github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-05 07:27:21 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #48051 from xilabao/add-selfsubjectrulesreview-api

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 45724, 48051, 46444, 51056, 51605)

Add selfsubjectrulesreview in authorization

**What this PR does / why we need it**:

**Which issue this PR fixes**: fixes #47834 #31292

**Special notes for your reviewer**:

**Release note**:

```release-note
Add selfsubjectrulesreview API for allowing users to query which permissions they have in a given namespace.
```
/cc @deads2k @liggitt
This commit is contained in:
Kubernetes Submit Queue
2017-09-02 12:11:04 -07:00
committed by GitHub
parent 917f9f02ef 790374da10
commit c84b3132a2
87 changed files with 6426 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
plugin/pkg/auth/authorizer/rbac/rbac.go
View File

@@ -123,6 +123,36 @@ func (r *RBACAuthorizer) Authorize(requestAttributes authorizer.Attributes) (boo
return false, reason, nil
}
func (r *RBACAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) {
var (
resourceRules []authorizer.ResourceRuleInfo
nonResourceRules []authorizer.NonResourceRuleInfo
)
policyRules, err := r.authorizationRuleResolver.RulesFor(user, namespace)
for _, policyRule := range policyRules {
if len(policyRule.Resources) > 0 {
r := authorizer.DefaultResourceRuleInfo{
Verbs: policyRule.Verbs,
APIGroups: policyRule.APIGroups,
Resources: policyRule.Resources,
ResourceNames: policyRule.ResourceNames,
}
var resourceRule authorizer.ResourceRuleInfo = &r
resourceRules = append(resourceRules, resourceRule)
}
if len(policyRule.NonResourceURLs) > 0 {
r := authorizer.DefaultNonResourceRuleInfo{
Verbs: policyRule.Verbs,
NonResourceURLs: policyRule.NonResourceURLs,
}
var nonResourceRule authorizer.NonResourceRuleInfo = &r
nonResourceRules = append(nonResourceRules, nonResourceRule)
}
}
return resourceRules, nonResourceRules, false, err
}
func New(roles rbacregistryvalidation.RoleGetter, roleBindings rbacregistryvalidation.RoleBindingLister, clusterRoles rbacregistryvalidation.ClusterRoleGetter, clusterRoleBindings rbacregistryvalidation.ClusterRoleBindingLister) *RBACAuthorizer {
authorizer := &RBACAuthorizer{
authorizationRuleResolver: rbacregistryvalidation.NewDefaultRuleResolver(