github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-09 20:17:41 +00:00
Code Issues Projects Releases Wiki Activity

don't ignore UID impersonation in webhook clients

Browse Source
This commit is contained in:
Stanislav Laznicka 2023-03-16 11:14:29 +01:00
parent 742316ee21
commit 8d3a498c87
No known key found for this signature in database
GPG Key ID: C98C414936B1A7F3
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go
View File

@ -243,6 +243,7 @@ func restConfigFromKubeconfig(configAuthInfo *clientcmdapi.AuthInfo) (*rest.Conf
if len(configAuthInfo.Impersonate) > 0 { if len(configAuthInfo.Impersonate) > 0 {
config.Impersonate = rest.ImpersonationConfig{ config.Impersonate = rest.ImpersonationConfig{
UserName: configAuthInfo.Impersonate, UserName: configAuthInfo.Impersonate,
UID: configAuthInfo.ImpersonateUID,
Groups: configAuthInfo.ImpersonateGroups, Groups: configAuthInfo.ImpersonateGroups,
Extra: configAuthInfo.ImpersonateUserExtra, Extra: configAuthInfo.ImpersonateUserExtra,
} }

24
staging/src/k8s.io/apiserver/pkg/util/webhook/authentication_test.go
View File

@ -64,6 +64,30 @@ func TestAuthenticationDetection(t *testing.T) {
}, },
expected: rest.Config{BearerToken: "foo"}, expected: rest.Config{BearerToken: "foo"},
}, },
{
name: "match with impersonation",
serverName: "foo.com",
kubeconfig: clientcmdapi.Config{
AuthInfos: map[string]*clientcmdapi.AuthInfo{
"foo.com": {
Token: "foo",
Impersonate: "user-a",
ImpersonateUID: "user-a-uid-1111",
ImpersonateGroups: []string{"user-a-group1", "user-a-group2"},
ImpersonateUserExtra: map[string][]string{"foo": {"bar", "baz", "etc"}},
},
},
},
expected: rest.Config{
BearerToken: "foo",
Impersonate: rest.ImpersonationConfig{
UserName: "user-a",
UID: "user-a-uid-1111",
Groups: []string{"user-a-group1", "user-a-group2"},
Extra: map[string][]string{"foo": {"bar", "baz", "etc"}},
},
},
},
{ {
name: "partial star match", name: "partial star match",
serverName: "foo.com", serverName: "foo.com",