fix: kube-apiserver authorizers order

Fixes handling of `kube-apiserver` authorization config authorizers. order. Fixes: #10110 Signed-off-by: Noel Georgi <[email protected]>
siderolabs · Jan 14, 2025 · 3f891f4 · 3f891f4
1 parent faa1490
commit 3f891f4
Show file tree

Hide file tree

Showing 3 changed files with 67 additions and 11 deletions.
diff --git a/hack/release.toml b/hack/release.toml
@@ -24,6 +24,7 @@ preface = """
 
 Talos is built with Go 1.23.4.
 """
+
     [notes.driver-rebind]
         title = "Driver Rebind"
         description = """\
@@ -36,6 +37,36 @@ See the [documentation](https://www.talos.dev/v1.10/reference/configuration/hard
         description = """\
 Talos Linux no longer supports `cgroupsv1` when running in non-container mode.
 The kernel argument `talos.unified_cgroup_hierarchy` is now ignored.
+"""
+
+    [notes.kube-apiserver-authorization-config]
+        title = "kube-apiserver Authorization Config"
+        description = """\
+When using `.cluster.apiServer.authorizationConfig` the user provided order for the authorizers is honoured and `Node` and `RBAC` authorizers are always added to the end if not explicitly specified.
+
+Eg: If user provides only `Webhook` authorizer, the final order will be `Webhook`, `Node`, `RBAC`.
+
+To provide a specific order for `Node` or `RBAC` explicitly, user can provide the authorizer in the order they want.
+
+Eg:
+
+```yaml
+cluster:
+  apiServer:
+    authorizationConfig:
+      - type: Node
+        name: Node
+      - type: Webhook
+        name: Webhook
+        webhook:
+          connectionInfo:
+            type: InClusterConfig
+        ...
+      - type: RBAC
+        name: rbac
+```
+
+Usage of `authorization-mode` CLI argument will not support this form of customization.
 """
 
 [make_deps]

diff --git a/internal/app/machined/pkg/controllers/k8s/control_plane.go b/internal/app/machined/pkg/controllers/k8s/control_plane.go
@@ -131,11 +131,6 @@ func NewControlPlaneAuthorizationController() *ControlPlaneAuthorizationControll
 				var authorizers []k8s.AuthorizationAuthorizersSpec
 
 				for _, authorizer := range cfgProvider.Cluster().APIServer().AuthorizationConfig() {
-					// skip Node and RBAC authorizers as we add them by default later on.
-					if authorizer.Type() == "Node" || authorizer.Type() == "RBAC" {
-						continue
-					}
-
 					authorizers = slices.Concat(authorizers, []k8s.AuthorizationAuthorizersSpec{
 						{
 							Type:    authorizer.Type(),
@@ -145,7 +140,29 @@ func NewControlPlaneAuthorizationController() *ControlPlaneAuthorizationControll
 					})
 				}
 
-				res.TypedSpec().Config = slices.Concat(v1alpha1.APIServerDefaultAuthorizationConfigAuthorizers, authorizers)
+				if !slices.ContainsFunc(authorizers, func(a k8s.AuthorizationAuthorizersSpec) bool {
+					return a.Type == "Node"
+				}) {
+					authorizers = slices.Concat(authorizers, []k8s.AuthorizationAuthorizersSpec{
+						{
+							Type: "Node",
+							Name: "node",
+						},
+					})
+				}
+
+				if !slices.ContainsFunc(authorizers, func(a k8s.AuthorizationAuthorizersSpec) bool {
+					return a.Type == "RBAC"
+				}) {
+					authorizers = slices.Concat(authorizers, []k8s.AuthorizationAuthorizersSpec{
+						{
+							Type: "RBAC",
+							Name: "rbac",
+						},
+					})
+				}
+
+				res.TypedSpec().Config = authorizers
 
 				return nil
 			},

diff --git a/internal/app/machined/pkg/controllers/k8s/control_plane_test.go b/internal/app/machined/pkg/controllers/k8s/control_plane_test.go
@@ -209,7 +209,7 @@ func (suite *K8sControlPlaneSuite) TestReconcileAdditionalAuthorizationConfigAut
 
 	suite.setupMachine(cfg)
 
-	expectedAuthorizers := slices.Concat(v1alpha1.APIServerDefaultAuthorizationConfigAuthorizers, []k8s.AuthorizationAuthorizersSpec{
+	expectedAuthorizers := slices.Concat([]k8s.AuthorizationAuthorizersSpec{
 		{
 			Type: "Webhook",
 			Name: "webhook",
@@ -223,7 +223,7 @@ func (suite *K8sControlPlaneSuite) TestReconcileAdditionalAuthorizationConfigAut
 				},
 			},
 		},
-	})
+	}, v1alpha1.APIServerDefaultAuthorizationConfigAuthorizers)
 
 	rtestutils.AssertResources(suite.Ctx(), suite.T(), suite.State(), []resource.ID{k8s.AuthorizationConfigID},
 		func(authorizationConfig *k8s.AuthorizationConfig, assert *assert.Assertions) {
@@ -272,7 +272,7 @@ func (suite *K8sControlPlaneSuite) TestReconcileAdditionalAuthorizationConfigAut
 							},
 							{
 								AuthorizerType: "Node",
-								AuthorizerName: "foo",
+								AuthorizerName: "bar",
 							},
 						},
 					},
@@ -283,7 +283,11 @@ func (suite *K8sControlPlaneSuite) TestReconcileAdditionalAuthorizationConfigAut
 
 	suite.setupMachine(cfg)
 
-	expectedAuthorizers := slices.Concat(v1alpha1.APIServerDefaultAuthorizationConfigAuthorizers, []k8s.AuthorizationAuthorizersSpec{
+	expectedAuthorizers := []k8s.AuthorizationAuthorizersSpec{
+		{
+			Type: "RBAC",
+			Name: "foo",
+		},
 		{
 			Type: "Webhook",
 			Name: "webhook",
@@ -297,7 +301,11 @@ func (suite *K8sControlPlaneSuite) TestReconcileAdditionalAuthorizationConfigAut
 				},
 			},
 		},
-	})
+		{
+			Type: "Node",
+			Name: "bar",
+		},
+	}
 
 	rtestutils.AssertResources(suite.Ctx(), suite.T(), suite.State(), []resource.ID{k8s.AuthorizationConfigID},
 		func(authorizationConfig *k8s.AuthorizationConfig, assert *assert.Assertions) {