From 90d2fa4ea9e6d80285aad94be591a2dd00965135 Mon Sep 17 00:00:00 2001 From: zheng1771 <353263628+zheng1771@users.noreply.github.com> Date: Sat, 7 Nov 2026 15:11:32 +0000 Subject: [PATCH] Check access to Kubernetes CNI user data --- .../cluster/KubernetesClusterManagerImpl.java | 12 ++++ .../cluster/CreateKubernetesClusterCmd.java | 1 + .../KubernetesClusterManagerImplTest.java | 63 +++++++++++++++++++ 3 files changed, 76 insertions(+) diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java index 035554e38237..b99007292c50 100644 --- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java +++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java @@ -1019,7 +1019,19 @@ public boolean isCommandSupported(KubernetesCluster cluster, String cmdName) { } } + protected void validateCniConfiguration(Long cniConfigId) { + if (cniConfigId == null) { + return; + } + UserDataVO userData = userDataDao.findById(cniConfigId); + if (userData == null) { + throw new InvalidParameterValueException("Unable to find user data with the specified ID."); + } + accountManager.checkAccess(CallContext.current().getCallingAccount(), null, false, userData); + } + private void validateManagedKubernetesClusterCreateParameters(final CreateKubernetesClusterCmd cmd) throws CloudRuntimeException { + validateCniConfiguration(cmd.getCniConfigId()); ApiServiceConfiguration.validateEndpointUrl(); final String name = cmd.getName(); final Long zoneId = cmd.getZoneId(); diff --git a/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java b/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java index 9ce6dc3ea788..769953152ae9 100644 --- a/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java +++ b/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java @@ -197,6 +197,7 @@ public class CreateKubernetesClusterCmd extends BaseAsyncCreateCmd { @Parameter(name = ApiConstants.HYPERVISOR, type = CommandType.STRING, description = "the hypervisor on which the CKS cluster is to be deployed. This is required if the zone in which the CKS cluster is being deployed has clusters with different hypervisor types.", since = "4.21.0") private String hypervisor; + @ACL @Parameter(name = ApiConstants.CNI_CONFIG_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.21.0") private Long cniConfigId; diff --git a/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java b/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java index 2a381f282de2..64495217ffb5 100644 --- a/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java +++ b/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java @@ -42,12 +42,15 @@ import com.cloud.user.Account; import com.cloud.user.AccountManager; import com.cloud.user.User; +import com.cloud.user.UserDataVO; +import com.cloud.user.dao.UserDataDao; import com.cloud.utils.Pair; import com.cloud.utils.net.NetUtils; import com.cloud.vm.VMInstanceVO; import com.cloud.vm.dao.VMInstanceDao; import org.apache.cloudstack.api.BaseCmd; import org.apache.cloudstack.api.command.user.kubernetes.cluster.AddVirtualMachinesToKubernetesClusterCmd; +import org.apache.cloudstack.api.command.user.kubernetes.cluster.CreateKubernetesClusterCmd; import org.apache.cloudstack.api.command.user.kubernetes.cluster.RemoveVirtualMachinesFromKubernetesClusterCmd; import org.apache.cloudstack.context.CallContext; import org.apache.cloudstack.framework.config.ConfigKey; @@ -103,10 +106,70 @@ public class KubernetesClusterManagerImplTest { @Mock private ServiceOfferingDao serviceOfferingDao; + @Mock + private UserDataDao userDataDao; + @Spy @InjectMocks KubernetesClusterManagerImpl kubernetesClusterManager; + @Test + public void testValidateCniConfigurationNotSpecified() { + kubernetesClusterManager.validateCniConfiguration(null); + + Mockito.verifyNoInteractions(userDataDao); + } + + @Test + public void testValidateCniConfigurationAccessible() { + UserDataVO userData = new UserDataVO(); + userData.setAccountId(CallContext.current().getCallingAccount().getId()); + Mockito.when(userDataDao.findById(1L)).thenReturn(userData); + + kubernetesClusterManager.validateCniConfiguration(1L); + + Mockito.verify(accountManager).checkAccess(CallContext.current().getCallingAccount(), null, false, userData); + } + + @Test + public void testCreateManagedClusterRejectsInaccessibleCniConfiguration() { + CreateKubernetesClusterCmd cmd = Mockito.mock(CreateKubernetesClusterCmd.class); + Mockito.when(cmd.getCniConfigId()).thenReturn(1L); + UserDataVO userData = new UserDataVO(); + userData.setAccountId(CallContext.current().getCallingAccount().getId() + 1); + Mockito.when(userDataDao.findById(1L)).thenReturn(userData); + PermissionDeniedException denied = new PermissionDeniedException("UserData access denied"); + Mockito.doThrow(denied).when(accountManager).checkAccess( + CallContext.current().getCallingAccount(), null, false, userData); + + try { + kubernetesClusterManager.createManagedKubernetesCluster(cmd); + Assert.fail("Expected UserData access denial"); + } catch (PermissionDeniedException expected) { + Assert.assertSame(denied, expected); + } + + Mockito.verifyNoInteractions(kubernetesClusterDao); + Mockito.verify(cmd, Mockito.never()).getZoneId(); + Mockito.verify(cmd, Mockito.never()).getCniConfigDetails(); + } + + @Test + public void testCreateManagedClusterRejectsMissingCniConfiguration() { + CreateKubernetesClusterCmd cmd = Mockito.mock(CreateKubernetesClusterCmd.class); + Mockito.when(cmd.getCniConfigId()).thenReturn(1L); + + try { + kubernetesClusterManager.createManagedKubernetesCluster(cmd); + Assert.fail("Expected missing UserData rejection"); + } catch (InvalidParameterValueException expected) { + Assert.assertEquals("Unable to find user data with the specified ID.", expected.getMessage()); + } + + Mockito.verifyNoInteractions(kubernetesClusterDao); + Mockito.verify(cmd, Mockito.never()).getZoneId(); + } + @Test public void testValidateVpcTierAllocated() { Network network = Mockito.mock(Network.class);