diff --git a/pkg/apis/authorization/types.go b/pkg/apis/authorization/types.go index 368f37e66fa..1480359f515 100644 --- a/pkg/apis/authorization/types.go +++ b/pkg/apis/authorization/types.go @@ -87,6 +87,72 @@ type ResourceAttributes struct { Subresource string // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all. Name string + // fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it. + // + // This field is alpha-level. To use this field, you must enable the + // `AuthorizeWithSelectors` feature gate (disabled by default). + // +optional + FieldSelector *FieldSelectorAttributes + // labelSelector describes the limitation on access based on labels. It can only limit access, not broaden it. + // + // This field is alpha-level. To use this field, you must enable the + // `AuthorizeWithSelectors` feature gate (disabled by default). + // +optional + LabelSelector *LabelSelectorAttributes +} + +// LabelSelectorAttributes indicates a label limited access. +// Webhook authors are encouraged to +// * ensure rawSelector and requirements are not both set +// * consider the requirements field if set +// * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. +// For the *SubjectAccessReview endpoints of the kube-apiserver: +// * If rawSelector is empty and requirements are empty, the request is not limited. +// * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. +// * If rawSelector is empty and requirements are present, the requirements should be honored +// * If rawSelector is present and requirements are present, the request is invalid. +type LabelSelectorAttributes struct { + // rawSelector is the serialization of a field selector that would be included in a query parameter. + // Webhook implementations are encouraged to ignore rawSelector. + // The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present. + // +optional + RawSelector string + + // requirements is the parsed interpretation of a label selector. + // All requirements must be met for a resource instance to match the selector. + // Webhook implementations should handle requirements, but how to handle them is up to the webhook. + // Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements + // are not understood. + // +optional + // +listType=atomic + Requirements []metav1.LabelSelectorRequirement +} + +// FieldSelectorAttributes indicates a field limited access. +// Webhook authors are encouraged to +// * ensure rawSelector and requirements are not both set +// * consider the requirements field if set +// * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. +// For the *SubjectAccessReview endpoints of the kube-apiserver: +// * If rawSelector is empty and requirements are empty, the request is not limited. +// * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. +// * If rawSelector is empty and requirements are present, the requirements should be honored +// * If rawSelector is present and requirements are present, the request is invalid. +type FieldSelectorAttributes struct { + // rawSelector is the serialization of a field selector that would be included in a query parameter. + // Webhook implementations are encouraged to ignore rawSelector. + // The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present. + // +optional + RawSelector string + + // requirements is the parsed interpretation of a field selector. + // All requirements must be met for a resource instance to match the selector. + // Webhook implementations should handle requirements, but how to handle them is up to the webhook. + // Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements + // are not understood. + // +optional + // +listType=atomic + Requirements []metav1.FieldSelectorRequirement } // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface diff --git a/staging/src/k8s.io/api/authorization/v1/types.go b/staging/src/k8s.io/api/authorization/v1/types.go index c25f72f9e9c..36f5fa41078 100644 --- a/staging/src/k8s.io/api/authorization/v1/types.go +++ b/staging/src/k8s.io/api/authorization/v1/types.go @@ -118,6 +118,72 @@ type ResourceAttributes struct { // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all. // +optional Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"` + // fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it. + // + // This field is alpha-level. To use this field, you must enable the + // `AuthorizeWithSelectors` feature gate (disabled by default). + // +optional + FieldSelector *FieldSelectorAttributes `json:"fieldSelector,omitempty" protobuf:"bytes,8,opt,name=fieldSelector"` + // labelSelector describes the limitation on access based on labels. It can only limit access, not broaden it. + // + // This field is alpha-level. To use this field, you must enable the + // `AuthorizeWithSelectors` feature gate (disabled by default). + // +optional + LabelSelector *LabelSelectorAttributes `json:"labelSelector,omitempty" protobuf:"bytes,9,opt,name=labelSelector"` +} + +// LabelSelectorAttributes indicates a label limited access. +// Webhook authors are encouraged to +// * ensure rawSelector and requirements are not both set +// * consider the requirements field if set +// * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. +// For the *SubjectAccessReview endpoints of the kube-apiserver: +// * If rawSelector is empty and requirements are empty, the request is not limited. +// * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. +// * If rawSelector is empty and requirements are present, the requirements should be honored +// * If rawSelector is present and requirements are present, the request is invalid. +type LabelSelectorAttributes struct { + // rawSelector is the serialization of a field selector that would be included in a query parameter. + // Webhook implementations are encouraged to ignore rawSelector. + // The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present. + // +optional + RawSelector string `json:"rawSelector,omitempty" protobuf:"bytes,1,opt,name=rawSelector"` + + // requirements is the parsed interpretation of a label selector. + // All requirements must be met for a resource instance to match the selector. + // Webhook implementations should handle requirements, but how to handle them is up to the webhook. + // Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements + // are not understood. + // +optional + // +listType=atomic + Requirements []metav1.LabelSelectorRequirement `json:"requirements,omitempty" protobuf:"bytes,2,rep,name=requirements"` +} + +// FieldSelectorAttributes indicates a field limited access. +// Webhook authors are encouraged to +// * ensure rawSelector and requirements are not both set +// * consider the requirements field if set +// * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. +// For the *SubjectAccessReview endpoints of the kube-apiserver: +// * If rawSelector is empty and requirements are empty, the request is not limited. +// * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. +// * If rawSelector is empty and requirements are present, the requirements should be honored +// * If rawSelector is present and requirements are present, the request is invalid. +type FieldSelectorAttributes struct { + // rawSelector is the serialization of a field selector that would be included in a query parameter. + // Webhook implementations are encouraged to ignore rawSelector. + // The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present. + // +optional + RawSelector string `json:"rawSelector,omitempty" protobuf:"bytes,1,opt,name=rawSelector"` + + // requirements is the parsed interpretation of a field selector. + // All requirements must be met for a resource instance to match the selector. + // Webhook implementations should handle requirements, but how to handle them is up to the webhook. + // Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements + // are not understood. + // +optional + // +listType=atomic + Requirements []metav1.FieldSelectorRequirement `json:"requirements,omitempty" protobuf:"bytes,2,rep,name=requirements"` } // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface diff --git a/staging/src/k8s.io/api/authorization/v1beta1/types.go b/staging/src/k8s.io/api/authorization/v1beta1/types.go index ef3a501b058..8b8e5a98678 100644 --- a/staging/src/k8s.io/api/authorization/v1beta1/types.go +++ b/staging/src/k8s.io/api/authorization/v1beta1/types.go @@ -19,6 +19,7 @@ package v1beta1 import ( "fmt" + authorizationv1 "k8s.io/api/authorization/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) @@ -124,6 +125,12 @@ type ResourceAttributes struct { // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all. // +optional Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"` + // fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it. + // +optional + FieldSelector *authorizationv1.FieldSelectorAttributes `json:"fieldSelector,omitempty" protobuf:"bytes,8,opt,name=fieldSelector"` + // labelSelector describes the limitation on access based on labels. It can only limit access, not broaden it. + // +optional + LabelSelector *authorizationv1.LabelSelectorAttributes `json:"labelSelector,omitempty" protobuf:"bytes,9,opt,name=labelSelector"` } // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface diff --git a/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go b/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go index 9695ba50b4d..473adb9ef53 100644 --- a/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go +++ b/staging/src/k8s.io/apimachinery/pkg/apis/meta/v1/types.go @@ -1278,6 +1278,33 @@ const ( LabelSelectorOpDoesNotExist LabelSelectorOperator = "DoesNotExist" ) +// FieldSelectorRequirement is a selector that contains values, a key, and an operator that +// relates the key and values. +type FieldSelectorRequirement struct { + // key is the field selector key that the requirement applies to. + Key string `json:"key" protobuf:"bytes,1,opt,name=key"` + // operator represents a key's relationship to a set of values. + // Valid operators are In, NotIn, Exists, DoesNotExist. + // The list of operators may grow in the future. + Operator FieldSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=FieldSelectorOperator"` + // values is an array of string values. + // If the operator is In or NotIn, the values array must be non-empty. + // If the operator is Exists or DoesNotExist, the values array must be empty. + // +optional + // +listType=atomic + Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"` +} + +// A field selector operator is the set of operators that can be used in a selector requirement. +type FieldSelectorOperator string + +const ( + FieldSelectorOpIn FieldSelectorOperator = "In" + FieldSelectorOpNotIn FieldSelectorOperator = "NotIn" + FieldSelectorOpExists FieldSelectorOperator = "Exists" + FieldSelectorOpDoesNotExist FieldSelectorOperator = "DoesNotExist" +) + // ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource // that the fieldset applies to. type ManagedFieldsEntry struct {