github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 21:47:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #47171 from xilabao/validate-nonResourceURL-in-create-clusterrole

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 51038, 50063, 51257, 47171, 51143)

validate nonResourceURL in create clusterrole

**Release note**:

```release-note
NONE
```
This commit is contained in:
Kubernetes Submit Queue 2017-08-25 12:31:07 -07:00 committed by GitHub
commit 08c2071bec
2 changed files with 56 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/kubectl/cmd/create_clusterrole.go
View File

@ -19,6 +19,7 @@ package cmd
import (
"fmt"
"io"
"strings"
"github.com/spf13/cobra"
@ -133,6 +134,20 @@ func (c *CreateClusterRoleOptions) Validate() error {
return fmt.Errorf("invalid verb: '%s' for nonResourceURL", v)
}
}
for _, nonResourceURL := range c.NonResourceURLs {
if nonResourceURL == "*" {
continue
}
if nonResourceURL == "" || !strings.HasPrefix(nonResourceURL, "/") {
return fmt.Errorf("nonResourceURL should start with /")
}
if strings.ContainsRune(nonResourceURL[:len(nonResourceURL)-1], '*') {
return fmt.Errorf("nonResourceURL only supports wildcard matches when '*' is at the end")
}
}
}
return nil

42
pkg/kubectl/cmd/create_clusterrole_test.go
View File

@ -375,6 +375,46 @@ func TestClusterRoleValidate(t *testing.T) {
},
expectErr: false,
},
"test-invalid-empty-non-resource-url": {
clusterRoleOptions: &CreateClusterRoleOptions{
CreateRoleOptions: &CreateRoleOptions{
Name: "my-clusterrole",
Verbs: []string{"create"},
},
NonResourceURLs: []string{""},
},
expectErr: true,
},
"test-invalid-non-resource-url": {
clusterRoleOptions: &CreateClusterRoleOptions{
CreateRoleOptions: &CreateRoleOptions{
Name: "my-clusterrole",
Verbs: []string{"create"},
},
NonResourceURLs: []string{"logs"},
},
expectErr: true,
},
"test-invalid-non-resource-url-with-*": {
clusterRoleOptions: &CreateClusterRoleOptions{
CreateRoleOptions: &CreateRoleOptions{
Name: "my-clusterrole",
Verbs: []string{"create"},
},
NonResourceURLs: []string{"/logs/*/"},
},
expectErr: true,
},
"test-invalid-non-resource-url-with-multiple-*": {
clusterRoleOptions: &CreateClusterRoleOptions{
CreateRoleOptions: &CreateRoleOptions{
Name: "my-clusterrole",
Verbs: []string{"create"},
},
NonResourceURLs: []string{"/logs*/*"},
},
expectErr: true,
},
"test-invalid-verb-for-non-resource-url": {
clusterRoleOptions: &CreateClusterRoleOptions{
CreateRoleOptions: &CreateRoleOptions{
@ -397,7 +437,7 @@ func TestClusterRoleValidate(t *testing.T) {
},
},
},
NonResourceURLs: []string{"/logs/"},
NonResourceURLs: []string{"/logs/", "/logs/*"},
},
expectErr: false,
},