github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-05 15:37:24 +00:00
Code Issues Projects Releases Wiki Activity

allow */subresource in rbac policy rules

Browse Source
This commit is contained in:
David Eads
2017-10-11 10:06:37 -04:00
parent 5a709021ab
commit e8a703b651
26 changed files with 205 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/apis/rbac/helpers.go
View File

@@ -55,14 +55,29 @@ func APIGroupMatches(rule *PolicyRule, requestedGroup string) bool {
return false
}
func ResourceMatches(rule *PolicyRule, requestedResource string) bool {
func ResourceMatches(rule *PolicyRule, combinedRequestedResource, requestedSubresource string) bool {
for _, ruleResource := range rule.Resources {
// if everything is allowed, we match
if ruleResource == ResourceAll {
return true
}
if ruleResource == requestedResource {
// if we have an exact match, we match
if ruleResource == combinedRequestedResource {
return true
}
// We can also match a */subresource.
// if there isn't a subresource, then continue
if len(requestedSubresource) == 0 {
continue
}
// if the rule isn't in the format */subresource, then we don't match, continue
if len(ruleResource) == len(requestedSubresource)+2 &&
strings.HasPrefix(ruleResource, "*/") &&
strings.HasSuffix(ruleResource, requestedSubresource) {
return true
}
}
return false