poc-client.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "07a60b5a-31aa-4cd7-baca-ce4fa0442314",
   "metadata": {},
   "source": [
    "## POC client notebook"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8295b60e-90d6-41c8-acdb-f9426c30516c",
   "metadata": {},
   "source": [
    "Get the current token from the Pod's filesystem"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "9abd030e-e0eb-4b5a-9c46-3224b0f0490b",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "def get_current_token():\n",
    "    try:\n",
    "        with open(\n",
    "            \"/var/run/secrets/kubernetes.io/serviceaccount/token\", \"r\"\n",
    "        ) as file:\n",
    "            token = file.read().strip()\n",
    "        return token\n",
    "    except Exception as e:\n",
    "        print(f\"Error reading token: {e}\")\n",
    "        return None\n",
    "\n",
    "\n",
    "token = get_current_token()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5fe0adbd-f7f5-4e08-b4f8-b9d9d73cc883",
   "metadata": {},
   "source": [
    "Decode the token for your investigation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "b38a3af9-f9e4-481e-8392-dbb24fe5648e",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'aud': ['https://kubernetes.default.svc'],\n",
       " 'exp': 1748439300,\n",
       " 'iat': 1716903300,\n",
       " 'iss': 'https://kubernetes.default.svc',\n",
       " 'kubernetes.io': {'namespace': 'feast',\n",
       "  'pod': {'name': 'feast-notebook-0',\n",
       "   'uid': '911eb512-ad45-4301-ab09-34659cacda6c'},\n",
       "  'serviceaccount': {'name': 'feast-notebook',\n",
       "   'uid': '190310c8-293c-4468-87c5-e6f6f0e1b303'},\n",
       "  'warnafter': 1716906907},\n",
       " 'nbf': 1716903300,\n",
       " 'sub': 'system:serviceaccount:feast:feast-notebook'}"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import jwt\n",
    "jwt.decode(token, options={\"verify_signature\": False})"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "de4824cf-c3a0-4ca5-8004-43275ebeb435",
   "metadata": {},
   "source": [
    "A `Session` implementyation to always include the authorization token in the header"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "a2a8281d-5776-4ecf-aa0c-986e548c0c28",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "import requests\n",
    "class AuthorizedSession(requests.Session):\n",
    "    def __init__(self, token=None):\n",
    "        super().__init__()\n",
    "        self.token = token\n",
    "\n",
    "    def request(self, method, url, *args, **kwargs):\n",
    "        if self.token:\n",
    "            kwargs.setdefault('headers', {})['Authorization'] = f'Bearer {self.token}'\n",
    "        return super().request(method, url, *args, **kwargs)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "424c6215-663b-4e38-9918-f71612e9467c",
   "metadata": {},
   "source": [
    "A method to run a request on the defined `url`, starting from the deployed `server_url`.\n",
    "\n",
    "Both GET and POST are attempted and results displayed."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "778c7799-5556-49c0-b24a-bb0f860356f1",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "server_url = \"http://poc-app.feast.svc.cluster.local:8000\"\n",
    "def run_request(\n",
    "                    session: AuthorizedSession,\n",
    "                    url: str = f\"{server_url}/a\",\n",
    "):\n",
    "    headers = {\n",
    "        \"Authorization\": f\"Bearer {token}\",\n",
    "        \"Content-Type\": \"application/json\"  # Adjust content type as needed\n",
    "    }\n",
    "\n",
    "    response = session.get(url, headers=headers)\n",
    "    if response.status_code == 200:\n",
    "        print(\"GET Response:\", response.json())\n",
    "    else:\n",
    "        print(\"GET Error:\", response.status_code, response.text)\n",
    "\n",
    "    response = session.post(url, headers=headers)\n",
    "    if response.status_code == 200:\n",
    "        print(\"POST Response:\", response.json())\n",
    "    else:\n",
    "        print(\"POST Error:\", response.status_code, response.text)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3c89671d-ed03-4827-a787-df5c415a6494",
   "metadata": {},
   "source": [
    "Test endpoint `/a`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "fa43318d-b35a-43d5-8a54-5335602dd1fc",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "GET Error: 403 {\"message\":\"No permissions to execute [<AuthzedAction.READ: 'read'>] on AuthzedResourceType.A:a. Requires roles ['a-reader']\"}\n",
      "POST Response: {'message': 'edit_A'}\n"
     ]
    }
   ],
   "source": [
    "session = AuthorizedSession(get_current_token())\n",
    "run_request(session, url=f\"{server_url}/a\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1fd054f3-5f5d-4d66-a47f-df6052218c2e",
   "metadata": {},
   "source": [
    "Test endpoint `/b`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "fa61d9fd-99ce-4aa5-a01f-cd1afa86ee23",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "GET Error: 403 {\"message\":\"No permissions to execute [<AuthzedAction.READ: 'read'>] on AuthzedResourceType.B:b. Requires roles ['b-reader', 'b-editor']\"}\n",
      "POST Error: 403 {\"message\":\"No permissions to execute [<AuthzedAction.EDIT: 'edit'>] on AuthzedResourceType.B:b. Requires roles ['b-reader', 'b-editor']\"}\n"
     ]
    }
   ],
   "source": [
    "run_request(session, url=f\"{server_url}/b\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0327b1d2-9d9d-4f8c-bb00-eccb53130ccf",
   "metadata": {},
   "source": [
    "Test unprotected endpoint `/`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "id": "be7153ef-1461-442d-a061-c99b14640b2f",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "GET Response: {'message': 'read_unprotected'}\n",
      "POST Response: {'message': 'post_unprotected'}\n"
     ]
    }
   ],
   "source": [
    "run_request(session, url=f\"{server_url}/\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "659f5ae9-58d9-4a2e-8353-f4314129c354",
   "metadata": {},
   "source": [
    "Repeat the above tests by creating different role bindings, using:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "00bd4a9b-1737-4b9d-837d-9871a6f8a6d1",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "rolebinding.rbac.authorization.k8s.io/poc-a-editor created\n"
     ]
    }
   ],
   "source": [
    "!oc create rolebinding poc-a-editor --role=a-editor --serviceaccount=default:feast-notebook"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "89595796-81ad-4ddc-a9f2-0540c771ce45",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.9",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.18"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}