mirror of https://github.com/linkerd/linkerd2.git
024a77ec16
The `linkerd check` command was using TitleCase resource names (e.g.
"ConfigMaps") for SelfSubjectAccessReview requests. These were not
valid, they were only passing because SSARs requests return `allowed`
for unknown resource types unless explicitly restricted.
Modify the `linkerd check` authorization requests to use the correct
resource names.
Steps to reproduce:
- default AKS cluster
- running inside a pod
```bash
$ kubectl proxy
```
Fails:
```bash
$ curl -k -v -XPOST -d'{"kind":"SelfSubjectAccessReview","apiVersion":"authorization.k8s.io/v1","spec":{"resourceAttributes":{"namespace":"default","verb":"create","version":"v1","resource":
"Namespace"}}}' -H "Accept: application/json, */*" -H "Content-Type: application/json" http://127.0.0.1:8001/apis/authorization.k8s.io/v1/selfsubjectaccessreviews
...
{
"kind": "SelfSubjectAccessReview",
"apiVersion": "authorization.k8s.io/v1",
"metadata": {
"creationTimestamp": null
},
"spec": {
"resourceAttributes": {
"namespace": "default",
"verb": "create",
"version": "v1",
"resource": "Namespace"
}
},
"status": {
"allowed": false
}
}
```
Works:
```bash
curl -k -v -XPOST -d'{"kind":"SelfSubjectAccessReview","apiVersion":"authorization.k8s.io/v1","spec":{"resourceAttributes":{"namespace":"default","verb":"create","version":"v1","resource":
"namespaces"}}}' -H "Accept: application/json, */*" -H "Content-Type: application/json" http://127.0.0.1:8001/apis/authorization.k8s.io/v1/selfsubjectaccessreviews
...
{
"kind": "SelfSubjectAccessReview",
"apiVersion": "authorization.k8s.io/v1",
"metadata": {
"creationTimestamp": null
},
"spec": {
"resourceAttributes": {
"namespace": "default",
"verb": "create",
"version": "v1",
"resource": "namespaces"
}
},
"status": {
"allowed": true,
"reason": "RBAC: allowed by ClusterRoleBinding \"docker-build\" of ClusterRole \"docker-build\" to ServiceAccount \"docker-build/docker-build\""
}
}
```
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
|
||
|---|---|---|
| .. | ||
| addr | ||
| admin | ||
| config | ||
| filesonly | ||
| flags | ||
| healthcheck | ||
| inject | ||
| k8s | ||
| profiles | ||
| prometheus | ||
| tls | ||
| util | ||
| version | ||