kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #80007 from liggitt/populate-version-authorization-check 

Populate API version in synthetic authorization requests

Kubernetes-commit: ab960c612c4ca804fac2548a0f72bfd00761860c
This commit is contained in:
Kubernetes Publisher 2019-07-10 22:59:07 -07:00
parent 8a2b35483e fd78427347
commit 62fd9cb1d6
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/endpoints/filters/impersonation.go
View File

@ -68,16 +68,18 @@ func WithImpersonation(handler http.Handler, a authorizer.Authorizer, s runtime.
groups := []string{} groups := []string{}
userExtra := map[string][]string{} userExtra := map[string][]string{}
for _, impersonationRequest := range impersonationRequests { for _, impersonationRequest := range impersonationRequests {
gvk := impersonationRequest.GetObjectKind().GroupVersionKind()
actingAsAttributes := &authorizer.AttributesRecord{ actingAsAttributes := &authorizer.AttributesRecord{
User: requestor, User: requestor,
Verb: "impersonate", Verb: "impersonate",
APIGroup: impersonationRequest.GetObjectKind().GroupVersionKind().Group, APIGroup: gvk.Group,
APIVersion: gvk.Version,
Namespace: impersonationRequest.Namespace, Namespace: impersonationRequest.Namespace,
Name: impersonationRequest.Name, Name: impersonationRequest.Name,
ResourceRequest: true, ResourceRequest: true,
} }
switch impersonationRequest.GetObjectKind().GroupVersionKind().GroupKind() { switch gvk.GroupKind() {
case v1.SchemeGroupVersion.WithKind("ServiceAccount").GroupKind(): case v1.SchemeGroupVersion.WithKind("ServiceAccount").GroupKind():
actingAsAttributes.Resource = "serviceaccounts" actingAsAttributes.Resource = "serviceaccounts"
username = serviceaccount.MakeUsername(impersonationRequest.Namespace, impersonationRequest.Name) username = serviceaccount.MakeUsername(impersonationRequest.Namespace, impersonationRequest.Name)