github/steve
1
0
Fork 0
mirror of https://github.com/niusmallnan/steve.git synced 2025-06-30 08:21:55 +00:00
Code Issues Projects Releases Wiki Activity

Fix impersonating serviceaccounts for podimpersonation

Browse Source
This commit is contained in:
Darren Shepherd 2020-10-21 22:39:34 -07:00
parent e0e2eddcb1
commit c84c1b52af
1 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/podimpersonation/podimpersonation.go
View File

@ -3,6 +3,7 @@ package podimpersonation
import (
"context"
"fmt"
"strings"
"sync"
"time"
@ -186,6 +187,21 @@ func (s *PodImpersonation) createRole(ctx context.Context, user user.Info, names
return nil, err
}
rule := rbacv1.PolicyRule{
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"users"},
ResourceNames: []string{user.GetName()},
}
if strings.HasPrefix(user.GetName(), "system:serviceaccount:") {
rule = rbacv1.PolicyRule{
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"serviceaccounts"},
}
}
return client.RbacV1().ClusterRoles().Create(ctx, &rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
GenerateName: "pod-impersonation-" + s.key + "-",
@ -194,12 +210,7 @@ func (s *PodImpersonation) createRole(ctx context.Context, user user.Info, names
},
},
Rules: []rbacv1.PolicyRule{
{
Verbs: []string{"impersonate"},
APIGroups: []string{""},
Resources: []string{"users"},
ResourceNames: []string{user.GetName()},
},
rule,
{
Verbs: []string{"impersonate"},
APIGroups: []string{""},