mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 10:28:36 +00:00
Code Activity

validation added

Browse source
This commit is contained in:
evalsocket 2020-07-10 12:27:31 -07:00
parent 014db64ed2
commit 44a164b184
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
pkg/userinfo/roleRef.go
View file

@ -2,8 +2,6 @@ package userinfo
import (
"fmt"
"strings"
"github.com/nirmata/kyverno/pkg/engine"
"github.com/nirmata/kyverno/pkg/utils"
v1beta1 "k8s.io/api/admission/v1beta1"
@ -12,6 +10,7 @@ import (
labels "k8s.io/apimachinery/pkg/labels"
rbaclister "k8s.io/client-go/listers/rbac/v1"
"sigs.k8s.io/controller-runtime/pkg/log"
"strings"
)
const (
@ -139,6 +138,7 @@ func IsRoleAuthorize(rbLister rbaclister.RoleBindingLister, crbLister rbaclister
if err != nil {
return false, err
}
for _,e := range clusterRoles {
role,err := crLister.Get(e);
if err != nil {
@ -162,11 +162,18 @@ func IsRoleAuthorize(rbLister rbaclister.RoleBindingLister, crbLister rbaclister
}
} else {
// User or Group
excludeDevelopmentRole := []string{"minikube-user","kubernetes-admin"}
for _,e := range excludeDevelopmentRole {
if strings.Contains(request.UserInfo.Username,e){
return false,nil
}
}
var matchedRoles []bool
for _,e := range request.UserInfo.Groups {
for _,defaultSuffix := range defaultSuffixs {
if strings.Contains(e,defaultSuffix) {
matchedRoles = append(matchedRoles, true)
break;
}
}
}