Ahmet Alp Balkan 20217f1945 Allow non-mutating POST endpoints and dry-run through readonly proxy ...

The readonly proxy now permits:
- K8s "review" POST endpoints (SubjectAccessReview, TokenReview, etc.)
  that query auth state without persisting resources
- Requests with ?dryRun=All for server-side validation

Review endpoints are matched with anchored regexps pinned to
authorization.k8s.io and authentication.k8s.io API groups, preventing
spoofing via custom resources with the same name.

Refactors the handler into small, independently tested filter functions
(isUpgrade, isReadOnly, isNonMutatingPost, isDryRun) composed by a
checkRequest commander.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-25 22:05:32 -04:00

10 KiB

Raw Permalink Blame History

View Raw