mirror of
https://github.com/portainer/portainer.git
synced 2025-07-25 08:19:40 +02:00
* feat(api): decorate Docker resource creation response with resource control * fix(api): fix a potential resource control conflict between stacks/volumes * feat(api): generate a default private resource control instead of admin only * fix(api): fix default RC value * fix(api): update RC authorizations check to support admin only flag * refactor(api): relocate access control related methods * fix(api): fix a potential conflict when fetching RC from database * refactor(api): refactor access control logic * refactor(api): remove the concept of DecoratedStack * feat(api): automatically remove RC when removing a Docker resource * refactor(api): update filter resource methods documentation * refactor(api): update proxy package structure * refactor(api): renamed proxy/misc package * feat(api): re-introduce ResourceControlDelete operation as admin restricted * refactor(api): relocate default endpoint authorizations * feat(api): migrate RBAC data * feat(app): ResourceControl management refactor * fix(api): fix access control issue on stack deletion and automatically delete RC * fix(api): fix stack filtering * fix(api): fix UpdateResourceControl operation checks * refactor(api): introduce a NewTransport builder method * refactor(api): inject endpoint in Docker transport * refactor(api): introduce Docker client into Docker transport * refactor(api): refactor http/proxy package * feat(api): inspect a Docker resource labels during access control validation * fix(api): only apply automatic resource control creation on success response * fix(api): fix stack access control check * fix(api): use StatusCreated instead of StatusOK for automatic resource control creation * fix(app): resource control fixes * fix(api): fix an issue preventing administrator to inspect a resource with a RC * refactor(api): remove useless error return * refactor(api): document DecorateStacks function * fix(api): fix invalid resource control type for container deletion * feat(api): support Docker system networks * feat(api): update Swagger docs * refactor(api): rename transport variable * refactor(api): rename transport variable * feat(networks): add system tag for system networks * feat(api): add support for resource control labels * feat(api): upgrade to DBVersion 22 * refactor(api): refactor access control management in Docker proxy * refactor(api): re-implement docker proxy taskListOperation * refactor(api): review parameters declaration * refactor(api): remove extra blank line * refactor(api): review method comments * fix(api): fix invalid ServerAddress property and review method visibility * feat(api): update error message * feat(api): update restrictedVolumeBrowserOperation method * refactor(api): refactor method parameters * refactor(api): minor refactor * refactor(api): change Azure transport visibility * refactor(api): update struct documentation * refactor(api): update struct documentation * feat(api): review restrictedResourceOperation method * refactor(api): remove unused authorization methods * feat(api): apply RBAC when enabled on stack operations * fix(api): fix invalid data migration procedure for DBVersion = 22 * fix(app): RC duplicate on private resource * feat(api): change Docker API version logic for libcompose/client factory * fix(api): update access denied error message to be Docker API compliant * fix(api): update volume browsing authorizations data migration * fix(api): fix an issue with access control in multi-node agent Swarm cluster
146 lines
5.3 KiB
Go
146 lines
5.3 KiB
Go
package proxy
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
|
|
"github.com/orcaman/concurrent-map"
|
|
"github.com/portainer/portainer/api"
|
|
"github.com/portainer/portainer/api/docker"
|
|
"github.com/portainer/portainer/api/http/proxy/factory"
|
|
)
|
|
|
|
// TODO: contain code related to legacy extension management
|
|
|
|
type (
|
|
// Manager represents a service used to manage proxies to endpoints and extensions.
|
|
Manager struct {
|
|
proxyFactory *factory.ProxyFactory
|
|
endpointProxies cmap.ConcurrentMap
|
|
extensionProxies cmap.ConcurrentMap
|
|
legacyExtensionProxies cmap.ConcurrentMap
|
|
}
|
|
|
|
// ManagerParams represents the required parameters to create a new Manager instance.
|
|
ManagerParams struct {
|
|
ResourceControlService portainer.ResourceControlService
|
|
UserService portainer.UserService
|
|
TeamService portainer.TeamService
|
|
TeamMembershipService portainer.TeamMembershipService
|
|
SettingsService portainer.SettingsService
|
|
RegistryService portainer.RegistryService
|
|
DockerHubService portainer.DockerHubService
|
|
SignatureService portainer.DigitalSignatureService
|
|
ReverseTunnelService portainer.ReverseTunnelService
|
|
ExtensionService portainer.ExtensionService
|
|
DockerClientFactory *docker.ClientFactory
|
|
}
|
|
)
|
|
|
|
// NewManager initializes a new proxy Service
|
|
func NewManager(parameters *ManagerParams) *Manager {
|
|
proxyFactoryParameters := &factory.ProxyFactoryParameters{
|
|
ResourceControlService: parameters.ResourceControlService,
|
|
UserService: parameters.UserService,
|
|
TeamService: parameters.TeamService,
|
|
TeamMembershipService: parameters.TeamMembershipService,
|
|
SettingsService: parameters.SettingsService,
|
|
RegistryService: parameters.RegistryService,
|
|
DockerHubService: parameters.DockerHubService,
|
|
SignatureService: parameters.SignatureService,
|
|
ReverseTunnelService: parameters.ReverseTunnelService,
|
|
ExtensionService: parameters.ExtensionService,
|
|
DockerClientFactory: parameters.DockerClientFactory,
|
|
}
|
|
|
|
return &Manager{
|
|
endpointProxies: cmap.New(),
|
|
extensionProxies: cmap.New(),
|
|
legacyExtensionProxies: cmap.New(),
|
|
proxyFactory: factory.NewProxyFactory(proxyFactoryParameters),
|
|
}
|
|
}
|
|
|
|
// CreateAndRegisterEndpointProxy creates a new HTTP reverse proxy based on endpoint properties and and adds it to the registered proxies.
|
|
// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
|
|
func (manager *Manager) CreateAndRegisterEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
|
|
proxy, err := manager.proxyFactory.NewEndpointProxy(endpoint)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
manager.endpointProxies.Set(string(endpoint.ID), proxy)
|
|
return proxy, nil
|
|
}
|
|
|
|
// GetEndpointProxy returns the proxy associated to a key
|
|
func (manager *Manager) GetEndpointProxy(endpoint *portainer.Endpoint) http.Handler {
|
|
proxy, ok := manager.endpointProxies.Get(string(endpoint.ID))
|
|
if !ok {
|
|
return nil
|
|
}
|
|
|
|
return proxy.(http.Handler)
|
|
}
|
|
|
|
// DeleteEndpointProxy deletes the proxy associated to a key
|
|
func (manager *Manager) DeleteEndpointProxy(endpoint *portainer.Endpoint) {
|
|
manager.endpointProxies.Remove(string(endpoint.ID))
|
|
}
|
|
|
|
// CreateExtensionProxy creates a new HTTP reverse proxy for an extension and
|
|
// registers it in the extension map associated to the specified extension identifier
|
|
func (manager *Manager) CreateExtensionProxy(extensionID portainer.ExtensionID) (http.Handler, error) {
|
|
proxy, err := manager.proxyFactory.NewExtensionProxy(extensionID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
manager.extensionProxies.Set(strconv.Itoa(int(extensionID)), proxy)
|
|
return proxy, nil
|
|
}
|
|
|
|
// GetExtensionProxy returns an extension proxy associated to an extension identifier
|
|
func (manager *Manager) GetExtensionProxy(extensionID portainer.ExtensionID) http.Handler {
|
|
proxy, ok := manager.extensionProxies.Get(strconv.Itoa(int(extensionID)))
|
|
if !ok {
|
|
return nil
|
|
}
|
|
|
|
return proxy.(http.Handler)
|
|
}
|
|
|
|
// GetExtensionURL retrieves the URL of an extension running locally based on the extension port table
|
|
func (manager *Manager) GetExtensionURL(extensionID portainer.ExtensionID) string {
|
|
return factory.BuildExtensionURL(extensionID)
|
|
}
|
|
|
|
// DeleteExtensionProxy deletes the extension proxy associated to an extension identifier
|
|
func (manager *Manager) DeleteExtensionProxy(extensionID portainer.ExtensionID) {
|
|
manager.extensionProxies.Remove(strconv.Itoa(int(extensionID)))
|
|
}
|
|
|
|
// CreateLegacyExtensionProxy creates a new HTTP reverse proxy for a legacy extension and adds it to the registered proxies.
|
|
func (manager *Manager) CreateLegacyExtensionProxy(key, extensionAPIURL string) (http.Handler, error) {
|
|
proxy, err := manager.proxyFactory.NewLegacyExtensionProxy(extensionAPIURL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
manager.legacyExtensionProxies.Set(key, proxy)
|
|
return proxy, nil
|
|
}
|
|
|
|
// GetLegacyExtensionProxy returns a legacy extension proxy associated to a key
|
|
func (manager *Manager) GetLegacyExtensionProxy(key string) http.Handler {
|
|
proxy, ok := manager.legacyExtensionProxies.Get(key)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
return proxy.(http.Handler)
|
|
}
|
|
|
|
// CreateGitlabProxy creates a new HTTP reverse proxy that can be used to send requests to the Gitlab API..
|
|
func (manager *Manager) CreateGitlabProxy(url string) (http.Handler, error) {
|
|
return newGitlabProxy(url)
|
|
}
|