check folder privileges

Author: rvanderp3

README.md

@@ -38,7 +38,15 @@ vSphere object: vSphere vCenter Datacenter
 Resource.AssignVMToPool, VApp.Import, VirtualMachine.Config.AddExistingDisk, VirtualMachine.Config.AddNewDisk, VirtualMachine.Config.AddRemoveDevice, VirtualMachine.Config.AdvancedConfig, VirtualMachine.Config.Annotation, VirtualMachine.Config.CPUCount, VirtualMachine.Config.DiskExtend, VirtualMachine.Config.DiskLease, VirtualMachine.Config.EditDevice, VirtualMachine.Config.Memory, VirtualMachine.Config.RemoveDisk, VirtualMachine.Config.Rename, VirtualMachine.Config.ResetGuestInfo, VirtualMachine.Config.Resource, VirtualMachine.Config.Settings, VirtualMachine.Config.UpgradeVirtualHardware, VirtualMachine.Interact.GuestControl, VirtualMachine.Interact.PowerOff, VirtualMachine.Interact.PowerOn, VirtualMachine.Interact.Reset, VirtualMachine.Inventory.Create, VirtualMachine.Inventory.CreateFromExisting, VirtualMachine.Inventory.Delete, VirtualMachine.Provisioning.Clone, Folder.Create, Folder.Delete
 ~~~
 
-## Missing Checks
+### Checking Folder Permissions
+
+Checking user privileges on a folder can be a bit tough as privileges can't be validated until the folder is created.  Additionally, privileges to create a folder are provided by the [vSphere vCenter Datacenter](https://docs.openshift.com/container-platform/latest/installing/installing_vsphere/installing-vsphere-installer-provisioned.html#installation-vsphere-installer-infra-requirements-account_installing-vsphere-installer-provisioned).
 
+If a preexisting folder is being checked(i.e. installing in to an existing folder, creating a UPI machineset which creates machines in a specific folder), the folder can be checked by running:
+
+~~~
+./bin/vsphere-priv-check --check-folder=vcentertest-24lrs
+~~~
+
+## Missing Checks
 - Privilege Propagation
-- Virtual Machine Folder

cmd/vsphere-priv-check/vsphere-priv-check.go

@@ -3,12 +3,33 @@ package main
 import (
 	"context"
 	"fmt"
-	util "github.com/rvanderp/vsphere-perm-check/pkg/util"
+	"github.com/rvanderp/vsphere-perm-check/pkg/util"
+	"github.com/spf13/cobra"
 	"log"
+	"os"
+	"path/filepath"
 )
 
-func main() {
-	fmt.Printf("OpenShift vSphere Pre-Flight Permissions Validator\n\n")
+var (
+	rootOpts struct {
+		checkFolder string
+	}
+)
+
+func newRootCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:           filepath.Base(os.Args[0]),
+		Short:         "Verifies vCenter user account privileges",
+		Long:          "",
+		Run:           runRootCmd,
+		SilenceErrors: true,
+		SilenceUsage:  true,
+	}
+	cmd.Flags().StringVar(&rootOpts.checkFolder, "check-folder", "", "verify privileges for folder")
+	return cmd
+}
+
+func runRootCmd(cmd *cobra.Command, args []string) {
 	installConfig, err := util.LoadConfig()
 	if err != nil {
 		log.Fatal(err)
@@ -20,13 +41,19 @@ func main() {
 		log.Fatal(err)
 		return
 	}
-
+	log.Printf("folder: %s", rootOpts.checkFolder)
 	log.Printf("checking permissions for user %s\n\n", installConfig.Username)
-	err = util.ValidatePrivileges(ssn, installConfig)
+	err = util.ValidatePrivileges(ssn, installConfig, rootOpts.checkFolder)
 
 	if err != nil {
 		log.Printf("error while validating required privileges:\n\n%s", err.Error())
 	} else {
 		log.Printf("no missing privileges found for user")
 	}
 }
+
+func main() {
+	fmt.Printf("OpenShift vSphere Pre-Flight Permissions Validator\n\n")
+	rootCmd := newRootCmd()
+	rootCmd.Execute()
+}

go.mod

@@ -5,6 +5,7 @@ go 1.15
 require (
 	github.com/davecgh/go-spew v1.1.1
 	github.com/mitchellh/mapstructure v1.4.1
+	github.com/spf13/cobra v1.2.1
 	github.com/vmware/govmomi v0.26.0
 	k8s.io/apimachinery v0.22.0 // indirect
 	sigs.k8s.io/yaml v1.2.0

pkg/util/privileges.go

@@ -35,8 +35,9 @@ func ComparePrivileges(derived []types.UserPrivilegeResult, required []string) e
 	return nil
 }
 
-func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
+func ValidatePrivileges(ssn *Session, p *pctypes.Platform, folder string) error {
 	ctx := context.TODO()
+	var missingPrivileges = ""
 	authManager := object.NewAuthorizationManager(ssn.Vim25Client)
 
 	finder := find.NewFinder(ssn.Vim25Client)
@@ -52,8 +53,7 @@ func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
 		}
 		err = ComparePrivileges(res, val.Privileges)
 		if err != nil {
-			out := fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n", val.Name, err.Error())
-			return errors.New(out)
+			missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
 		}
 	}
 
@@ -75,8 +75,7 @@ func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
 		}
 		err = ComparePrivileges(res, val.Privileges)
 		if err != nil {
-			out := fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n", val.Name, err.Error())
-			return errors.New(out)
+			missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
 		}
 	}
 
@@ -91,8 +90,7 @@ func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
 		}
 		err = ComparePrivileges(res, val.Privileges)
 		if err != nil {
-			out := fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n", val.Name, err.Error())
-			return errors.New(out)
+			missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
 		}
 	}
 
@@ -107,8 +105,7 @@ func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
 		}
 		err = ComparePrivileges(res, val.Privileges)
 		if err != nil {
-			out := fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n", val.Name, err.Error())
-			return errors.New(out)
+			missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
 		}
 	}
 	if val, ok := permissions.RequiredPermissions["vCenter"]; ok {
@@ -119,9 +116,27 @@ func ValidatePrivileges(ssn *Session, p *pctypes.Platform) error {
 		}
 		err = ComparePrivileges(res, val.Privileges)
 		if err != nil {
-			out := fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n", val.Name, err.Error())
-			return errors.New(out)
+			missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
+		}
+	}
+	if folder != "" {
+		if val, ok := permissions.RequiredPermissions["Folder"]; ok {
+			folderObj, err := finder.Folder(ctx, folder)
+			if err != nil {
+				return err
+			}
+			res, err := authManager.FetchUserPrivilegeOnEntities(ctx, []types.ManagedObjectReference{folderObj.Reference()}, p.Username)
+			if err != nil {
+				return err
+			}
+			err = ComparePrivileges(res, val.Privileges)
+			if err != nil {
+				missingPrivileges = missingPrivileges + fmt.Sprintf("*** Missing Privileges ***\nvSphere object: %s\n%s\n\n", val.Name, err.Error())
+			}
 		}
 	}
+	if missingPrivileges != "" {
+		return errors.New(missingPrivileges)
+	}
 	return nil
 }