Add API to create user settings #7095

christoph-jerolimov · 2020-11-04T00:19:48Z

Fixes:
https://issues.redhat.com/browse/ODC-4755

Analysis / Root cause:
Based on the User Settings for OpenShift Console enhancement proposal we want to create a ConfigMap for each individual user in the namespace openshift-console-user-settings

Currently you need create this namespace yourself, see Test Setup below. This namespace will be automatically created by the console-operator, see PR openshift/console-operator#479

Solution Description:
Because the user could not create a ConfigMap here, we create a new ConfigMap, Role and RoleBinding with the service account role over the bridge. This code provides 3 new endpoints to create, get and delete the user settings. (The second and third API calls primary for debugging / development.) The console will fetch the ConfigMap over the known k8sWatch API.

API
GET /api/console/user-settings
Get the current user settings (returns a ConfigMap or 404)

POST /api/console/user-settings
Create a user setting ConfigMap for the current user. It returns the existing ConfigMap if it is already exist. This method does not accept an initial content for the ConfigMap.

DELETE /api/console/user-settings
Delete the user setting ConfigMap for the current user. Returns 204 No Content if the ConfigMap was deleted, also if it was not created yet.

Screen shots / Gifs for design review:
Irrelevant

Unit test coverage report:

➜  console git:([odc-4755](https://issues.redhat.com/browse/odc-4755)) go test -coverprofile=coverage.out github.com/openshift/console/pkg/usersettings  
ok  	github.com/openshift/console/pkg/usersettings	0.006s	coverage: 16.2% of statements

➜  console git:([odc-4755](https://issues.redhat.com/browse/odc-4755)) ✗ go tool cover -func=coverage.out
github.com/openshift/console/pkg/usersettings/handlers.go:37:	HandleUserSettings		0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:86:	getUserSettings			0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:92:	createUserSettings		0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:121:	deleteUserSettings		0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:140:	createServiceAccountClient	0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:149:	createUserProxyClient		0.0%
github.com/openshift/console/pkg/usersettings/handlers.go:158:	getUserSettingMeta		0.0%
github.com/openshift/console/pkg/usersettings/helpers.go:11:	getUserSettingMeta		100.0%
github.com/openshift/console/pkg/usersettings/helpers.go:29:	createRole			100.0%
github.com/openshift/console/pkg/usersettings/helpers.go:61:	createRoleBinding		100.0%
github.com/openshift/console/pkg/usersettings/helpers.go:85:	createConfigMap			100.0%
github.com/openshift/console/pkg/usersettings/types.go:10:	getConfigMapName		100.0%
github.com/openshift/console/pkg/usersettings/types.go:14:	getRoleName			100.0%
github.com/openshift/console/pkg/usersettings/types.go:18:	getRoleBindingName		100.0%
total:								(statements)			16.2%

Test setup:
This PR require some additional RBAC rules.

If PR Add namespace and role resources for user settings console-operator#479 is not part of your cluster you need to create a namespace:

1a Create namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: openshift-console-user-settings
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
    openshift.io/node-selector: ""

Until https://github.com/openshift/console-operator/pull/486/files is merged and available on your cluster you need to add this as well:

1b Create Role:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: console-user-settings-admin-fixed
  namespace: openshift-console-user-settings
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
rules:
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - roles
  - rolebindings
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch

1c Create RoleBinding:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: console-user-settings-admin-fixed
  namespace: openshift-console-user-settings
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
roleRef:
  kind: Role
  name: console-user-settings-admin-fixed
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: console
    namespace: openshift-console

Because the API calls needs a authentication and CSRF token, you can test the API calls from a logged in browser session with this JavaScript snippet:

In frontend code this is automatically done by coFetch, see co-fetch.js. But to test this without additional frontend code or postman I extracted the code for you:

2a Extract crcf token:

let cookiePrefix = 'csrf-token=';
let getCSRFToken = () =>
  document &&
  document.cookie &&
  document.cookie
    .split(';')
    .map((c) => c.trim())
    .filter((c) => c.startsWith(cookiePrefix))
    .map((c) => c.slice(cookiePrefix.length))
    .pop();
getCSRFToken();

2b Get user-settings:

fetch('/api/console/user-settings', { method: 'GET', headers: { 'X-CSRFToken': getCSRFToken() } }).then(
    (res) => {
        console.log('res', res);
        res.text().then(
            (text) => {
                console.log('text', text);
            },
            (parseErr) => console.warn('parseErr', parseErr)
        );
    },
    (requestErr) => {
        console.warn('requestErr', requestErr);
    }
);

2c Create user-settings:

fetch('/api/console/user-settings', { method: 'POST', headers: { 'X-CSRFToken': getCSRFToken() } }).then(
    (res) => {
        console.log('res', res);
        res.text().then(
            (text) => {
                console.log('text', text);
            },
            (parseErr) => console.warn('parseErr', parseErr)
        );
    },
    (requestErr) => {
        console.warn('requestErr', requestErr);
    }
);

Browser conformance:
Irrelevant

christoph-jerolimov · 2020-11-13T17:31:12Z

Note for myself, we can fetch the current user uid with this command:

oc get users.user.openshift.io/~ -o template={{.metadata.uid}}

christoph-jerolimov · 2020-11-25T13:52:33Z

/retest

pkg/usersettings/handlers.go

jhadvig · 2020-11-25T13:46:21Z

pkg/usersettings/handlers.go

lets just move the context initialization to the HandleUserSettings() and pass it as parameter. That way if we decide in the future to replace it by a single context there would be less changes.

I moved the context, createServiceAccountClient and getResourceData now at the top of HandleUserSettings so that there is just one place for it

jhadvig · 2020-11-25T13:57:56Z

pkg/usersettings/handlers.go

Also this call can be moved to the HandleUserSettings() and pas as param to the appropriate UserSettingsHandler method

I thought this also, but are unsure how an OPTION request would handle this. Should I add extra if for an OPTION request before that or should we check if this works locally and on a cluster. I will change this and we see what happen :)

Moved context, createServiceAccountClient and getResourceData to HandleUserSettings

jhadvig · 2020-11-25T14:00:21Z

pkg/usersettings/handlers.go

Also this call can be moved to the HandleUserSettings() and pas as param to the appropriate UserSettingsHandler method.

pkg/usersettings/handlers.go

jhadvig · 2020-11-25T14:39:57Z

pkg/usersettings/types.go

Would be good to add unit tests for these methods.

I would like to move this from "name getters / helpers" to the moment when creating the ResourceNames. See comment above.

But for the moment I added tests for the "name getters / helpers" here as well.

jhadvig · 2020-11-25T14:42:00Z

pkg/usersettings/handlers.go

Lets create a helper for this, so we can add unit-test.

Done, see helpers.go and helpers_test.go

jhadvig · 2020-11-25T14:42:07Z

pkg/usersettings/handlers.go

Lets create a helper for this, so we can add unit-test.

Done, see helpers.go and helpers_test.go

jhadvig · 2020-11-25T14:42:16Z

pkg/usersettings/handlers.go

Lets create a helper for this, so we can add unit-test.

Done, see helpers.go and helpers_test.go

jhadvig · 2020-11-25T14:43:17Z

cmd/bridge/main.go

christoph-jerolimov · 2020-11-25T17:43:57Z

@jhadvig All done, I had one small idea for another cleanup. And I can squash all commits leter. Thanks for reviewing this.

christianvogt · 2020-11-25T22:08:39Z

pkg/usersettings/helpers.go

Make sure there is no UID for the kubeadmin case:

Suggested change

if name == "kube:admin" {

resourceIdentifier = "kubeadmin"

} else if uid != "" {

resourceIdentifier = uid

if uid != "" {

resourceIdentifier = uid

} else if name == "kube:admin" {

resourceIdentifier = "kubeadmin"

pkg/usersettings/handlers.go

jhadvig · 2020-11-26T11:00:31Z

pkg/usersettings/handlers.go

The preferred idiomatic way for go, how to structure the response should be:

if err != nil { errMsg := fmt.Sprintf("Failed to create user settings: %v", err) klog.Errorf(errMsg) serverutils.SendResponse(w, http.StatusBadGateway, serverutils.ApiError{Err: errMsg}) return } serverutils.SendResponse(w, http.StatusOK, configMap)

so we return immediatelly

pkg/usersettings/handlers.go

jhadvig · 2020-11-26T11:08:40Z

pkg/usersettings/handlers.go

yeah, thats probably ok

pkg/usersettings/helpers.go

jhadvig · 2020-11-26T11:15:54Z

pkg/usersettings/handlers.go

we should call deleteUserSettings() method upon error. So we dont end up in an inconsistent state, where Role and RoleBinding was created but the CM for some reason was not.
Either that or we rely that the request would be repeated until all the resources are created.

As discussed in slack, I added deletedUserSettings before returning the create error.

jhadvig

/lgtm

christoph-jerolimov · 2020-11-30T16:57:15Z

/assign @spadgett

spadgett · 2020-11-30T17:06:53Z

/approve

openshift-ci-robot · 2020-11-30T17:07:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jerolimov, jhadvig, spadgett

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [spadgett]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-robot · 2020-12-01T03:45:06Z

@jerolimov: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-gcp-console	`d023732`	link	`/test e2e-gcp-console`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2020-12-01T03:58:01Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. component/backend Related to backend labels Nov 4, 2020

openshift-ci-robot requested review from rhamilto and spadgett November 4, 2020 00:20

christoph-jerolimov force-pushed the odc-4755 branch 6 times, most recently from 5aba1a8 to 3b16941 Compare November 5, 2020 10:05

christoph-jerolimov mentioned this pull request Nov 5, 2020

Add namespace and role resources for user settings openshift/console-operator#479

Merged

christoph-jerolimov force-pushed the odc-4755 branch 3 times, most recently from 8a50fca to d9675c1 Compare November 12, 2020 08:08

christoph-jerolimov force-pushed the odc-4755 branch 2 times, most recently from 519d7f2 to 3c44a04 Compare November 17, 2020 10:24

christoph-jerolimov changed the title ~~[WIP] Add API to create user settings~~ Add API to create user settings Nov 17, 2020

openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2020

christoph-jerolimov changed the title ~~Add API to create user settings~~ [WIP] Add API to create user settings Nov 17, 2020

openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2020

christoph-jerolimov force-pushed the odc-4755 branch 9 times, most recently from 93763b1 to 643e34b Compare November 17, 2020 18:14

christoph-jerolimov force-pushed the odc-4755 branch 2 times, most recently from 35c212d to 1b8b14c Compare November 25, 2020 00:44

openshift-ci-robot added the component/shared Related to console-shared label Nov 25, 2020

christoph-jerolimov force-pushed the odc-4755 branch from 1b8b14c to 09c2aed Compare November 25, 2020 09:41

christoph-jerolimov mentioned this pull request Nov 25, 2020

Update user settings hook to use bridge call to create ConfigMap #7327

Merged

4 tasks

jhadvig requested changes Nov 25, 2020

View reviewed changes

christoph-jerolimov force-pushed the odc-4755 branch from 09c2aed to c30b2ea Compare November 25, 2020 15:34

christianvogt reviewed Nov 25, 2020

View reviewed changes

jhadvig requested changes Nov 26, 2020

View reviewed changes

christoph-jerolimov force-pushed the odc-4755 branch 2 times, most recently from 4e977b8 to 2fcb14d Compare November 26, 2020 13:09

christoph-jerolimov requested a review from jhadvig November 27, 2020 01:56

christoph-jerolimov added 2 commits November 27, 2020 05:12

Add API to create user settings

e095e51

Return valid http status code for forbidden and not found errors

d023732

christoph-jerolimov force-pushed the odc-4755 branch from 1fdafe5 to d023732 Compare November 27, 2020 04:12

jhadvig approved these changes Nov 30, 2020

View reviewed changes

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Nov 30, 2020

christoph-jerolimov requested a review from spadgett November 30, 2020 16:56

openshift-ci-robot assigned spadgett Nov 30, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 30, 2020

openshift-merge-robot merged commit b54fdd5 into openshift:master Dec 1, 2020

christoph-jerolimov mentioned this pull request Dec 1, 2020

Add scripts to get and set user settings on a cluster #7384

Closed

spadgett added this to the v4.7 milestone Dec 9, 2020

-	if name == "kube:admin" {
-		resourceIdentifier = "kubeadmin"
-	} else if uid != "" {
-		resourceIdentifier = uid
+	if uid != "" {
+		resourceIdentifier = uid
+	} else if name == "kube:admin" {
+		resourceIdentifier = "kubeadmin"

Add API to create user settings #7095

Add API to create user settings #7095

Uh oh!

Conversation

christoph-jerolimov commented Nov 4, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christoph-jerolimov commented Nov 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christoph-jerolimov commented Nov 25, 2020

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov Nov 25, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov commented Nov 25, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jhadvig left a comment

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov commented Nov 30, 2020

Uh oh!

spadgett commented Nov 30, 2020

Uh oh!

openshift-ci-robot commented Nov 30, 2020

Uh oh!

openshift-merge-robot commented Dec 1, 2020

Uh oh!

christoph-jerolimov commented Nov 4, 2020 •

edited

Loading

christoph-jerolimov commented Nov 13, 2020 •

edited

Loading

christoph-jerolimov Nov 25, 2020 •

edited

Loading