github/steve
1
0
Fork 0
mirror of https://github.com/niusmallnan/steve.git synced 2025-06-30 16:31:54 +00:00
Code Issues Projects Releases Wiki Activity

Fix impersonating serviceaccounts for podimpersonation

Browse Source
This commit is contained in:
Darren Shepherd 2020-10-21 22:39:34 -07:00
parent e0e2eddcb1
commit c84c1b52af
1 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/podimpersonation/podimpersonation.go
View File

@ -3,6 +3,7 @@ package podimpersonation
import ( import (
"context" "context"
"fmt" "fmt"
"strings"
"sync" "sync"
"time" "time"
@ -186,6 +187,21 @@ func (s *PodImpersonation) createRole(ctx context.Context, user user.Info, names
return nil, err return nil, err
} }
rule := rbacv1.PolicyRule{
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"users"},
ResourceNames: []string{user.GetName()},
}
if strings.HasPrefix(user.GetName(), "system:serviceaccount:") {
rule = rbacv1.PolicyRule{
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"serviceaccounts"},
}
}
return client.RbacV1().ClusterRoles().Create(ctx, &rbacv1.ClusterRole{ return client.RbacV1().ClusterRoles().Create(ctx, &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
GenerateName: "pod-impersonation-" + s.key + "-", GenerateName: "pod-impersonation-" + s.key + "-",
@ -194,12 +210,7 @@ func (s *PodImpersonation) createRole(ctx context.Context, user user.Info, names
}, },
}, },
Rules: []rbacv1.PolicyRule{ Rules: []rbacv1.PolicyRule{
{ rule,
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"users"},
ResourceNames: []string{user.GetName()},
},
{ {
Verbs: []string{"impersonate"}, Verbs: []string{"impersonate"},
APIGroups: []string{""}, APIGroups: []string{""},