From 983435bdcec2aa130243108820c5c928ed2f8bf3 Mon Sep 17 00:00:00 2001 From: WanLinghao Date: Wed, 31 Jan 2018 14:21:42 +0800 Subject: [PATCH] modified: staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go --- .../src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go | 1 + 1 file changed, 1 insertion(+) diff --git a/staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go b/staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go index f60756b6fd1..b4610dfcea6 100644 --- a/staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go +++ b/staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go @@ -47,6 +47,7 @@ func WithAuthorization(handler http.Handler, requestContextMapper request.Reques return } authorized, reason, err := a.Authorize(attributes) + // an authorizer like RBAC could encounter evaluation errors and still allow the request, so authorizer decision is checked before error here. if authorized == authorizer.DecisionAllow { handler.ServeHTTP(w, req) return