mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-05 15:37:19 +00:00
955570b0c5
* fix auth checks with apiVersion and subresource Signed-off-by: ShutingZhao <shuting@nirmata.com> * add kuttl tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * remove duplicate code Signed-off-by: ShutingZhao <shuting@nirmata.com> * update permissions Signed-off-by: ShutingZhao <shuting@nirmata.com> --------- Signed-off-by: ShutingZhao <shuting@nirmata.com>
32 lines
1.1 KiB
Go
32 lines
1.1 KiB
Go
package mutate
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/kyverno/kyverno/pkg/auth"
|
|
"github.com/kyverno/kyverno/pkg/clients/dclient"
|
|
)
|
|
|
|
type authChecker struct {
|
|
client dclient.Interface
|
|
user string
|
|
}
|
|
|
|
type AuthChecker interface {
|
|
CanIUpdate(ctx context.Context, gvks, namespace, subresource string) (bool, error)
|
|
CanIGet(ctx context.Context, gvks, namespace, subresource string) (bool, error)
|
|
}
|
|
|
|
func newAuthChecker(client dclient.Interface, user string) AuthChecker {
|
|
return &authChecker{client: client, user: user}
|
|
}
|
|
|
|
func (a *authChecker) CanIUpdate(ctx context.Context, gvk, namespace, subresource string) (bool, error) {
|
|
checker := auth.NewCanI(a.client.Discovery(), a.client.GetKubeClient().AuthorizationV1().SubjectAccessReviews(), gvk, namespace, "update", subresource, a.user)
|
|
return checker.RunAccessCheck(ctx)
|
|
}
|
|
|
|
func (a *authChecker) CanIGet(ctx context.Context, gvk, namespace, subresource string) (bool, error) {
|
|
checker := auth.NewCanI(a.client.Discovery(), a.client.GetKubeClient().AuthorizationV1().SubjectAccessReviews(), gvk, namespace, "get", subresource, a.user)
|
|
return checker.RunAccessCheck(ctx)
|
|
}
|