mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-24 04:06:03 +00:00
Fix RBAC authorizer of ServiceAccount
RBAC authorizer assigns a role to a wrong service account.
This commit is contained in:
parent
86b47f26d9
commit
d1b14e2fae
@ -25,6 +25,7 @@ import (
|
||||
apierrors "k8s.io/kubernetes/pkg/api/errors"
|
||||
"k8s.io/kubernetes/pkg/apis/rbac"
|
||||
"k8s.io/kubernetes/pkg/auth/user"
|
||||
"k8s.io/kubernetes/pkg/serviceaccount"
|
||||
utilerrors "k8s.io/kubernetes/pkg/util/errors"
|
||||
)
|
||||
|
||||
@ -201,8 +202,7 @@ func appliesToUser(user user.Info, subject rbac.Subject) (bool, error) {
|
||||
if subject.Namespace == "" {
|
||||
return false, fmt.Errorf("subject of kind service account without specified namespace")
|
||||
}
|
||||
// TODO(ericchiang): Is there a better way of matching a service account name?
|
||||
return "system:serviceaccount:"+subject.Name+":"+subject.Namespace == user.GetName(), nil
|
||||
return serviceaccount.MakeUsername(subject.Namespace, subject.Name) == user.GetName(), nil
|
||||
default:
|
||||
return false, fmt.Errorf("unknown subject kind: %s", subject.Kind)
|
||||
}
|
||||
|
@ -234,7 +234,7 @@ func TestAppliesTo(t *testing.T) {
|
||||
subjects: []rbac.Subject{
|
||||
{Kind: rbac.UserKind, Name: "barfoo"},
|
||||
{Kind: rbac.GroupKind, Name: "foobar"},
|
||||
{Kind: rbac.ServiceAccountKind, Name: "kube-system", Namespace: "default"},
|
||||
{Kind: rbac.ServiceAccountKind, Namespace: "kube-system", Name: "default"},
|
||||
},
|
||||
ctx: api.WithNamespace(
|
||||
api.WithUser(api.NewContext(), &user.DefaultInfo{Name: "system:serviceaccount:kube-system:default"}),
|
||||
|
Loading…
Reference in New Issue
Block a user