github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-25 20:53:33 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #67617 from liggitt/authz-details

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 67493, 67617, 67582, 67337). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

limit forbidden error to details of what was forbidden

cleans up output from https://github.com/kubernetes/kubernetes/pull/65906#discussion_r210048853

/assign @smarterclayton

```release-note
NONE
```
This commit is contained in:
Kubernetes Submit Queue 2018-08-20 20:39:10 -07:00 committed by GitHub
commit b8c1e34df1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
staging/src/k8s.io/apiserver/pkg/endpoints/filters/authorization.go
View File

@ -73,7 +73,7 @@ func WithAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.
glog.V(4).Infof("Forbidden: %#v, Reason: %q", req.RequestURI, reason) glog.V(4).Infof("Forbidden: %#v, Reason: %q", req.RequestURI, reason)
audit.LogAnnotation(ae, decisionAnnotationKey, decisionForbid) audit.LogAnnotation(ae, decisionAnnotationKey, decisionForbid)
audit.LogAnnotation(ae, reasonAnnotationKey, reason) audit.LogAnnotation(ae, reasonAnnotationKey, reason)
responsewriters.Forbidden(ctx, attributes, w, req, reason, s) responsewriters.Forbidden(ctx, attributes, w, req, "", s)
}) })
} }

2
staging/src/k8s.io/apiserver/pkg/endpoints/filters/impersonation.go
View File

@ -110,7 +110,7 @@ func WithImpersonation(handler http.Handler, a authorizer.Authorizer, s runtime.
decision, reason, err := a.Authorize(actingAsAttributes) decision, reason, err := a.Authorize(actingAsAttributes)
if err != nil || decision != authorizer.DecisionAllow { if err != nil || decision != authorizer.DecisionAllow {
glog.V(4).Infof("Forbidden: %#v, Reason: %s, Error: %v", req.RequestURI, reason, err) glog.V(4).Infof("Forbidden: %#v, Reason: %s, Error: %v", req.RequestURI, reason, err)
responsewriters.Forbidden(ctx, actingAsAttributes, w, req, reason, s) responsewriters.Forbidden(ctx, actingAsAttributes, w, req, "", s)
return return
} }
} }

2
test/integration/master/synthetic_master_test.go
View File

@ -175,7 +175,7 @@ func TestStatus(t *testing.T) {
statusCode: http.StatusForbidden, statusCode: http.StatusForbidden,
reqPath: "/apis", reqPath: "/apis",
reason: "Forbidden", reason: "Forbidden",
message: `forbidden: User "" cannot get path "/apis": Everything is forbidden.`, message: `forbidden: User "" cannot get path "/apis"`,
}, },
{ {
name: "401", name: "401",