github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-07 19:23:40 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #116681 from stlaz/webhook_impersonate_uid

Browse Source 
don't ignore UID impersonation in webhook clients
This commit is contained in:
Kubernetes Prow Robot 2023-04-11 18:19:16 -07:00 committed by GitHub
commit 27f5601182
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go
View File

@ -243,6 +243,7 @@ func restConfigFromKubeconfig(configAuthInfo *clientcmdapi.AuthInfo) (*rest.Conf
if len(configAuthInfo.Impersonate) > 0 {
config.Impersonate = rest.ImpersonationConfig{
UserName: configAuthInfo.Impersonate,
UID: configAuthInfo.ImpersonateUID,
Groups: configAuthInfo.ImpersonateGroups,
Extra: configAuthInfo.ImpersonateUserExtra,
}

24
staging/src/k8s.io/apiserver/pkg/util/webhook/authentication_test.go
View File

@ -64,6 +64,30 @@ func TestAuthenticationDetection(t *testing.T) {
},
expected: rest.Config{BearerToken: "foo"},
},
{
name: "match with impersonation",
serverName: "foo.com",
kubeconfig: clientcmdapi.Config{
AuthInfos: map[string]*clientcmdapi.AuthInfo{
"foo.com": {
Token: "foo",
Impersonate: "user-a",
ImpersonateUID: "user-a-uid-1111",
ImpersonateGroups: []string{"user-a-group1", "user-a-group2"},
ImpersonateUserExtra: map[string][]string{"foo": {"bar", "baz", "etc"}},
},
},
},
expected: rest.Config{
BearerToken: "foo",
Impersonate: rest.ImpersonationConfig{
UserName: "user-a",
UID: "user-a-uid-1111",
Groups: []string{"user-a-group1", "user-a-group2"},
Extra: map[string][]string{"foo": {"bar", "baz", "etc"}},
},
},
},
{
name: "partial star match",
serverName: "foo.com",