github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-11 21:12:07 +00:00
Code Issues Projects Releases Wiki Activity

Add detailed RBAC deny logging

Browse Source
This commit is contained in:
Jordan Liggitt 2017-02-11 16:13:05 -05:00
parent cc11d7367a
commit 34782b203d
No known key found for this signature in database
GPG Key ID: 24E7ADF9A3B42012
1 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
plugin/pkg/auth/authorizer/rbac/rbac.go
View File

@ -22,6 +22,8 @@ import (
"github.com/golang/glog" "github.com/golang/glog"
"bytes"
"k8s.io/apiserver/pkg/authentication/user" "k8s.io/apiserver/pkg/authentication/user"
"k8s.io/apiserver/pkg/authorization/authorizer" "k8s.io/apiserver/pkg/authorization/authorizer"
"k8s.io/kubernetes/pkg/apis/rbac" "k8s.io/kubernetes/pkg/apis/rbac"
@ -51,11 +53,26 @@ func (r *RBACAuthorizer) Authorize(requestAttributes authorizer.Attributes) (boo
if glog.V(2) { if glog.V(2) {
var operation string var operation string
if requestAttributes.IsResourceRequest() { if requestAttributes.IsResourceRequest() {
operation = fmt.Sprintf( b := &bytes.Buffer{}
"%q on \"%v.%v/%v\"", b.WriteString(`"`)
requestAttributes.GetVerb(), b.WriteString(requestAttributes.GetVerb())
requestAttributes.GetResource(), requestAttributes.GetAPIGroup(), requestAttributes.GetSubresource(), b.WriteString(`" resource "`)
) b.WriteString(requestAttributes.GetResource())
if len(requestAttributes.GetAPIGroup()) > 0 {
b.WriteString(`.`)
b.WriteString(requestAttributes.GetAPIGroup())
}
if len(requestAttributes.GetSubresource()) > 0 {
b.WriteString(`/`)
b.WriteString(requestAttributes.GetSubresource())
}
b.WriteString(`"`)
if len(requestAttributes.GetName()) > 0 {
b.WriteString(` named "`)
b.WriteString(requestAttributes.GetName())
b.WriteString(`"`)
}
operation = b.String()
} else { } else {
operation = fmt.Sprintf("%q nonResourceURL %q", requestAttributes.GetVerb(), requestAttributes.GetPath()) operation = fmt.Sprintf("%q nonResourceURL %q", requestAttributes.GetVerb(), requestAttributes.GetPath())
} }