return env.Get(ConsoleIdpSecret, "")
|
||||
return env.Get(McsIdpSecret, "")
|
||||
}
|
||||
|
||||
// Public endpoint used by the identity oidcProvider when redirecting the user after identity verification
|
||||
func GetIdpCallbackURL() string {
|
||||
return env.Get(ConsoleIdpCallbackURL, "")
|
||||
return env.Get(McsIdpCallbackURL, "")
|
||||
}
|
||||
|
||||
func GetIdpAdminRoles() string {
|
||||
return env.Get(ConsoleIdpAdminRoles, "")
|
||||
return env.Get(McsIdpAdminRoles, "")
|
||||
}
|
||||
|
||||
func IsIdpEnabled() bool {
|
||||
@@ -55,17 +55,17 @@ var defaultPassphraseForIdpHmac = utils.RandomCharString(64)
|
||||
|
||||
// GetPassphraseForIdpHmac returns passphrase for the pbkdf2 function used to sign the oauth2 state parameter
|
||||
func getPassphraseForIdpHmac() string {
|
||||
return env.Get(ConsoleIdpHmacPassphrase, defaultPassphraseForIdpHmac)
|
||||
return env.Get(McsIdpHmacPassphrase, defaultPassphraseForIdpHmac)
|
||||
}
|
||||
|
||||
var defaultSaltForIdpHmac = utils.RandomCharString(64)
|
||||
|
||||
// GetSaltForIdpHmac returns salt for the pbkdf2 function used to sign the oauth2 state parameter
|
||||
func getSaltForIdpHmac() string {
|
||||
return env.Get(ConsoleIdpHmacSalt, defaultSaltForIdpHmac)
|
||||
return env.Get(McsIdpHmacSalt, defaultSaltForIdpHmac)
|
||||
}
|
||||
|
||||
// GetSaltForIdpHmac returns the policy to be assigned to the users authenticating via an IDP
|
||||
func GetIDPPolicyForUser() string {
|
||||
return env.Get(ConsoleIdpPolicyUser, "consoleAdmin")
|
||||
return env.Get(McsIdpPolicyUser, "mcsAdmin")
|
||||
}
|
||||
|
||||
@@ -18,12 +18,12 @@ package oauth2
|
||||
|
||||
const (
|
||||
// const for idp configuration
|
||||
ConsoleIdpURL = "CONSOLE_IDP_URL"
|
||||
ConsoleIdpClientID = "CONSOLE_IDP_CLIENT_ID"
|
||||
ConsoleIdpSecret = "CONSOLE_IDP_SECRET"
|
||||
ConsoleIdpCallbackURL = "CONSOLE_IDP_CALLBACK"
|
||||
ConsoleIdpAdminRoles = "CONSOLE_IDP_ADMIN_ROLES"
|
||||
ConsoleIdpHmacPassphrase = "CONSOLE_IDP_HMAC_PASSPHRASE"
|
||||
ConsoleIdpHmacSalt = "CONSOLE_IDP_HMAC_SALT"
|
||||
ConsoleIdpPolicyUser = "CONSOLE_IDP_POLICY_USER"
|
||||
McsIdpURL = "MCS_IDP_URL"
|
||||
McsIdpClientID = "MCS_IDP_CLIENT_ID"
|
||||
McsIdpSecret = "MCS_IDP_SECRET"
|
||||
McsIdpCallbackURL = "MCS_IDP_CALLBACK"
|
||||
McsIdpAdminRoles = "MCS_IDP_ADMIN_ROLES"
|
||||
McsIdpHmacPassphrase = "MCS_IDP_HMAC_PASSPHRASE"
|
||||
McsIdpHmacSalt = "MCS_IDP_HMAC_SALT"
|
||||
McsIdpPolicyUser = "MCS_IDP_POLICY_USER"
|
||||
)
|
||||
|
||||
@@ -28,7 +28,7 @@ import (
|
||||
"strings"
|
||||
|
||||
"github.com/coreos/go-oidc"
|
||||
"github.com/minio/console/pkg/auth/utils"
|
||||
"github.com/minio/mcs/pkg/auth/utils"
|
||||
"golang.org/x/crypto/pbkdf2"
|
||||
xoauth2 "golang.org/x/oauth2"
|
||||
)
|
||||
@@ -94,7 +94,7 @@ type Provider struct {
|
||||
}
|
||||
|
||||
// derivedKey is the key used to compute the HMAC for signing the oauth state parameter
|
||||
// its derived using pbkdf on CONSOLE_IDP_HMAC_PASSPHRASE with CONSOLE_IDP_HMAC_SALT
|
||||
// its derived using pbkdf on MCS_IDP_HMAC_PASSPHRASE with MCS_IDP_HMAC_SALT
|
||||
var derivedKey = pbkdf2.Key([]byte(getPassphraseForIdpHmac()), []byte(getSaltForIdpHmac()), 4096, 32, sha1.New)
|
||||
|
||||
// NewOauth2ProviderClient instantiates a new oauth2 client using the configured credentials
|
||||
@@ -186,7 +186,7 @@ func (client *Provider) VerifyIdentity(ctx context.Context, code, state string)
|
||||
}
|
||||
|
||||
// validateOauth2State validates the provided state was originated using the same
|
||||
// instance (or one configured using the same secrets) of Console, this is basically used to prevent CSRF attacks
|
||||
// instance (or one configured using the same secrets) of MCS, this is basically used to prevent CSRF attacks
|
||||
// https://security.stackexchange.com/questions/20187/oauth2-cross-site-request-forgery-and-state-parameter
|
||||
func validateOauth2State(state string) bool {
|
||||
// state contains a base64 encoded string that may ends with "==", the browser encodes that to "%3D%3D"
|
||||
|
||||
@@ -32,8 +32,8 @@ import (
|
||||
|
||||
jwtgo "github.com/dgrijalva/jwt-go"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
xjwt "github.com/minio/console/pkg/auth/jwt"
|
||||
"github.com/minio/mcs/models"
|
||||
xjwt "github.com/minio/mcs/pkg/auth/jwt"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
uuid "github.com/satori/go.uuid"
|
||||
"golang.org/x/crypto/pbkdf2"
|
||||
@@ -46,7 +46,7 @@ var (
|
||||
errClaimsFormat = errors.New("encrypted jwt claims not in the right format")
|
||||
)
|
||||
|
||||
// derivedKey is the key used to encrypt the JWT claims, its derived using pbkdf on CONSOLE_PBKDF_PASSPHRASE with CONSOLE_PBKDF_SALT
|
||||
// derivedKey is the key used to encrypt the JWT claims, its derived using pbkdf on MCS_PBKDF_PASSPHRASE with MCS_PBKDF_SALT
|
||||
var derivedKey = pbkdf2.Key([]byte(xjwt.GetPBKDFPassphrase()), []byte(xjwt.GetPBKDFSalt()), 4096, 32, sha1.New)
|
||||
|
||||
// IsJWTValid returns true or false depending if the provided jwt is valid or not
|
||||
@@ -104,7 +104,7 @@ func NewJWTWithClaimsForClient(credentials *credentials.Value, actions []string,
|
||||
return "", err
|
||||
}
|
||||
claims := xjwt.NewStandardClaims()
|
||||
claims.SetExpiry(time.Now().UTC().Add(xjwt.GetConsoleSTSAndJWTDurationTime()))
|
||||
claims.SetExpiry(time.Now().UTC().Add(xjwt.GetMcsSTSAndJWTDurationTime()))
|
||||
claims.SetSubject(uuid.NewV4().String())
|
||||
claims.SetData(encryptedClaims)
|
||||
claims.SetAudience(audience)
|
||||
@@ -216,7 +216,7 @@ func GetClaimsFromTokenInRequest(req *http.Request) (*models.Principal, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Perform decryption of the JWT, if Console is able to decrypt the JWT that means a valid session
|
||||
// Perform decryption of the JWT, if MCS is able to decrypt the JWT that means a valid session
|
||||
// was used in the first place to get it
|
||||
claims, err := JWTAuthenticate(*sessionID)
|
||||
if err != nil {
|
||||
|
||||
@@ -20,31 +20,31 @@ import (
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/minio/console/pkg/auth/utils"
|
||||
"github.com/minio/mcs/pkg/auth/utils"
|
||||
"github.com/minio/minio/pkg/env"
|
||||
)
|
||||
|
||||
// defaultHmacJWTPassphrase will be used by default if application is not configured with a custom CONSOLE_HMAC_JWT_SECRET secret
|
||||
// defaultHmacJWTPassphrase will be used by default if application is not configured with a custom MCS_HMAC_JWT_SECRET secret
|
||||
var defaultHmacJWTPassphrase = utils.RandomCharString(64)
|
||||
|
||||
// GetHmacJWTSecret returns the 64 bytes secret used for signing the generated JWT for the application
|
||||
func GetHmacJWTSecret() string {
|
||||
return env.Get(ConsoleHmacJWTSecret, defaultHmacJWTPassphrase)
|
||||
return env.Get(McsHmacJWTSecret, defaultHmacJWTPassphrase)
|
||||
}
|
||||
|
||||
// ConsoleSTSAndJWTDurationSeconds returns the default session duration for the STS requested tokens and the generated JWTs.
|
||||
// McsSTSAndJWTDurationSeconds returns the default session duration for the STS requested tokens and the generated JWTs.
|
||||
// Ideally both values should match so jwt and Minio sts sessions expires at the same time.
|
||||
func GetConsoleSTSAndJWTDurationInSeconds() int {
|
||||
duration, err := strconv.Atoi(env.Get(ConsoleSTSAndJWTDurationSeconds, "3600"))
|
||||
func GetMcsSTSAndJWTDurationInSeconds() int {
|
||||
duration, err := strconv.Atoi(env.Get(McsSTSAndJWTDurationSeconds, "3600"))
|
||||
if err != nil {
|
||||
duration = 3600
|
||||
}
|
||||
return duration
|
||||
}
|
||||
|
||||
// GetConsoleSTSAndJWTDurationTime returns GetConsoleSTSAndJWTDurationInSeconds in duration format
|
||||
func GetConsoleSTSAndJWTDurationTime() time.Duration {
|
||||
duration := GetConsoleSTSAndJWTDurationInSeconds()
|
||||
// GetMcsSTSAndJWTDurationTime returns GetMcsSTSAndJWTDurationInSeconds in duration format
|
||||
func GetMcsSTSAndJWTDurationTime() time.Duration {
|
||||
duration := GetMcsSTSAndJWTDurationInSeconds()
|
||||
return time.Duration(duration) * time.Second
|
||||
}
|
||||
|
||||
@@ -52,12 +52,12 @@ var defaultPBKDFPassphrase = utils.RandomCharString(64)
|
||||
|
||||
// GetPBKDFPassphrase returns passphrase for the pbkdf2 function used to encrypt JWT payload
|
||||
func GetPBKDFPassphrase() string {
|
||||
return env.Get(ConsolePBKDFPassphrase, defaultPBKDFPassphrase)
|
||||
return env.Get(McsPBKDFPassphrase, defaultPBKDFPassphrase)
|
||||
}
|
||||
|
||||
var defaultPBKDFSalt = utils.RandomCharString(64)
|
||||
|
||||
// GetPBKDFSalt returns salt for the pbkdf2 function used to encrypt JWT payload
|
||||
func GetPBKDFSalt() string {
|
||||
return env.Get(ConsolePBKDFSalt, defaultPBKDFSalt)
|
||||
return env.Get(McsPBKDFSalt, defaultPBKDFSalt)
|
||||
}
|
||||
|
||||
@@ -17,8 +17,8 @@
|
||||
package jwt
|
||||
|
||||
const (
|
||||
ConsoleHmacJWTSecret = "CONSOLE_HMAC_JWT_SECRET"
|
||||
ConsoleSTSAndJWTDurationSeconds = "CONSOLE_STS_AND_JWT_DURATION_SECONDS"
|
||||
ConsolePBKDFPassphrase = "CONSOLE_PBKDF_PASSPHRASE"
|
||||
ConsolePBKDFSalt = "CONSOLE_PBKDF_SALT"
|
||||
McsHmacJWTSecret = "MCS_HMAC_JWT_SECRET"
|
||||
McsSTSAndJWTDurationSeconds = "MCS_STS_AND_JWT_DURATION_SECONDS"
|
||||
McsPBKDFPassphrase = "MCS_PBKDF_PASSPHRASE"
|
||||
McsPBKDFSalt = "MCS_PBKDF_SALT"
|
||||
)
|
||||
|
||||
@@ -27,9 +27,9 @@ var (
|
||||
errInvalidCredentials = errors.New("invalid Credentials")
|
||||
)
|
||||
|
||||
// GetConsoleCredentialsFromLDAP authenticates the user against MinIO when the LDAP integration is enabled
|
||||
// GetMcsCredentialsFromLDAP authenticates the user against MinIO when the LDAP integration is enabled
|
||||
// if the authentication succeed *credentials.Credentials object is returned and we continue with the normal STSAssumeRole flow
|
||||
func GetConsoleCredentialsFromLDAP(endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error) {
|
||||
func GetMcsCredentialsFromLDAP(endpoint, ldapUser, ldapPassword string) (*credentials.Credentials, error) {
|
||||
creds, err := credentials.NewLDAPIdentity(endpoint, ldapUser, ldapPassword)
|
||||
if err != nil {
|
||||
log.Println("LDAP authentication error: ", err)
|
||||
|
||||
@@ -23,5 +23,5 @@ import (
|
||||
)
|
||||
|
||||
func GetLDAPEnabled() bool {
|
||||
return strings.ToLower(env.Get(ConsoleLDAPEnabled, "off")) == "on"
|
||||
return strings.ToLower(env.Get(MCSLDAPEnabled, "off")) == "on"
|
||||
}
|
||||
|
||||
@@ -18,5 +18,5 @@ package ldap
|
||||
|
||||
const (
|
||||
// const for ldap configuration
|
||||
ConsoleLDAPEnabled = "CONSOLE_LDAP_ENABLED"
|
||||
MCSLDAPEnabled = "MCS_LDAP_ENABLED"
|
||||
)
|
||||
|
||||
@@ -20,7 +20,7 @@ import (
|
||||
"context"
|
||||
"log"
|
||||
|
||||
"github.com/minio/console/cluster"
|
||||
"github.com/minio/mcs/cluster"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
operatorClientset "github.com/minio/operator/pkg/client/clientset/versioned"
|
||||
)
|
||||
@@ -30,7 +30,7 @@ type operatorCredentialsProvider struct {
|
||||
serviceAccountJWT string
|
||||
}
|
||||
|
||||
// Implementing the interfaces of the minio Provider, we use this to leverage on the existing console Authentication flow
|
||||
// Implementing the interfaces of the minio Provider, we use this to leverage on the existing mcs Authentication flow
|
||||
func (s operatorCredentialsProvider) Retrieve() (credentials.Value, error) {
|
||||
return credentials.Value{
|
||||
AccessKeyID: "",
|
||||
@@ -65,7 +65,7 @@ func (c *operatorClient) Authenticate(ctx context.Context) ([]byte, error) {
|
||||
}
|
||||
|
||||
// isServiceAccountTokenValid will make an authenticated request against kubernetes api, if the
|
||||
// request success means the provided jwt its a valid service account token and the console user can use it for future
|
||||
// request success means the provided jwt its a valid service account token and the MCS user can use it for future
|
||||
// requests until it expires
|
||||
func isServiceAccountTokenValid(ctx context.Context, operatorClient OperatorClient) bool {
|
||||
_, err := operatorClient.Authenticate(ctx)
|
||||
@@ -76,8 +76,8 @@ func isServiceAccountTokenValid(ctx context.Context, operatorClient OperatorClie
|
||||
return true
|
||||
}
|
||||
|
||||
// GetConsoleCredentialsForOperator will validate the provided JWT (service account token) and return it in the form of credentials.Credentials
|
||||
func GetConsoleCredentialsForOperator(jwt string) (*credentials.Credentials, error) {
|
||||
// GetMcsCredentialsForOperator will validate the provided JWT (service account token) and return it in the form of credentials.Credentials
|
||||
func GetMcsCredentialsForOperator(jwt string) (*credentials.Credentials, error) {
|
||||
ctx := context.Background()
|
||||
opClientClientSet, err := cluster.OperatorClient(jwt)
|
||||
if err != nil {
|
||||
|
||||
@@ -5,7 +5,7 @@ import (
|
||||
"errors"
|
||||
"testing"
|
||||
|
||||
"github.com/minio/console/cluster"
|
||||
"github.com/minio/mcs/cluster"
|
||||
operatorClientset "github.com/minio/operator/pkg/client/clientset/versioned"
|
||||
)
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ package versioned
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
networkingv1beta2 "github.com/minio/console/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
networkingv1beta2 "github.com/minio/mcs/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
discovery "k8s.io/client-go/discovery"
|
||||
rest "k8s.io/client-go/rest"
|
||||
flowcontrol "k8s.io/client-go/util/flowcontrol"
|
||||
|
||||
@@ -19,9 +19,9 @@ limitations under the License.
|
||||
package fake
|
||||
|
||||
import (
|
||||
clientset "github.com/minio/console/pkg/clientgen/clientset/versioned"
|
||||
networkingv1beta2 "github.com/minio/console/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
fakenetworkingv1beta2 "github.com/minio/console/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2/fake"
|
||||
clientset "github.com/minio/mcs/pkg/clientgen/clientset/versioned"
|
||||
networkingv1beta2 "github.com/minio/mcs/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
fakenetworkingv1beta2 "github.com/minio/mcs/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2/fake"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/watch"
|
||||
"k8s.io/client-go/discovery"
|
||||
|
||||
@@ -19,7 +19,7 @@ limitations under the License.
|
||||
package fake
|
||||
|
||||
import (
|
||||
networkingv1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
networkingv1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
|
||||
@@ -19,7 +19,7 @@ limitations under the License.
|
||||
package scheme
|
||||
|
||||
import (
|
||||
networkingv1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
networkingv1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
|
||||
@@ -21,7 +21,7 @@ package fake
|
||||
import (
|
||||
"context"
|
||||
|
||||
v1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
labels "k8s.io/apimachinery/pkg/labels"
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
|
||||
@@ -19,7 +19,7 @@ limitations under the License.
|
||||
package fake
|
||||
|
||||
import (
|
||||
v1beta2 "github.com/minio/console/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
v1beta2 "github.com/minio/mcs/pkg/clientgen/clientset/versioned/typed/networking.gke.io/v1beta2"
|
||||
rest "k8s.io/client-go/rest"
|
||||
testing "k8s.io/client-go/testing"
|
||||
)
|
||||
|
||||
@@ -22,8 +22,8 @@ import (
|
||||
"context"
|
||||
"time"
|
||||
|
||||
v1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
scheme "github.com/minio/console/pkg/clientgen/clientset/versioned/scheme"
|
||||
v1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
scheme "github.com/minio/mcs/pkg/clientgen/clientset/versioned/scheme"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
types "k8s.io/apimachinery/pkg/types"
|
||||
watch "k8s.io/apimachinery/pkg/watch"
|
||||
|
||||
@@ -19,8 +19,8 @@ limitations under the License.
|
||||
package v1beta2
|
||||
|
||||
import (
|
||||
v1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
"github.com/minio/console/pkg/clientgen/clientset/versioned/scheme"
|
||||
v1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
"github.com/minio/mcs/pkg/clientgen/clientset/versioned/scheme"
|
||||
rest "k8s.io/client-go/rest"
|
||||
)
|
||||
|
||||
|
||||
@@ -23,9 +23,9 @@ import (
|
||||
sync "sync"
|
||||
time "time"
|
||||
|
||||
versioned "github.com/minio/console/pkg/clientgen/clientset/versioned"
|
||||
internalinterfaces "github.com/minio/console/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
networkinggkeio "github.com/minio/console/pkg/clientgen/informers/externalversions/networking.gke.io"
|
||||
versioned "github.com/minio/mcs/pkg/clientgen/clientset/versioned"
|
||||
internalinterfaces "github.com/minio/mcs/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
networkinggkeio "github.com/minio/mcs/pkg/clientgen/informers/externalversions/networking.gke.io"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
|
||||
@@ -21,7 +21,7 @@ package externalversions
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
v1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
cache "k8s.io/client-go/tools/cache"
|
||||
)
|
||||
|
||||
@@ -21,7 +21,7 @@ package internalinterfaces
|
||||
import (
|
||||
time "time"
|
||||
|
||||
versioned "github.com/minio/console/pkg/clientgen/clientset/versioned"
|
||||
versioned "github.com/minio/mcs/pkg/clientgen/clientset/versioned"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
cache "k8s.io/client-go/tools/cache"
|
||||
|
||||
@@ -19,8 +19,8 @@ limitations under the License.
|
||||
package networking
|
||||
|
||||
import (
|
||||
internalinterfaces "github.com/minio/console/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
v1beta2 "github.com/minio/console/pkg/clientgen/informers/externalversions/networking.gke.io/v1beta2"
|
||||
internalinterfaces "github.com/minio/mcs/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
v1beta2 "github.com/minio/mcs/pkg/clientgen/informers/externalversions/networking.gke.io/v1beta2"
|
||||
)
|
||||
|
||||
// Interface provides access to each of this group's versions.
|
||||
|
||||
@@ -19,7 +19,7 @@ limitations under the License.
|
||||
package v1beta2
|
||||
|
||||
import (
|
||||
internalinterfaces "github.com/minio/console/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
internalinterfaces "github.com/minio/mcs/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
)
|
||||
|
||||
// Interface provides access to all the informers in this group version.
|
||||
|
||||
@@ -22,10 +22,10 @@ import (
|
||||
"context"
|
||||
time "time"
|
||||
|
||||
networkinggkeiov1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
versioned "github.com/minio/console/pkg/clientgen/clientset/versioned"
|
||||
internalinterfaces "github.com/minio/console/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
v1beta2 "github.com/minio/console/pkg/clientgen/listers/networking.gke.io/v1beta2"
|
||||
networkinggkeiov1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
versioned "github.com/minio/mcs/pkg/clientgen/clientset/versioned"
|
||||
internalinterfaces "github.com/minio/mcs/pkg/clientgen/informers/externalversions/internalinterfaces"
|
||||
v1beta2 "github.com/minio/mcs/pkg/clientgen/listers/networking.gke.io/v1beta2"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
watch "k8s.io/apimachinery/pkg/watch"
|
||||
|
||||
@@ -19,7 +19,7 @@ limitations under the License.
|
||||
package v1beta2
|
||||
|
||||
import (
|
||||
v1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
v1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
"k8s.io/apimachinery/pkg/api/errors"
|
||||
"k8s.io/apimachinery/pkg/labels"
|
||||
"k8s.io/client-go/tools/cache"
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -110,7 +110,7 @@ const AddTenant = ({
|
||||
const [mountPath, setMountPath] = useState<string>("");
|
||||
const [accessKey, setAccessKey] = useState<string>("");
|
||||
const [secretKey, setSecretKey] = useState<string>("");
|
||||
const [enableConsole, setEnableConsole] = useState<boolean>(true);
|
||||
const [enableMCS, setEnableMCS] = useState<boolean>(true);
|
||||
const [enableSSL, setEnableSSL] = useState<boolean>(false);
|
||||
const [sizeFactor, setSizeFactor] = useState<string>("Gi");
|
||||
const [storageClasses, setStorageClassesList] = useState<Opts[]>([]);
|
||||
@@ -275,7 +275,7 @@ const AddTenant = ({
|
||||
service_name: tenantName,
|
||||
image: imageName,
|
||||
enable_ssl: enableSSL,
|
||||
enable_console: enableConsole,
|
||||
enable_mcs: enableMCS,
|
||||
access_key: accessKey,
|
||||
secret_key: secretKey,
|
||||
volumes_per_server: volumesPerServer,
|
||||
@@ -735,15 +735,15 @@ const AddTenant = ({
|
||||
</div>
|
||||
<Grid item xs={12}>
|
||||
<CheckboxWrapper
|
||||
value="enabled_console"
|
||||
id="enabled_console"
|
||||
name="enabled_console"
|
||||
checked={enableConsole}
|
||||
value="enabled_mcs"
|
||||
id="enabled_mcs"
|
||||
name="enabled_mcs"
|
||||
checked={enableMCS}
|
||||
onChange={(e) => {
|
||||
const targetD = e.target;
|
||||
const checked = targetD.checked;
|
||||
|
||||
setEnableConsole(checked);
|
||||
setEnableMCS(checked);
|
||||
}}
|
||||
label={"Enable Console"}
|
||||
/>
|
||||
@@ -888,11 +888,9 @@ const AddTenant = ({
|
||||
</TableRow>
|
||||
<TableRow>
|
||||
<TableCell align="right" className={classes.tableTitle}>
|
||||
Enable Console
|
||||
</TableCell>
|
||||
<TableCell>
|
||||
{enableConsole ? "Enabled" : "Disabled"}
|
||||
Enable MCS
|
||||
</TableCell>
|
||||
<TableCell>{enableMCS ? "Enabled" : "Disabled"}</TableCell>
|
||||
</TableRow>
|
||||
</React.Fragment>
|
||||
)}
|
||||
|
||||
@@ -23,12 +23,12 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerAdminArnsHandlers(api *operations.ConsoleAPI) {
|
||||
func registerAdminArnsHandlers(api *operations.McsAPI) {
|
||||
// return a list of arns
|
||||
api.AdminAPIArnListHandler = admin_api.ArnListHandlerFunc(func(params admin_api.ArnListParams, session *models.Principal) middleware.Responder {
|
||||
arnsResp, err := getArnsResponse(session)
|
||||
|
||||
@@ -24,14 +24,14 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
madmin "github.com/minio/minio/pkg/madmin"
|
||||
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerConfigHandlers(api *operations.ConsoleAPI) {
|
||||
func registerConfigHandlers(api *operations.McsAPI) {
|
||||
// List Configurations
|
||||
api.AdminAPIListConfigHandler = admin_api.ListConfigHandlerFunc(func(params admin_api.ListConfigParams, session *models.Principal) middleware.Responder {
|
||||
configListResp, err := getListConfigResponse(session)
|
||||
|
||||
@@ -28,7 +28,7 @@ import (
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/minio/cmd/config"
|
||||
"github.com/minio/minio/pkg/event/target"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
|
||||
@@ -23,15 +23,15 @@ import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
func registerGroupsHandlers(api *operations.ConsoleAPI) {
|
||||
func registerGroupsHandlers(api *operations.McsAPI) {
|
||||
// List Groups
|
||||
api.AdminAPIListGroupsHandler = admin_api.ListGroupsHandlerFunc(func(params admin_api.ListGroupsParams, session *models.Principal) middleware.Responder {
|
||||
listGroupsResponse, err := getListGroupsResponse(session)
|
||||
|
||||
@@ -22,7 +22,7 @@ import (
|
||||
"testing"
|
||||
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
|
||||
@@ -23,12 +23,12 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerAdminInfoHandlers(api *operations.ConsoleAPI) {
|
||||
func registerAdminInfoHandlers(api *operations.McsAPI) {
|
||||
// return usage stats
|
||||
api.AdminAPIAdminInfoHandler = admin_api.AdminInfoHandlerFunc(func(params admin_api.AdminInfoParams, session *models.Principal) middleware.Responder {
|
||||
infoResp, err := getAdminInfoResponse(session)
|
||||
|
||||
@@ -24,12 +24,12 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerAdminNotificationEndpointsHandlers(api *operations.ConsoleAPI) {
|
||||
func registerAdminNotificationEndpointsHandlers(api *operations.McsAPI) {
|
||||
// return a list of notification endpoints
|
||||
api.AdminAPINotificationEndpointListHandler = admin_api.NotificationEndpointListHandlerFunc(func(params admin_api.NotificationEndpointListParams, session *models.Principal) middleware.Responder {
|
||||
notifEndpoints, err := getNotificationEndpointsResponse(session)
|
||||
|
||||
@@ -24,8 +24,8 @@ import (
|
||||
|
||||
"github.com/go-openapi/swag"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func Test_addNotificationEndpoint(t *testing.T) {
|
||||
|
||||
@@ -26,13 +26,13 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
iampolicy "github.com/minio/minio/pkg/iam/policy"
|
||||
)
|
||||
|
||||
func registersPoliciesHandler(api *operations.ConsoleAPI) {
|
||||
func registersPoliciesHandler(api *operations.McsAPI) {
|
||||
// List Policies
|
||||
api.AdminAPIListPoliciesHandler = admin_api.ListPoliciesHandlerFunc(func(params admin_api.ListPoliciesParams, session *models.Principal) middleware.Responder {
|
||||
listPoliciesResponse, err := getListPoliciesResponse(session)
|
||||
|
||||
@@ -25,7 +25,7 @@ import (
|
||||
|
||||
"errors"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
iampolicy "github.com/minio/minio/pkg/iam/policy"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
@@ -97,7 +97,7 @@ func TestRemovePolicy(t *testing.T) {
|
||||
funcAssert := assert.New(t)
|
||||
adminClient := adminClientMock{}
|
||||
// Test-1 : removePolicy() remove an existing policy
|
||||
policyToRemove := "console-policy"
|
||||
policyToRemove := "mcs-policy"
|
||||
minioRemovePolicyMock = func(name string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -26,13 +26,13 @@ import (
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
)
|
||||
|
||||
func registerProfilingHandler(api *operations.ConsoleAPI) {
|
||||
func registerProfilingHandler(api *operations.McsAPI) {
|
||||
// Start Profiling
|
||||
api.AdminAPIProfilingStartHandler = admin_api.ProfilingStartHandlerFunc(func(params admin_api.ProfilingStartParams, session *models.Principal) middleware.Responder {
|
||||
profilingStartResponse, err := getProfilingStartResponse(session, params.Body)
|
||||
|
||||
@@ -24,7 +24,7 @@ import (
|
||||
|
||||
"errors"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
@@ -23,13 +23,13 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerServiceHandlers(api *operations.ConsoleAPI) {
|
||||
func registerServiceHandlers(api *operations.McsAPI) {
|
||||
// Restart Service
|
||||
api.AdminAPIRestartServiceHandler = admin_api.RestartServiceHandlerFunc(func(params admin_api.RestartServiceParams, session *models.Principal) middleware.Responder {
|
||||
if err := getRestartServiceResponse(session); err != nil {
|
||||
|
||||
@@ -33,19 +33,19 @@ import (
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
|
||||
"github.com/minio/console/cluster"
|
||||
"github.com/minio/mcs/cluster"
|
||||
madmin "github.com/minio/minio/pkg/madmin"
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
operator "github.com/minio/operator/pkg/apis/minio.min.io/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func registerTenantHandlers(api *operations.ConsoleAPI) {
|
||||
func registerTenantHandlers(api *operations.McsAPI) {
|
||||
// Add Tenant
|
||||
api.AdminAPICreateTenantHandler = admin_api.CreateTenantHandlerFunc(func(params admin_api.CreateTenantParams, session *models.Principal) middleware.Responder {
|
||||
resp, err := getTenantCreatedResponse(session, params)
|
||||
@@ -406,9 +406,9 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
if params.Body.EnableSsl != nil {
|
||||
enableSSL = *params.Body.EnableSsl
|
||||
}
|
||||
enableConsole := true
|
||||
enableMCS := true
|
||||
if params.Body.EnableConsole != nil {
|
||||
enableConsole = *params.Body.EnableConsole
|
||||
enableMCS = *params.Body.EnableConsole
|
||||
}
|
||||
|
||||
// TODO: Calculate this ourselves?
|
||||
@@ -433,22 +433,22 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
}
|
||||
// optionals are set below
|
||||
|
||||
if enableConsole {
|
||||
consoleSelector := fmt.Sprintf("%s-console", *params.Body.Name)
|
||||
if enableMCS {
|
||||
mcsSelector := fmt.Sprintf("%s-mcs", *params.Body.Name)
|
||||
|
||||
consoleSecretName := fmt.Sprintf("%s-secret", consoleSelector)
|
||||
mcsSecretName := fmt.Sprintf("%s-secret", mcsSelector)
|
||||
imm := true
|
||||
instanceSecret := corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: consoleSecretName,
|
||||
Name: mcsSecretName,
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
"CONSOLE_HMAC_JWT_SECRET": []byte(RandomCharString(16)),
|
||||
"CONSOLE_PBKDF_PASSPHRASE": []byte(RandomCharString(16)),
|
||||
"CONSOLE_PBKDF_SALT": []byte(RandomCharString(8)),
|
||||
"CONSOLE_ACCESS_KEY": []byte(RandomCharString(16)),
|
||||
"CONSOLE_SECRET_KEY": []byte(RandomCharString(32)),
|
||||
"MCS_HMAC_JWT_SECRET": []byte(RandomCharString(16)),
|
||||
"MCS_PBKDF_PASSPHRASE": []byte(RandomCharString(16)),
|
||||
"MCS_PBKDF_SALT": []byte(RandomCharString(8)),
|
||||
"MCS_ACCESS_KEY": []byte(RandomCharString(16)),
|
||||
"MCS_SECRET_KEY": []byte(RandomCharString(32)),
|
||||
},
|
||||
}
|
||||
_, err = clientset.CoreV1().Secrets(ns).Create(context.Background(), &instanceSecret, metav1.CreateOptions{})
|
||||
@@ -456,11 +456,11 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
|
||||
return nil, err
|
||||
}
|
||||
|
||||
const consoleVersion = "minio/console:v0.3.0"
|
||||
const consoleVersion = "minio/mcs:v0.2.1"
|
||||
minInst.Spec.Console = &operator.ConsoleConfiguration{
|
||||
Replicas: 2,
|
||||
Image: consoleVersion,
|
||||
ConsoleSecret: &corev1.LocalObjectReference{Name: consoleSecretName},
|
||||
ConsoleSecret: &corev1.LocalObjectReference{Name: mcsSecretName},
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -27,9 +27,9 @@ import (
|
||||
"testing"
|
||||
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/cluster"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/cluster"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
operator "github.com/minio/operator/pkg/apis/minio.min.io/v1"
|
||||
v1 "github.com/minio/operator/pkg/apis/minio.min.io/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
|
||||
@@ -20,9 +20,9 @@ import (
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations/admin_api"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
|
||||
"context"
|
||||
@@ -31,7 +31,7 @@ import (
|
||||
"strings"
|
||||
)
|
||||
|
||||
func registerUsersHandlers(api *operations.ConsoleAPI) {
|
||||
func registerUsersHandlers(api *operations.McsAPI) {
|
||||
// List Users
|
||||
api.AdminAPIListUsersHandler = admin_api.ListUsersHandlerFunc(func(params admin_api.ListUsersParams, session *models.Principal) middleware.Responder {
|
||||
listUsersResponse, err := getListUsersResponse(session)
|
||||
|
||||
@@ -22,16 +22,16 @@ import (
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
mcCmd "github.com/minio/mc/cmd"
|
||||
"github.com/minio/mc/pkg/probe"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
mauth "github.com/minio/minio/pkg/auth"
|
||||
iampolicy "github.com/minio/minio/pkg/iam/policy"
|
||||
"github.com/minio/minio/pkg/madmin"
|
||||
)
|
||||
|
||||
const globalAppName = "console"
|
||||
const globalAppName = "mcs"
|
||||
|
||||
// NewAdminClient gives a new client interface
|
||||
func NewAdminClient(url, accessKey, secretKey string) (*madmin.AdminClient, *probe.Error) {
|
||||
@@ -42,7 +42,7 @@ func NewAdminClient(url, accessKey, secretKey string) (*madmin.AdminClient, *pro
|
||||
AccessKey: accessKey,
|
||||
SecretKey: secretKey,
|
||||
AppName: appName,
|
||||
AppVersion: ConsoleVersion,
|
||||
AppVersion: McsVersion,
|
||||
AppComments: []string{appName, runtime.GOOS, runtime.GOARCH},
|
||||
Insecure: false,
|
||||
})
|
||||
|
||||
@@ -23,13 +23,13 @@ import (
|
||||
|
||||
"errors"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/pkg/acl"
|
||||
"github.com/minio/console/pkg/auth"
|
||||
xjwt "github.com/minio/console/pkg/auth/jwt"
|
||||
"github.com/minio/console/pkg/auth/ldap"
|
||||
mc "github.com/minio/mc/cmd"
|
||||
"github.com/minio/mc/pkg/probe"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/pkg/acl"
|
||||
"github.com/minio/mcs/pkg/auth"
|
||||
xjwt "github.com/minio/mcs/pkg/auth/jwt"
|
||||
"github.com/minio/mcs/pkg/auth/ldap"
|
||||
"github.com/minio/minio-go/v7"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
"github.com/minio/minio-go/v7/pkg/notification"
|
||||
@@ -124,41 +124,41 @@ func (c mcS3Client) watch(ctx context.Context, options mc.WatchOptions) (*mc.Wat
|
||||
return c.client.Watch(ctx, options)
|
||||
}
|
||||
|
||||
// ConsoleCredentials interface with all functions to be implemented
|
||||
// by mock when testing, it should include all needed consoleCredentials.Credentials api calls
|
||||
// MCSCredentials interface with all functions to be implemented
|
||||
// by mock when testing, it should include all needed mcsCredentials.Credentials api calls
|
||||
// that are used within this project.
|
||||
type ConsoleCredentials interface {
|
||||
type MCSCredentials interface {
|
||||
Get() (credentials.Value, error)
|
||||
Expire()
|
||||
}
|
||||
|
||||
// Interface implementation
|
||||
type consoleCredentials struct {
|
||||
consoleCredentials *credentials.Credentials
|
||||
type mcsCredentials struct {
|
||||
mcsCredentials *credentials.Credentials
|
||||
}
|
||||
|
||||
// implements *Credentials.Get()
|
||||
func (c consoleCredentials) Get() (credentials.Value, error) {
|
||||
return c.consoleCredentials.Get()
|
||||
func (c mcsCredentials) Get() (credentials.Value, error) {
|
||||
return c.mcsCredentials.Get()
|
||||
}
|
||||
|
||||
// implements *Credentials.Expire()
|
||||
func (c consoleCredentials) Expire() {
|
||||
c.consoleCredentials.Expire()
|
||||
func (c mcsCredentials) Expire() {
|
||||
c.mcsCredentials.Expire()
|
||||
}
|
||||
|
||||
// consoleSTSAssumeRole it's a STSAssumeRole wrapper, in general
|
||||
// mcsSTSAssumeRole it's a STSAssumeRole wrapper, in general
|
||||
// there's no need to use this struct anywhere else in the project, it's only required
|
||||
// for passing a custom *http.Client to *credentials.STSAssumeRole
|
||||
type consoleSTSAssumeRole struct {
|
||||
type mcsSTSAssumeRole struct {
|
||||
stsAssumeRole *credentials.STSAssumeRole
|
||||
}
|
||||
|
||||
func (s consoleSTSAssumeRole) Retrieve() (credentials.Value, error) {
|
||||
func (s mcsSTSAssumeRole) Retrieve() (credentials.Value, error) {
|
||||
return s.stsAssumeRole.Retrieve()
|
||||
}
|
||||
|
||||
func (s consoleSTSAssumeRole) IsExpired() bool {
|
||||
func (s mcsSTSAssumeRole) IsExpired() bool {
|
||||
return s.stsAssumeRole.IsExpired()
|
||||
}
|
||||
|
||||
@@ -168,31 +168,31 @@ var (
|
||||
MinioEndpoint = getMinIOServer()
|
||||
)
|
||||
|
||||
func newConsoleCredentials(accessKey, secretKey, location string) (*credentials.Credentials, error) {
|
||||
func newMcsCredentials(accessKey, secretKey, location string) (*credentials.Credentials, error) {
|
||||
// Future authentication methods can be added under this switch statement
|
||||
switch {
|
||||
// authentication for Operator Console
|
||||
case acl.GetOperatorMode():
|
||||
{
|
||||
creds, err := auth.GetConsoleCredentialsForOperator(secretKey)
|
||||
creds, err := auth.GetMcsCredentialsForOperator(secretKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return creds, nil
|
||||
}
|
||||
// LDAP authentication for Console
|
||||
// LDAP authentication for MCS
|
||||
case ldap.GetLDAPEnabled():
|
||||
{
|
||||
if MinioEndpoint == "" {
|
||||
return nil, errors.New("endpoint cannot be empty for AssumeRoleSTS")
|
||||
}
|
||||
creds, err := auth.GetConsoleCredentialsFromLDAP(MinioEndpoint, accessKey, secretKey)
|
||||
creds, err := auth.GetMcsCredentialsFromLDAP(MinioEndpoint, accessKey, secretKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return creds, nil
|
||||
}
|
||||
// default authentication for Console is via STS (Security Token Service) against MinIO
|
||||
// default authentication for MCS is via STS (Security Token Service) against MinIO
|
||||
default:
|
||||
{
|
||||
if MinioEndpoint == "" || accessKey == "" || secretKey == "" {
|
||||
@@ -202,15 +202,15 @@ func newConsoleCredentials(accessKey, secretKey, location string) (*credentials.
|
||||
AccessKey: accessKey,
|
||||
SecretKey: secretKey,
|
||||
Location: location,
|
||||
DurationSeconds: xjwt.GetConsoleSTSAndJWTDurationInSeconds(),
|
||||
DurationSeconds: xjwt.GetMcsSTSAndJWTDurationInSeconds(),
|
||||
}
|
||||
stsAssumeRole := &credentials.STSAssumeRole{
|
||||
Client: STSClient,
|
||||
STSEndpoint: MinioEndpoint,
|
||||
Options: opts,
|
||||
}
|
||||
consoleSTSWrapper := consoleSTSAssumeRole{stsAssumeRole: stsAssumeRole}
|
||||
return credentials.New(consoleSTSWrapper), nil
|
||||
mcsSTSWrapper := mcsSTSAssumeRole{stsAssumeRole: stsAssumeRole}
|
||||
return credentials.New(mcsSTSWrapper), nil
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -224,16 +224,16 @@ func GetClaimsFromJWT(jwt string) (*auth.DecryptedClaims, error) {
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
// getConsoleCredentialsFromSession returns the *consoleCredentials.Credentials associated to the
|
||||
// getMcsCredentialsFromSession returns the *mcsCredentials.Credentials associated to the
|
||||
// provided jwt, this is useful for running the Expire() or IsExpired() operations
|
||||
func getConsoleCredentialsFromSession(claims *models.Principal) *credentials.Credentials {
|
||||
func getMcsCredentialsFromSession(claims *models.Principal) *credentials.Credentials {
|
||||
return credentials.NewStaticV4(claims.AccessKeyID, claims.SecretAccessKey, claims.SessionToken)
|
||||
}
|
||||
|
||||
// newMinioClient creates a new MinIO client based on the consoleCredentials extracted
|
||||
// newMinioClient creates a new MinIO client based on the mcsCredentials extracted
|
||||
// from the provided jwt
|
||||
func newMinioClient(claims *models.Principal) (*minio.Client, error) {
|
||||
creds := getConsoleCredentialsFromSession(claims)
|
||||
creds := getMcsCredentialsFromSession(claims)
|
||||
minioClient, err := minio.New(getMinIOEndpoint(), &minio.Options{
|
||||
Creds: creds,
|
||||
Secure: getMinIOEndpointIsSecure(),
|
||||
@@ -275,11 +275,11 @@ func newS3BucketClient(claims *models.Principal, bucketName string) (*mc.S3Clien
|
||||
// parameters.
|
||||
func newS3Config(endpoint, accessKey, secretKey, sessionToken string, isSecure bool) *mc.Config {
|
||||
// We have a valid alias and hostConfig. We populate the
|
||||
// consoleCredentials from the match found in the config file.
|
||||
// mcsCredentials from the match found in the config file.
|
||||
s3Config := new(mc.Config)
|
||||
|
||||
s3Config.AppName = "console" // TODO: make this a constant
|
||||
s3Config.AppVersion = "" // TODO: get this from constant or build
|
||||
s3Config.AppName = "mcs" // TODO: make this a constant
|
||||
s3Config.AppVersion = "" // TODO: get this from constant or build
|
||||
s3Config.AppComments = []string{}
|
||||
s3Config.Debug = false
|
||||
s3Config.Insecure = isSecure
|
||||
|
||||
@@ -24,19 +24,19 @@ import (
|
||||
"github.com/minio/minio/pkg/env"
|
||||
)
|
||||
|
||||
// Port console default port
|
||||
// Port mcs default port
|
||||
var Port = "9090"
|
||||
|
||||
// Hostname console hostname
|
||||
// Hostname mcs hostname
|
||||
var Hostname = "0.0.0.0"
|
||||
|
||||
// TLSHostname console tls hostname
|
||||
// TLSHostname mcs tls hostname
|
||||
var TLSHostname = "0.0.0.0"
|
||||
|
||||
// TLSPort console tls port
|
||||
// TLSPort mcs tls port
|
||||
var TLSPort = "9443"
|
||||
|
||||
// TLSRedirect console tls redirect rule
|
||||
// TLSRedirect mcs tls redirect rule
|
||||
var TLSRedirect = "off"
|
||||
|
||||
// defaultTenantMemorySize default value used
|
||||
@@ -44,21 +44,21 @@ var TLSRedirect = "off"
|
||||
var defaultTenantMemorySize = "16Gi"
|
||||
|
||||
func getAccessKey() string {
|
||||
return env.Get(ConsoleAccessKey, "minioadmin")
|
||||
return env.Get(McsAccessKey, "minioadmin")
|
||||
}
|
||||
|
||||
func getSecretKey() string {
|
||||
return env.Get(ConsoleSecretKey, "minioadmin")
|
||||
return env.Get(McsSecretKey, "minioadmin")
|
||||
}
|
||||
|
||||
func getMinIOServer() string {
|
||||
return strings.TrimSpace(env.Get(ConsoleMinIOServer, "http://localhost:9000"))
|
||||
return strings.TrimSpace(env.Get(McsMinIOServer, "http://localhost:9000"))
|
||||
}
|
||||
|
||||
// If CONSOLE_MINIO_SERVER_TLS_ROOT_CAS is true console will load a list of certificates into the
|
||||
// If MCS_MINIO_SERVER_TLS_ROOT_CAS is true mcs will load a list of certificates into the
|
||||
// http.client rootCAs store, this is useful for testing or when working with self-signed certificates
|
||||
func getMinioServerTLSRootCAs() []string {
|
||||
caCertFileNames := strings.TrimSpace(env.Get(ConsoleMinIOServerTLSRootCAs, ""))
|
||||
caCertFileNames := strings.TrimSpace(env.Get(McsMinIOServerTLSRootCAs, ""))
|
||||
if caCertFileNames == "" {
|
||||
return []string{}
|
||||
}
|
||||
@@ -90,35 +90,35 @@ func getMinIOEndpointIsSecure() bool {
|
||||
}
|
||||
|
||||
func getProductionMode() bool {
|
||||
return strings.ToLower(env.Get(ConsoleProductionMode, "on")) == "on"
|
||||
return strings.ToLower(env.Get(McsProductionMode, "on")) == "on"
|
||||
}
|
||||
|
||||
// GetHostname gets console hostname set on env variable,
|
||||
// GetHostname gets mcs hostname set on env variable,
|
||||
// default one or defined on run command
|
||||
func GetHostname() string {
|
||||
return strings.ToLower(env.Get(ConsoleHostname, Hostname))
|
||||
return strings.ToLower(env.Get(McsHostname, Hostname))
|
||||
}
|
||||
|
||||
// GetPort gets console por set on env variable
|
||||
// GetPort gets mcs por set on env variable
|
||||
// or default one
|
||||
func GetPort() int {
|
||||
port, err := strconv.Atoi(env.Get(ConsolePort, Port))
|
||||
port, err := strconv.Atoi(env.Get(McsPort, Port))
|
||||
if err != nil {
|
||||
port = 9090
|
||||
}
|
||||
return port
|
||||
}
|
||||
|
||||
// GetSSLHostname gets console ssl hostname set on env variable
|
||||
// GetSSLHostname gets mcs ssl hostname set on env variable
|
||||
// or default one
|
||||
func GetSSLHostname() string {
|
||||
return strings.ToLower(env.Get(ConsoleTLSHostname, TLSHostname))
|
||||
return strings.ToLower(env.Get(McsTLSHostname, TLSHostname))
|
||||
}
|
||||
|
||||
// GetSSLPort gets console ssl port set on env variable
|
||||
// GetSSLPort gets mcs ssl port set on env variable
|
||||
// or default one
|
||||
func GetSSLPort() int {
|
||||
port, err := strconv.Atoi(env.Get(ConsoleTLSPort, TLSPort))
|
||||
port, err := strconv.Atoi(env.Get(McsTLSPort, TLSPort))
|
||||
if err != nil {
|
||||
port = 9443
|
||||
}
|
||||
@@ -127,7 +127,7 @@ func GetSSLPort() int {
|
||||
|
||||
// Get secure middleware env variable configurations
|
||||
func getSecureAllowedHosts() []string {
|
||||
allowedHosts := env.Get(ConsoleSecureAllowedHosts, "")
|
||||
allowedHosts := env.Get(McsSecureAllowedHosts, "")
|
||||
if allowedHosts != "" {
|
||||
return strings.Split(allowedHosts, ",")
|
||||
}
|
||||
@@ -136,39 +136,39 @@ func getSecureAllowedHosts() []string {
|
||||
|
||||
// AllowedHostsAreRegex determines, if the provided AllowedHosts slice contains valid regular expressions. Default is false.
|
||||
func getSecureAllowedHostsAreRegex() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureAllowedHostsAreRegex, "off")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureAllowedHostsAreRegex, "off")) == "on"
|
||||
}
|
||||
|
||||
// If FrameDeny is set to true, adds the X-Frame-Options header with the value of `DENY`. Default is true.
|
||||
func getSecureFrameDeny() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureFrameDeny, "on")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureFrameDeny, "on")) == "on"
|
||||
}
|
||||
|
||||
// If ContentTypeNosniff is true, adds the X-Content-Type-Options header with the value `nosniff`. Default is true.
|
||||
func getSecureContentTypeNonSniff() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureContentTypeNoSniff, "on")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureContentTypeNoSniff, "on")) == "on"
|
||||
}
|
||||
|
||||
// If BrowserXssFilter is true, adds the X-XSS-Protection header with the value `1; mode=block`. Default is true.
|
||||
func getSecureBrowserXSSFilter() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureBrowserXSSFilter, "on")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureBrowserXSSFilter, "on")) == "on"
|
||||
}
|
||||
|
||||
// ContentSecurityPolicy allows the Content-Security-Policy header value to be set with a custom value. Default is "".
|
||||
// Passing a template string will replace `$NONCE` with a dynamic nonce value of 16 bytes for each request which can be
|
||||
// later retrieved using the Nonce function.
|
||||
func getSecureContentSecurityPolicy() string {
|
||||
return env.Get(ConsoleSecureContentSecurityPolicy, "")
|
||||
return env.Get(McsSecureContentSecurityPolicy, "")
|
||||
}
|
||||
|
||||
// ContentSecurityPolicyReportOnly allows the Content-Security-Policy-Report-Only header value to be set with a custom value. Default is "".
|
||||
func getSecureContentSecurityPolicyReportOnly() string {
|
||||
return env.Get(ConsoleSecureContentSecurityPolicyReportOnly, "")
|
||||
return env.Get(McsSecureContentSecurityPolicyReportOnly, "")
|
||||
}
|
||||
|
||||
// HostsProxyHeaders is a set of header keys that may hold a proxied hostname value for the request.
|
||||
func getSecureHostsProxyHeaders() []string {
|
||||
allowedHosts := env.Get(ConsoleSecureHostsProxyHeaders, "")
|
||||
allowedHosts := env.Get(McsSecureHostsProxyHeaders, "")
|
||||
if allowedHosts != "" {
|
||||
return strings.Split(allowedHosts, ",")
|
||||
}
|
||||
@@ -177,17 +177,17 @@ func getSecureHostsProxyHeaders() []string {
|
||||
|
||||
// If SSLRedirect is set to true, then only allow HTTPS requests. Default is true.
|
||||
func getSSLRedirect() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureSSLRedirect, TLSRedirect)) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureSSLRedirect, TLSRedirect)) == "on"
|
||||
}
|
||||
|
||||
// SSLHost is the host name that is used to redirect HTTP requests to HTTPS. Default is "", which indicates to use the same host.
|
||||
func getSecureSSLHost() string {
|
||||
return env.Get(ConsoleSecureSSLHost, fmt.Sprintf("%s:%s", TLSHostname, TLSPort))
|
||||
return env.Get(McsSecureSSLHost, fmt.Sprintf("%s:%s", TLSHostname, TLSPort))
|
||||
}
|
||||
|
||||
// STSSeconds is the max-age of the Strict-Transport-Security header. Default is 0, which would NOT include the header.
|
||||
func getSecureSTSSeconds() int64 {
|
||||
seconds, err := strconv.Atoi(env.Get(ConsoleSecureSTSSeconds, "0"))
|
||||
seconds, err := strconv.Atoi(env.Get(McsSecureSTSSeconds, "0"))
|
||||
if err != nil {
|
||||
seconds = 0
|
||||
}
|
||||
@@ -196,45 +196,45 @@ func getSecureSTSSeconds() int64 {
|
||||
|
||||
// If STSIncludeSubdomains is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header. Default is false.
|
||||
func getSecureSTSIncludeSubdomains() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureSTSIncludeSubdomains, "off")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureSTSIncludeSubdomains, "off")) == "on"
|
||||
}
|
||||
|
||||
// If STSPreload is set to true, the `preload` flag will be appended to the Strict-Transport-Security header. Default is false.
|
||||
func getSecureSTSPreload() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureSTSPreload, "off")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureSTSPreload, "off")) == "on"
|
||||
}
|
||||
|
||||
// If SSLTemporaryRedirect is true, the a 302 will be used while redirecting. Default is false (301).
|
||||
func getSecureSSLTemporaryRedirect() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureSSLTemporaryRedirect, "off")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureSSLTemporaryRedirect, "off")) == "on"
|
||||
}
|
||||
|
||||
// STS header is only included when the connection is HTTPS.
|
||||
func getSecureForceSTSHeader() bool {
|
||||
return strings.ToLower(env.Get(ConsoleSecureForceSTSHeader, "off")) == "on"
|
||||
return strings.ToLower(env.Get(McsSecureForceSTSHeader, "off")) == "on"
|
||||
}
|
||||
|
||||
// PublicKey implements HPKP to prevent MITM attacks with forged certificates. Default is "".
|
||||
func getSecurePublicKey() string {
|
||||
return env.Get(ConsoleSecurePublicKey, "")
|
||||
return env.Get(McsSecurePublicKey, "")
|
||||
}
|
||||
|
||||
// ReferrerPolicy allows the Referrer-Policy header with the value to be set with a custom value. Default is "".
|
||||
func getSecureReferrerPolicy() string {
|
||||
return env.Get(ConsoleSecureReferrerPolicy, "")
|
||||
return env.Get(McsSecureReferrerPolicy, "")
|
||||
}
|
||||
|
||||
// FeaturePolicy allows the Feature-Policy header with the value to be set with a custom value. Default is "".
|
||||
func getSecureFeaturePolicy() string {
|
||||
return env.Get(ConsoleSecureFeaturePolicy, "")
|
||||
return env.Get(McsSecureFeaturePolicy, "")
|
||||
}
|
||||
|
||||
func getSecureExpectCTHeader() string {
|
||||
return env.Get(ConsoleSecureExpectCTHeader, "")
|
||||
return env.Get(McsSecureExpectCTHeader, "")
|
||||
}
|
||||
|
||||
// getTenantMemorySize Memory size value to be used when generating the
|
||||
// Tenant request
|
||||
func getTenantMemorySize() string {
|
||||
return env.Get(ConsoleTenantMemorySize, defaultTenantMemorySize)
|
||||
return env.Get(McsTenantMemorySize, defaultTenantMemorySize)
|
||||
}
|
||||
|
||||
@@ -24,28 +24,28 @@ import (
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/minio/console/pkg/auth"
|
||||
"github.com/minio/mcs/pkg/auth"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/pkg"
|
||||
"github.com/minio/mcs/models"
|
||||
"github.com/minio/mcs/pkg"
|
||||
|
||||
assetFS "github.com/elazarl/go-bindata-assetfs"
|
||||
|
||||
portalUI "github.com/minio/console/portal-ui"
|
||||
portalUI "github.com/minio/mcs/portal-ui"
|
||||
|
||||
"github.com/go-openapi/errors"
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/mcs/restapi/operations"
|
||||
"github.com/unrolled/secure"
|
||||
)
|
||||
|
||||
//go:generate swagger generate server --target ../../console --name Console --spec ../swagger.yml
|
||||
//go:generate swagger generate server --target ../../mcs --name Mcs --spec ../swagger.yml
|
||||
|
||||
func configureFlags(api *operations.ConsoleAPI) {
|
||||
func configureFlags(api *operations.McsAPI) {
|
||||
// api.CommandLineOptionsGroups = []swag.CommandLineOptionsGroup{ ... }
|
||||
}
|
||||
|
||||
func configureAPI(api *operations.ConsoleAPI) http.Handler {
|
||||
func configureAPI(api *operations.McsAPI) http.Handler {
|
||||
// configure the api here
|
||||
api.ServeError = errors.ServeError
|
||||
|
||||
@@ -176,7 +176,7 @@ func setupGlobalMiddleware(handler http.Handler) http.Handler {
|
||||
// FileServerMiddleware serves files from the static folder
|
||||
func FileServerMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Server", "console/"+pkg.Version) // add HTTP Server header
|
||||
w.Header().Set("Server", "mcs/"+pkg.Version) // add HTTP Server header
|
||||
switch {
|
||||
case strings.HasPrefix(r.URL.Path, "/ws"):
|
||||
serveWS(w, r)
|
||||
@@ -17,6 +17,6 @@
|
||||
package restapi
|
||||
|
||||
const (
|
||||
// ConsoleTenantMemorySize Memory size to be used when creating Tenant request
|
||||
ConsoleTenantMemorySize = "CONSOLE_TENANT_MEMORY_SIZE"
|
||||
// McsTenantMemorySize Memory size to be used when creating Tenant request
|
||||
McsTenantMemorySize = "MCS_TENANT_MEMORY_SIZE"
|
||||
)
|
||||
|
||||
@@ -18,35 +18,35 @@ package restapi
|
||||
|
||||
const (
|
||||
// consts for common configuration
|
||||
ConsoleVersion = `0.1.0`
|
||||
ConsoleAccessKey = "CONSOLE_ACCESS_KEY"
|
||||
ConsoleSecretKey = "CONSOLE_SECRET_KEY"
|
||||
ConsoleMinIOServer = "CONSOLE_MINIO_SERVER"
|
||||
ConsoleMinIOServerTLSRootCAs = "CONSOLE_MINIO_SERVER_TLS_ROOT_CAS"
|
||||
ConsoleProductionMode = "CONSOLE_PRODUCTION_MODE"
|
||||
ConsoleHostname = "CONSOLE_HOSTNAME"
|
||||
ConsolePort = "CONSOLE_PORT"
|
||||
ConsoleTLSHostname = "CONSOLE_TLS_HOSTNAME"
|
||||
ConsoleTLSPort = "CONSOLE_TLS_PORT"
|
||||
McsVersion = `0.1.0`
|
||||
McsAccessKey = "MCS_ACCESS_KEY"
|
||||
McsSecretKey = "MCS_SECRET_KEY"
|
||||
McsMinIOServer = "MCS_MINIO_SERVER"
|
||||
McsMinIOServerTLSRootCAs = "MCS_MINIO_SERVER_TLS_ROOT_CAS"
|
||||
McsProductionMode = "MCS_PRODUCTION_MODE"
|
||||
McsHostname = "MCS_HOSTNAME"
|
||||
McsPort = "MCS_PORT"
|
||||
McsTLSHostname = "MCS_TLS_HOSTNAME"
|
||||
McsTLSPort = "MCS_TLS_PORT"
|
||||
|
||||
// consts for Secure middleware
|
||||
ConsoleSecureAllowedHosts = "CONSOLE_SECURE_ALLOWED_HOSTS"
|
||||
ConsoleSecureAllowedHostsAreRegex = "CONSOLE_SECURE_ALLOWED_HOSTS_ARE_REGEX"
|
||||
ConsoleSecureFrameDeny = "CONSOLE_SECURE_FRAME_DENY"
|
||||
ConsoleSecureContentTypeNoSniff = "CONSOLE_SECURE_CONTENT_TYPE_NO_SNIFF"
|
||||
ConsoleSecureBrowserXSSFilter = "CONSOLE_SECURE_BROWSER_XSS_FILTER"
|
||||
ConsoleSecureContentSecurityPolicy = "CONSOLE_SECURE_CONTENT_SECURITY_POLICY"
|
||||
ConsoleSecureContentSecurityPolicyReportOnly = "CONSOLE_SECURE_CONTENT_SECURITY_POLICY_REPORT_ONLY"
|
||||
ConsoleSecureHostsProxyHeaders = "CONSOLE_SECURE_HOSTS_PROXY_HEADERS"
|
||||
ConsoleSecureSTSSeconds = "CONSOLE_SECURE_STS_SECONDS"
|
||||
ConsoleSecureSTSIncludeSubdomains = "CONSOLE_SECURE_STS_INCLUDE_SUB_DOMAINS"
|
||||
ConsoleSecureSTSPreload = "CONSOLE_SECURE_STS_PRELOAD"
|
||||
ConsoleSecureSSLRedirect = "CONSOLE_SECURE_SSL_REDIRECT"
|
||||
ConsoleSecureSSLHost = "CONSOLE_SECURE_SSL_HOST"
|
||||
ConsoleSecureSSLTemporaryRedirect = "CONSOLE_SECURE_SSL_TEMPORARY_REDIRECT"
|
||||
ConsoleSecureForceSTSHeader = "CONSOLE_SECURE_FORCE_STS_HEADER"
|
||||
ConsoleSecurePublicKey = "CONSOLE_SECURE_PUBLIC_KEY"
|
||||
ConsoleSecureReferrerPolicy = "CONSOLE_SECURE_REFERRER_POLICY"
|
||||
ConsoleSecureFeaturePolicy = "CONSOLE_SECURE_FEATURE_POLICY"
|
||||
ConsoleSecureExpectCTHeader = "CONSOLE_SECURE_EXPECT_CT_HEADER"
|
||||
McsSecureAllowedHosts = "MCS_SECURE_ALLOWED_HOSTS"
|
||||
McsSecureAllowedHostsAreRegex = "MCS_SECURE_ALLOWED_HOSTS_ARE_REGEX"
|
||||
McsSecureFrameDeny = "MCS_SECURE_FRAME_DENY"
|
||||
McsSecureContentTypeNoSniff = "MCS_SECURE_CONTENT_TYPE_NO_SNIFF"
|
||||
McsSecureBrowserXSSFilter = "MCS_SECURE_BROWSER_XSS_FILTER"
|
||||
McsSecureContentSecurityPolicy = "MCS_SECURE_CONTENT_SECURITY_POLICY"
|
||||
McsSecureContentSecurityPolicyReportOnly = "MCS_SECURE_CONTENT_SECURITY_POLICY_REPORT_ONLY"
|
||||
McsSecureHostsProxyHeaders = "MCS_SECURE_HOSTS_PROXY_HEADERS"
|
||||
McsSecureSTSSeconds = "MCS_SECURE_STS_SECONDS"
|
||||
McsSecureSTSIncludeSubdomains = "MCS_SECURE_STS_INCLUDE_SUB_DOMAINS"
|
||||
McsSecureSTSPreload = "MCS_SECURE_STS_PRELOAD"
|
||||
McsSecureSSLRedirect = "MCS_SECURE_SSL_REDIRECT"
|
||||
McsSecureSSLHost = "MCS_SECURE_SSL_HOST"
|
||||
McsSecureSSLTemporaryRedirect = "MCS_SECURE_SSL_TEMPORARY_REDIRECT"
|
||||
McsSecureForceSTSHeader = "MCS_SECURE_FORCE_STS_HEADER"
|
||||
McsSecurePublicKey = "MCS_SECURE_PUBLIC_KEY"
|
||||
McsSecureReferrerPolicy = "MCS_SECURE_REFERRER_POLICY"
|
||||
McsSecureFeaturePolicy = "MCS_SECURE_FEATURE_POLICY"
|
||||
McsSecureExpectCTHeader = "MCS_SECURE_EXPECT_CT_HEADER"
|
||||
)
|
||||
|
||||
@@ -23,9 +23,9 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/minio/console/cluster"
|
||||
gkev1beta2 "github.com/minio/console/pkg/apis/networking.gke.io/v1beta2"
|
||||
gkeClientset "github.com/minio/console/pkg/clientgen/clientset/versioned"
|
||||
"github.com/minio/mcs/cluster"
|
||||
gkev1beta2 "github.com/minio/mcs/pkg/apis/networking.gke.io/v1beta2"
|
||||
gkeClientset "github.com/minio/mcs/pkg/clientgen/clientset/versioned"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
extensionsBeta1 "k8s.io/api/extensions/v1beta1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
@@ -70,7 +70,7 @@ func gkeIntegration(clientset *kubernetes.Clientset, tenantName string, namespac
|
||||
log.Println("informer closed")
|
||||
|
||||
tenantDomain := fmt.Sprintf("%s.cloud.min.dev", tenantName)
|
||||
tenantConsoleDomain := fmt.Sprintf("console.%s.cloud.min.dev", tenantName)
|
||||
tenantMcsDomain := fmt.Sprintf("console.%s.cloud.min.dev", tenantName)
|
||||
|
||||
// customization for demo, add the ingress for this new tenant
|
||||
// create ManagedCertificate
|
||||
@@ -82,7 +82,7 @@ func gkeIntegration(clientset *kubernetes.Clientset, tenantName string, namespac
|
||||
Spec: gkev1beta2.ManagedCertificateSpec{
|
||||
Domains: []string{
|
||||
tenantDomain,
|
||||
tenantConsoleDomain,
|
||||
tenantMcsDomain,
|
||||
},
|
||||
},
|
||||
Status: gkev1beta2.ManagedCertificateStatus{
|
||||
@@ -134,38 +134,38 @@ func gkeIntegration(clientset *kubernetes.Clientset, tenantName string, namespac
|
||||
return err
|
||||
}
|
||||
|
||||
//NOW FOR Console
|
||||
// create consoleManagedCertificate
|
||||
//NOW FOR MCS
|
||||
// create mcsManagedCertificate
|
||||
|
||||
// get a nodeport port for this tenant and create a nodeport for it
|
||||
tenantConsoleNodePort := 9090
|
||||
tenantMcsNodePort := 9090
|
||||
|
||||
targetConsolePort := intstr.IntOrString{
|
||||
targetMcsPort := intstr.IntOrString{
|
||||
Type: intstr.Int,
|
||||
IntVal: 9090,
|
||||
}
|
||||
|
||||
tenantNpConsoleSvc := fmt.Sprintf("%s-console-np", tenantName)
|
||||
npConsoleSvc := corev1.Service{
|
||||
tenantMcsnpMcsSvc := fmt.Sprintf("%s-mcs-np", tenantName)
|
||||
npMcsSvc := corev1.Service{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: tenantNpConsoleSvc,
|
||||
Name: tenantMcsnpMcsSvc,
|
||||
},
|
||||
Spec: corev1.ServiceSpec{
|
||||
Selector: map[string]string{
|
||||
"v1.min.io/console": fmt.Sprintf("%s-console", tenantName),
|
||||
"v1.min.io/mcs": fmt.Sprintf("%s-mcs", tenantName),
|
||||
},
|
||||
Type: corev1.ServiceTypeNodePort,
|
||||
Ports: []corev1.ServicePort{
|
||||
{
|
||||
Protocol: corev1.ProtocolTCP,
|
||||
Port: int32(tenantConsoleNodePort),
|
||||
TargetPort: targetConsolePort,
|
||||
Port: int32(tenantMcsNodePort),
|
||||
TargetPort: targetMcsPort,
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
_, err = clientset.CoreV1().Services(namespace).Create(context.Background(), &npConsoleSvc, metav1.CreateOptions{})
|
||||
_, err = clientset.CoreV1().Services(namespace).Create(context.Background(), &npMcsSvc, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -185,9 +185,9 @@ func gkeIntegration(clientset *kubernetes.Clientset, tenantName string, namespac
|
||||
IntVal: int32(tenantNodePort),
|
||||
}
|
||||
|
||||
tenantConsoleNodePortIoS := intstr.IntOrString{
|
||||
tenantMcsNodePortIoS := intstr.IntOrString{
|
||||
Type: intstr.Int,
|
||||
IntVal: int32(tenantConsoleNodePort),
|
||||
IntVal: int32(tenantMcsNodePort),
|
||||
}
|
||||
|
||||
consoleIngress.Spec.Rules = append(consoleIngress.Spec.Rules, extensionsBeta1.IngressRule{
|
||||
@@ -206,14 +206,14 @@ func gkeIntegration(clientset *kubernetes.Clientset, tenantName string, namespac
|
||||
},
|
||||
})
|
||||
consoleIngress.Spec.Rules = append(consoleIngress.Spec.Rules, extensionsBeta1.IngressRule{
|
||||
Host: tenantConsoleDomain,
|
||||
Host: tenantMcsDomain,
|
||||
IngressRuleValue: extensionsBeta1.IngressRuleValue{
|
||||
HTTP: &extensionsBeta1.HTTPIngressRuleValue{
|
||||
Paths: []extensionsBeta1.HTTPIngressPath{
|
||||
{
|
||||
Backend: extensionsBeta1.IngressBackend{
|
||||
ServiceName: tenantNpConsoleSvc,
|
||||
ServicePort: tenantConsoleNodePortIoS,
|
||||
ServiceName: tenantMcsnpMcsSvc,
|
||||
ServicePort: tenantMcsNodePortIoS,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddGroupHandlerFunc turns a function with the right signature into a add group handler
|
||||
|
||||
@@ -30,7 +30,7 @@ import (
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// NewAddGroupParams creates a new AddGroupParams object
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddGroupCreatedCode is the HTTP code returned for type AddGroupCreated
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddNotificationEndpointHandlerFunc turns a function with the right signature into a add notification endpoint handler
|
||||
|
||||
@@ -30,7 +30,7 @@ import (
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// NewAddNotificationEndpointParams creates a new AddNotificationEndpointParams object
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddNotificationEndpointCreatedCode is the HTTP code returned for type AddNotificationEndpointCreated
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddPolicyHandlerFunc turns a function with the right signature into a add policy handler
|
||||
|
||||
@@ -30,7 +30,7 @@ import (
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// NewAddPolicyParams creates a new AddPolicyParams object
|
||||
|
||||
@@ -27,7 +27,7 @@ import (
|
||||
|
||||
"github.com/go-openapi/runtime"
|
||||
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/mcs/models"
|
||||
)
|
||||
|
||||
// AddPolicyCreatedCode is the HTTP code returned for type AddPolicyCreated
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user