K
Q

How to create Flask Rest API server to limit Kubernetes REST API access?

7/27/2018

I'm using Flask and Gunicorn for writing Restful API to minimize the access to Kubernetes REST. For example, Kubernet REST gives the list of available URLs:

{
    "paths": [
    ..
    ..
    ..
        "/apis/xxxx.io",
        "/apis/xxxx.io/v1alpha1",
    ..
.   ..
        "/metrics",
        "/swagger-2.0.0.json",
        "/swagger-2.0.0.pb-v1",
        "/swagger-2.0.0.pb-v1.gz",
        "/swagger-ui/",
        "/swagger.json",
        "/swaggerapi",
        "/ui",
        "/ui/",
        "/version"
    ]
}

I would like to limit only access to:

        "/apis/xxxx.io",
        "/apis/xxxx.io/v1alpha1",

and whatever GET provide under(sub-URLs) these two URLs as in the return after the access.

Problem: I would like to allow to access. I have found http://flask.pocoo.org/snippets/57/, it doesn't seem to work with below code:

import json
import logging


from flask import Flask, jsonify
from flask_cors import CORS
from kubernetes import client, config

app = Flask(__name__)
CORS(app)

config.load_incluster_config()
api_instance = client.CoreV1Api()

def read_file(filename):
    with open(filename, 'r') as content_file:
        content = content_file.read()
    return content

def set_configuration():
    configuration = client.Configuration()
    configuration.verify_ssl = False
    configuration.debug = True

    return configuration

@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def catch_all(path):
    logger.info("Request Path: " + path)
    bearer_header = {"Authorization": "Bearer %s" % read_file('/etc/token')}

    client.Configuration.set_default(set_configuration())

    v1 = client.CoreV1Api()
    ret = v1.api_client.rest_client.GET('https://kubernetes/', bearer_header)

    return jsonify(requests.get(url).json())

if __name__ == "__main__":
    logging.basicConfig(level=10)
    logger = logging.getLogger(__name__)
    app.run(host="0.0.0.0", port="5000")

As a beginner of Flask/Restful in Python, Would you give your insights or clues?

Regards,

-- spark
flask
flask-restful
gunicorn
kubernetes
python

Similar Questions

Running geth on kubernetes
Can't get HTTP basic auth with Google Kubernetes Engien Nginx ingress controller
True LoadBalancing in Kubernetes?
Docker image custom nginx.conf

1 Answer

7/27/2018

Looks like I got figured out how to bypass, but still need to figure out how to limit the access. I think Kubernetes service account or rule might have the answers:

@app.route('/', defaults={'path': ''}) @app.route('/') def fms_rest(path): bearer_header = {"Authorization": "Bearer %s" % read_file('/etc/token')}

client.Configuration.set_default(set_configuration())

v1 = client.CoreV1Api()
ret = v1.api_client.rest_client.GET('https://kubernetes/', bearer_header)

data = json.loads(ret.data)
if '/' + path in data["paths"]:
    return jsonify(json.loads(v1.api_client.rest_client.GET('https://kubernetes/' + path, bearer_header).data))
data["url"] = path

return jsonify(data)
-- spark
Source: StackOverflow