kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

server/config: assing system:apiserver user to system:authenticated group 

Kubernetes-commit: 32286d571dee764f30863e18de8f65f13dae6891
This commit is contained in:
Lukasz Szaszkiewicz 2024-10-07 17:39:10 +02:00 committed by Kubernetes Publisher
parent 62d807d9f4
commit fec9273f89
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/config.go
View File

@ -1170,7 +1170,7 @@ func AuthorizeClientBearerToken(loopback *restclient.Config, authn *Authenticati
tokens[privilegedLoopbackToken] = &user.DefaultInfo{
Name: user.APIServerUser,
UID: uid,
Groups: []string{user.SystemPrivilegedGroup},
Groups: []string{user.AllAuthenticated, user.SystemPrivilegedGroup},
}
tokenAuthenticator := authenticatorfactory.NewFromTokens(tokens, authn.APIAudiences)

29
pkg/server/config_test.go
View File

@ -38,6 +38,7 @@ import (
"k8s.io/apiserver/pkg/audit/policy"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/user"
"k8s.io/apiserver/pkg/authorization/authorizer"
"k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/apiserver/pkg/server/healthz"
utilfeature "k8s.io/apiserver/pkg/util/feature"
@ -83,6 +84,34 @@ func TestAuthorizeClientBearerTokenNoops(t *testing.T) {
}
}
func TestAuthorizeClientBearerTokenRequiredGroups(t *testing.T) {
fakeAuthenticator := authenticator.RequestFunc(func(req *http.Request) (*authenticator.Response, bool, error) {
return &authenticator.Response{User: &user.DefaultInfo{}}, false, nil
})
fakeAuthorizer := authorizer.AuthorizerFunc(func(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error) {
return authorizer.DecisionAllow, "", nil
})
target := &rest.Config{BearerToken: "secretToken"}
authN := &AuthenticationInfo{Authenticator: fakeAuthenticator}
authC := &AuthorizationInfo{Authorizer: fakeAuthorizer}
AuthorizeClientBearerToken(target, authN, authC)
fakeRequest, err := http.NewRequest("", "", nil)
if err != nil {
t.Fatal(err)
}
fakeRequest.Header.Set("Authorization", "bearer secretToken")
rsp, _, err := authN.Authenticator.AuthenticateRequest(fakeRequest)
if err != nil {
t.Fatal(err)
}
expectedGroups := []string{user.AllAuthenticated, user.SystemPrivilegedGroup}
if !reflect.DeepEqual(expectedGroups, rsp.User.GetGroups()) {
t.Fatalf("unexpected groups = %v returned, expected = %v", rsp.User.GetGroups(), expectedGroups)
}
}
func TestNewWithDelegate(t *testing.T) {
_, ctx := ktesting.NewTestContext(t)
ctx, cancel := context.WithCancelCause(ctx)