Add Authentication module for Kubernetes node

This authentication module connects to docker to figure out the pod
name associated to the PID requesting the service by ay of discovering
the container id via the process cgroup namespace.

The pod name as set in the metadata label named 'io.kubernetes.pod.name'
is then used as the 'remote_user' attribute on the request.

Signed-off-by: Simo Sorce <simo@redhat.com>

3 files changed, 74 insertions, 1 deletions

diff --git a/custodia/kubernetes/__init__.py b/custodia/kubernetes/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/custodia/kubernetes/__init__.py
diff --git a/custodia/kubernetes/node.py b/custodia/kubernetes/node.py
new file mode 100644
index 0000000..5d4f863
--- /dev/null
+++ b/custodia/kubernetes/node.py
@@ -0,0 +1,73 @@
+# Copyright (C) 2015  Custodia Project Contributors - see LICENSE file
+
+import re
+
+from docker import Client
+
+from custodia import log
+from custodia.httpd.authenticators import HTTPAuthenticator
+
+DEFAULT_REGEX = r'/docker-([0-9a-f]{64})\.scope'
+DEFUALT_DOCKER_URI = 'unix://var/run/docker.sock'
+
+
+class NodeAuth(HTTPAuthenticator):
+
+    def __init__(self, config=None):
+        super(NodeAuth, self).__init__(config)
+        if self.config is not None:
+            regex = self.config.get('docker_regex', DEFAULT_REGEX)
+            self.docker_uri = self.config.get('docker_uri', DEFUALT_DOCKER_URI)
+        else:
+            regex = DEFAULT_REGEX
+            self.docker_uri = DEFUALT_DOCKER_URI
+        self.id_filter = re.compile(regex)
+
+    def _pid2dockerid(self, pid):
+        with open('/proc/%i/cgroup' % pid) as f:
+            for line in f:
+                mo = self.id_filter.search(line)
+                if mo is not None:
+                    return mo.group(1)
+        return None
+
+    def handle(self, request):
+        creds = request.get('creds')
+        if creds is None:
+            self.logger.debug('Missing "creds" on request')
+            return None
+        dockerid = self._pid2dockerid(int(creds['pid']))
+        if dockerid is None:
+            self.logger.debug("Didn't find docker ID for pid %s", creds['pid'])
+            return None
+
+        try:
+            dc = Client(base_url=self.docker_uri)
+            data = dc.inspect_container(dockerid)
+            data_id = data['Id']
+            data_labels = dict(data['Config']['Labels'])
+        except Exception as err:  # pylint: disable=broad-except
+            self.logger.debug("Failed to query docker for [%s:%s]: %s",
+                              creds['pid'], dockerid, err)
+            self.audit_svc_access(log.AUDIT_SVC_AUTH_FAIL,
+                                      request['client_id'], dockerid)
+            return False
+
+        if data_id != dockerid:
+            self.logger.debug("Docker ID %s not found!", dockerid)
+            self.audit_svc_access(log.AUDIT_SVC_AUTH_FAIL,
+                                      request['client_id'], dockerid)
+            return False
+
+        podname = data_labels.get('io.kubernetes.pod.name')
+        if podname is None:
+            self.logger.debug("Pod Name not found for Docker ID %s", dockerid)
+            self.audit_svc_access(log.AUDIT_SVC_AUTH_FAIL,
+                                      request['client_id'], dockerid)
+            return False
+
+        self.audit_svc_access(log.AUDIT_SVC_AUTH_PASS,
+                                  request['client_id'], dockerid)
+        request['client_id'] = dockerid
+        request['remote_user'] = podname
+        return True
diff --git a/setup.py b/setup.py
index bda7db2..a24c8d7 100755
--- a/setup.py
+++ b/setup.py
@@ -12,7 +12,7 @@ setup(
     maintainer_email='simo@redhat.com',
     url='https://github.com/simo5/custodia',
     packages=['custodia', 'custodia.httpd', 'custodia.store',
-              'custodia.message'],
+              'custodia.message', 'custodia.kubernetes'],
     data_files=[('share/man/man7', ["man/custodia.7"]),
                 ('share/doc/custodia', ['LICENSE', 'README', 'API.md']),
                 ('share/doc/custodia/examples', ['custodia.conf']),