From fd78427347821072bd7156db2204a14c7adb3fa8 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Wed, 10 Jul 2019 21:29:25 -0400 Subject: [PATCH] Populate API version in synthetic authorization requests Kubernetes-commit: 2899abb65cf459d6ab1d61f24fe82555f87a306f --- pkg/endpoints/filters/impersonation.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/endpoints/filters/impersonation.go b/pkg/endpoints/filters/impersonation.go index d017f2bf6..e71533cd2 100644 --- a/pkg/endpoints/filters/impersonation.go +++ b/pkg/endpoints/filters/impersonation.go @@ -68,16 +68,18 @@ func WithImpersonation(handler http.Handler, a authorizer.Authorizer, s runtime. groups := []string{} userExtra := map[string][]string{} for _, impersonationRequest := range impersonationRequests { + gvk := impersonationRequest.GetObjectKind().GroupVersionKind() actingAsAttributes := &authorizer.AttributesRecord{ User: requestor, Verb: "impersonate", - APIGroup: impersonationRequest.GetObjectKind().GroupVersionKind().Group, + APIGroup: gvk.Group, + APIVersion: gvk.Version, Namespace: impersonationRequest.Namespace, Name: impersonationRequest.Name, ResourceRequest: true, } - switch impersonationRequest.GetObjectKind().GroupVersionKind().GroupKind() { + switch gvk.GroupKind() { case v1.SchemeGroupVersion.WithKind("ServiceAccount").GroupKind(): actingAsAttributes.Resource = "serviceaccounts" username = serviceaccount.MakeUsername(impersonationRequest.Namespace, impersonationRequest.Name)