mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

remove RBACInfo check (#5015)

Browse source
This commit is contained in:
Vyankatesh Kudtarkar 2022-10-17 20:17:06 +05:30 • committed by GitHub
parent cb0410dcf1
commit f5748b1e70
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 64 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

68
pkg/webhooks/utils/policy_context_builder.go
View file

@ -1,12 +1,8 @@
package utils package utils
import ( import (
"encoding/json"
"strings"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
kyvernov1beta1 "github.com/kyverno/kyverno/api/kyverno/v1beta1" kyvernov1beta1 "github.com/kyverno/kyverno/api/kyverno/v1beta1"
"github.com/kyverno/kyverno/pkg/autogen"
"github.com/kyverno/kyverno/pkg/clients/dclient" "github.com/kyverno/kyverno/pkg/clients/dclient"
"github.com/kyverno/kyverno/pkg/config" "github.com/kyverno/kyverno/pkg/config"
"github.com/kyverno/kyverno/pkg/engine" "github.com/kyverno/kyverno/pkg/engine"
@ -22,60 +18,6 @@ type PolicyContextBuilder interface {
Build(*admissionv1.AdmissionRequest, ...kyvernov1.PolicyInterface) (*engine.PolicyContext, error) Build(*admissionv1.AdmissionRequest, ...kyvernov1.PolicyInterface) (*engine.PolicyContext, error)
} }
func checkForRBACInfo(rule kyvernov1.Rule) bool {
if len(rule.MatchResources.Roles) > 0 || len(rule.MatchResources.ClusterRoles) > 0 || len(rule.ExcludeResources.Roles) > 0 || len(rule.ExcludeResources.ClusterRoles) > 0 {
return true
}
if len(rule.MatchResources.All) > 0 {
for _, rf := range rule.MatchResources.All {
if len(rf.UserInfo.Roles) > 0 || len(rf.UserInfo.ClusterRoles) > 0 {
return true
}
}
}
if len(rule.MatchResources.Any) > 0 {
for _, rf := range rule.MatchResources.Any {
if len(rf.UserInfo.Roles) > 0 || len(rf.UserInfo.ClusterRoles) > 0 {
return true
}
}
}
if len(rule.ExcludeResources.All) > 0 {
for _, rf := range rule.ExcludeResources.All {
if len(rf.UserInfo.Roles) > 0 || len(rf.UserInfo.ClusterRoles) > 0 {
return true
}
}
}
if len(rule.ExcludeResources.Any) > 0 {
for _, rf := range rule.ExcludeResources.Any {
if len(rf.UserInfo.Roles) > 0 || len(rf.UserInfo.ClusterRoles) > 0 {
return true
}
}
}
if bytes, err := json.Marshal(rule); err != nil {
return false
} else {
if strings.Contains(string(bytes), "request.roles") || strings.Contains(string(bytes), "request.clusterRoles") {
return true
}
}
return false
}
func containsRBACInfo(policies ...kyvernov1.PolicyInterface) bool {
for _, policy := range policies {
for _, rule := range autogen.ComputeRules(policy) {
if checkForRBACInfo(rule) {
return true
}
}
}
return false
}
func newVariablesContext(request *admissionv1.AdmissionRequest, userRequestInfo *kyvernov1beta1.RequestInfo) (enginectx.Interface, error) { func newVariablesContext(request *admissionv1.AdmissionRequest, userRequestInfo *kyvernov1beta1.RequestInfo) (enginectx.Interface, error) {
ctx := enginectx.NewContext() ctx := enginectx.NewContext()
if err := ctx.AddRequest(request); err != nil { if err := ctx.AddRequest(request); err != nil {
@ -112,15 +54,13 @@ func NewPolicyContextBuilder(
} }
func (b *policyContextBuilder) Build(request *admissionv1.AdmissionRequest, policies ...kyvernov1.PolicyInterface) (*engine.PolicyContext, error) { func (b *policyContextBuilder) Build(request *admissionv1.AdmissionRequest, policies ...kyvernov1.PolicyInterface) (*engine.PolicyContext, error) {
var err error
userRequestInfo := kyvernov1beta1.RequestInfo{ userRequestInfo := kyvernov1beta1.RequestInfo{
AdmissionUserInfo: *request.UserInfo.DeepCopy(), AdmissionUserInfo: *request.UserInfo.DeepCopy(),
} }
if containsRBACInfo(policies...) { userRequestInfo.Roles, userRequestInfo.ClusterRoles, err = userinfo.GetRoleRef(b.rbLister, b.crbLister, request, b.configuration)
var err error if err != nil {
userRequestInfo.Roles, userRequestInfo.ClusterRoles, err = userinfo.GetRoleRef(b.rbLister, b.crbLister, request, b.configuration) return nil, errors.Wrap(err, "failed to fetch RBAC information for request")
if err != nil {
return nil, errors.Wrap(err, "failed to fetch RBAC information for request")
}
} }
ctx, err := newVariablesContext(request, &userRequestInfo) ctx, err := newVariablesContext(request, &userRequestInfo)
if err != nil { if err != nil {