github/steve
1
0
Fork 0
mirror of https://github.com/niusmallnan/steve.git synced 2025-06-25 06:01:35 +00:00
Code Issues Projects Releases Wiki Activity

Deal with namespace bindings to cluster scoped resources

Browse Source
This commit is contained in:
Darren Shepherd 2020-02-10 20:53:45 -07:00
parent d1ce16f351
commit 433a39dcab
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/schema/factory.go
View File

@ -66,6 +66,16 @@ func (c *Collection) schemasForSubject(access *accesscontrol.AccessSet) (*types.
for _, verb := range verbs { for _, verb := range verbs {
a := access.AccessListFor(verb, gr) a := access.AccessListFor(verb, gr)
if !attributes.Namespaced(s) {
// trim out bad data where we are granted namespaced access to cluster scoped object
result := accesscontrol.AccessList{}
for _, access := range a {
if access.Namespace == accesscontrol.All {
result = append(result, access)
}
}
a = result
}
if len(a) > 0 { if len(a) > 0 {
verbAccess[verb] = a verbAccess[verb] = a
} }