Skip to content

Commit 10e2e6c

Browse files
deads2kdeads2k
committed
switch meaning to openshift.GetResource to match upstream
1 parent a4bdfab commit 10e2e6c

File tree

15 files changed

+89
-48
lines changed

15 files changed

+89
-48
lines changed

‎pkg/authorization/authorizer/adapter/attributes.go

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,16 +38,11 @@ func OriginAuthorizerAttributes(kattrs kauthorizer.Attributes) (kapi.Context, oa
3838
APIGroup: kattrs.GetAPIGroup(),
3939
APIVersion: kattrs.GetAPIVersion(),
4040
Resource: kattrs.GetResource(),
41+
Subresource: kattrs.GetSubresource(),
4142
ResourceName: kattrs.GetName(),
4243

4344
NonResourceURL: kattrs.IsResourceRequest() == false,
4445
URL: kattrs.GetPath(),
45-
46-
// TODO: add to kube authorizer attributes
47-
// RequestAttributes interface{}
48-
}
49-
if len(kattrs.GetSubresource()) > 0 {
50-
oattrs.Resource = kattrs.GetResource() + "/" + kattrs.GetSubresource()
5146
}
5247

5348
return ctx, oattrs

‎pkg/authorization/authorizer/adapter/attributes_test.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ func TestRoundTrip(t *testing.T) {
2222
APIVersion: "av",
2323
APIGroup: "ag",
2424
Resource: "r",
25+
Subresource: "sub",
2526
ResourceName: "rn",
2627
NonResourceURL: true,
2728
URL: "/123",
@@ -73,6 +74,9 @@ func TestRoundTrip(t *testing.T) {
7374
if oattrs.GetResource() != oattrs2.GetResource() {
7475
t.Errorf("Expected %v, got %v", oattrs.GetResource(), oattrs2.GetResource())
7576
}
77+
if oattrs.GetSubresource() != oattrs2.GetSubresource() {
78+
t.Errorf("Expected %v, got %v", oattrs.GetSubresource(), oattrs2.GetSubresource())
79+
}
7680

7781
// Ensure origin-specific info is preserved
7882
if oattrs.GetAPIVersion() != oattrs2.GetAPIVersion() {
@@ -95,7 +99,7 @@ func TestRoundTrip(t *testing.T) {
9599
func TestAttributeIntersection(t *testing.T) {
96100
// These are the things we expect to be shared
97101
// Everything in this list should be used by OriginAuthorizerAttributes
98-
expectedIntersection := sets.NewString("GetVerb", "GetResource", "GetAPIGroup", "GetAPIVersion")
102+
expectedIntersection := sets.NewString("GetVerb", "GetResource", "GetSubresource", "GetAPIGroup", "GetAPIVersion")
99103

100104
// These are the things we expect to only be in the Kubernetes interface
101105
// Everything in this list should be used by OriginAuthorizerAttributes or derivative (like IsReadOnly)

‎pkg/authorization/authorizer/attributes.go

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ type DefaultAuthorizationAttributes struct {
1414
APIVersion string
1515
APIGroup string
1616
Resource string
17+
Subresource string
1718
ResourceName string
1819
NonResourceURL bool
1920
URL string
@@ -22,11 +23,24 @@ type DefaultAuthorizationAttributes struct {
2223
// ToDefaultAuthorizationAttributes coerces Action to DefaultAuthorizationAttributes. Namespace is not included
2324
// because the authorizer takes that information on the context
2425
func ToDefaultAuthorizationAttributes(in authorizationapi.Action) Action {
26+
// to match the RequestInfoFactory assuming an in.resource of one/two/three, one==resource, two==subresource, three=nothing
27+
tokens := strings.SplitN(in.Resource, "/", 2)
28+
resource := ""
29+
subresource := ""
30+
switch {
31+
case len(tokens) >= 2:
32+
subresource = tokens[1]
33+
fallthrough
34+
case len(tokens) == 1:
35+
resource = tokens[0]
36+
}
37+
2538
return DefaultAuthorizationAttributes{
2639
Verb: in.Verb,
2740
APIGroup: in.Group,
2841
APIVersion: in.Version,
29-
Resource: in.Resource,
42+
Resource: resource,
43+
Subresource: subresource,
3044
ResourceName: in.ResourceName,
3145
URL: in.Path,
3246
NonResourceURL: in.IsNonResourceURL,
@@ -85,7 +99,15 @@ func verbMatches(a Action, verbs sets.String) bool {
8599
}
86100

87101
func resourceMatches(a Action, allowedResourceTypes sets.String) bool {
88-
return allowedResourceTypes.Has(authorizationapi.ResourceAll) || allowedResourceTypes.Has(strings.ToLower(a.GetResource()))
102+
if allowedResourceTypes.Has(authorizationapi.ResourceAll) {
103+
return true
104+
}
105+
106+
if len(a.GetSubresource()) == 0 {
107+
return allowedResourceTypes.Has(strings.ToLower(a.GetResource()))
108+
}
109+
110+
return allowedResourceTypes.Has(strings.ToLower(a.GetResource() + "/" + a.GetSubresource()))
89111
}
90112

91113
// nameMatches checks to see if the resourceName of the action is in a the specified whitelist. An empty whitelist indicates that any name is allowed.
@@ -147,6 +169,10 @@ func (a DefaultAuthorizationAttributes) GetResource() string {
147169
return a.Resource
148170
}
149171

172+
func (a DefaultAuthorizationAttributes) GetSubresource() string {
173+
return a.Subresource
174+
}
175+
150176
func (a DefaultAuthorizationAttributes) GetResourceName() string {
151177
return a.ResourceName
152178
}

‎pkg/authorization/authorizer/attributes_builder.go

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,12 @@ func (a *openshiftAuthorizationAttributeBuilder) GetAttributes(req *http.Request
3030
}, nil
3131
}
3232

33-
resource := requestInfo.Resource
34-
if len(requestInfo.Subresource) > 0 {
35-
resource = requestInfo.Resource + "/" + requestInfo.Subresource
36-
}
37-
3833
return DefaultAuthorizationAttributes{
3934
Verb: requestInfo.Verb,
4035
APIGroup: requestInfo.APIGroup,
4136
APIVersion: requestInfo.APIVersion,
42-
Resource: resource,
37+
Resource: requestInfo.Resource,
38+
Subresource: requestInfo.Subresource,
4339
ResourceName: requestInfo.Name,
4440
NonResourceURL: false,
4541
URL: requestInfo.Path,

‎pkg/authorization/authorizer/attributes_test.go

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package authorizer
22

33
import (
4+
"strings"
45
"testing"
56

67
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
@@ -29,7 +30,21 @@ func (a authorizationAttributesAdapter) GetAPIGroup() string {
2930
}
3031

3132
func (a authorizationAttributesAdapter) GetResource() string {
32-
return a.attrs.Resource
33+
// to match the RequestInfoFactory assuming an in.resource of one/two/three, one==resource, two==subresource, three=nothing
34+
tokens := strings.SplitN(a.attrs.Resource, "/", 2)
35+
if len(tokens) >= 1 {
36+
return tokens[0]
37+
}
38+
return ""
39+
}
40+
41+
func (a authorizationAttributesAdapter) GetSubresource() string {
42+
// to match the RequestInfoFactory assuming an in.resource of one/two/three, one==resource, two==subresource, three=nothing
43+
tokens := strings.SplitN(a.attrs.Resource, "/", 2)
44+
if len(tokens) >= 2 {
45+
return tokens[1]
46+
}
47+
return ""
3348
}
3449

3550
func (a authorizationAttributesAdapter) GetResourceName() string {

‎pkg/authorization/authorizer/bootstrap_policy_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -378,8 +378,9 @@ func TestAdminGetStatusInMallet(t *testing.T) {
378378
test := &authorizeTest{
379379
context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), "mallet"), &user.DefaultInfo{Name: "Matthew"}),
380380
attributes: &DefaultAuthorizationAttributes{
381-
Verb: "get",
382-
Resource: "pods/status",
381+
Verb: "get",
382+
Resource: "pods",
383+
Subresource: "status",
383384
},
384385
expectedAllowed: true,
385386
expectedReason: "allowed by rule in mallet",

‎pkg/authorization/authorizer/cache/authorizer.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ func cacheKey(ctx kapi.Context, a authorizer.Action) (string, error) {
128128
"apiVersion": a.GetAPIVersion(),
129129
"apiGroup": a.GetAPIGroup(),
130130
"resource": a.GetResource(),
131+
"subresource": a.GetSubresource(),
131132
"resourceName": a.GetResourceName(),
132133
"nonResourceURL": a.IsNonResourceURL(),
133134
"url": a.GetURL(),

‎pkg/authorization/authorizer/cache/authorizer_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestCacheKey(t *testing.T) {
2929
"empty": {
3030
Context: kapi.NewContext(),
3131
Attrs: &authorizer.DefaultAuthorizationAttributes{},
32-
ExpectedKey: `{"apiGroup":"","apiVersion":"","nonResourceURL":false,"resource":"","resourceName":"","url":"","verb":""}`,
32+
ExpectedKey: `{"apiGroup":"","apiVersion":"","nonResourceURL":false,"resource":"","resourceName":"","subresource":"","url":"","verb":""}`,
3333
},
3434
"full": {
3535
Context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), "myns"), &user.DefaultInfo{Name: "me", Groups: []string{"group1", "group2"}}),
@@ -38,11 +38,12 @@ func TestCacheKey(t *testing.T) {
3838
APIVersion: "av",
3939
APIGroup: "ag",
4040
Resource: "r",
41+
Subresource: "sub",
4142
ResourceName: "rn",
4243
NonResourceURL: true,
4344
URL: "/abc",
4445
},
45-
ExpectedKey: `{"apiGroup":"ag","apiVersion":"av","groups":["group1","group2"],"namespace":"myns","nonResourceURL":true,"resource":"r","resourceName":"rn","scopes":null,"url":"/abc","user":"me","verb":"v"}`,
46+
ExpectedKey: `{"apiGroup":"ag","apiVersion":"av","groups":["group1","group2"],"namespace":"myns","nonResourceURL":true,"resource":"r","resourceName":"rn","scopes":null,"subresource":"sub","url":"/abc","user":"me","verb":"v"}`,
4647
},
4748
}
4849

‎pkg/authorization/authorizer/interfaces.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ type Action interface {
2828
GetAPIGroup() string
2929
// GetResource returns the resource type. If IsNonResourceURL() is true, then GetResource() is "".
3030
GetResource() string
31+
GetSubresource() string
3132
GetResourceName() string
3233
// IsNonResourceURL returns true if this is not an action performed against the resource API
3334
IsNonResourceURL() bool

‎pkg/authorization/authorizer/messages.go

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,27 +21,28 @@ type ForbiddenMessageResolver struct {
2121

2222
func NewForbiddenMessageResolver(projectRequestForbiddenTemplate string) *ForbiddenMessageResolver {
2323
apiGroupIfNotEmpty := "{{if len .Attributes.GetAPIGroup }}{{.Attributes.GetAPIGroup}}.{{end}}"
24+
resourceWithSubresourceIfNotEmpty := "{{if len .Attributes.GetSubresource }}{{.Attributes.GetResource}}/{{.Attributes.GetSubresource}}{{else}}{{.Attributes.GetResource}}{{end}}"
2425

2526
messageResolver := &ForbiddenMessageResolver{
2627
namespacedVerbsToResourcesToForbiddenMessageMaker: map[string]map[string]ForbiddenMessageMaker{},
2728
rootScopedVerbsToResourcesToForbiddenMessageMaker: map[string]map[string]ForbiddenMessageMaker{},
2829
nonResourceURLForbiddenMessageMaker: newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot "{{.Attributes.GetVerb}}" on "{{.Attributes.GetURL}}"`),
29-
defaultForbiddenMessageMaker: newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot "{{.Attributes.GetVerb}}" "` + apiGroupIfNotEmpty + `{{.Attributes.GetResource}}" with name "{{.Attributes.GetResourceName}}" in project "{{.Namespace}}"`),
30+
defaultForbiddenMessageMaker: newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot "{{.Attributes.GetVerb}}" "` + apiGroupIfNotEmpty + resourceWithSubresourceIfNotEmpty + `" with name "{{.Attributes.GetResourceName}}" in project "{{.Namespace}}"`),
3031
}
3132

3233
// general messages
33-
messageResolver.addNamespacedForbiddenMessageMaker("create", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot create `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
34-
messageResolver.addRootScopedForbiddenMessageMaker("create", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot create `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} at the cluster scope`))
35-
messageResolver.addNamespacedForbiddenMessageMaker("get", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot get `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
36-
messageResolver.addRootScopedForbiddenMessageMaker("get", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot get `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} at the cluster scope`))
37-
messageResolver.addNamespacedForbiddenMessageMaker("list", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot list `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
38-
messageResolver.addRootScopedForbiddenMessageMaker("list", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot list all `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in the cluster`))
39-
messageResolver.addNamespacedForbiddenMessageMaker("watch", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot watch `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
40-
messageResolver.addRootScopedForbiddenMessageMaker("watch", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot watch all `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in the cluster`))
41-
messageResolver.addNamespacedForbiddenMessageMaker("update", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot update `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
42-
messageResolver.addRootScopedForbiddenMessageMaker("update", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot update `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} at the cluster scope`))
43-
messageResolver.addNamespacedForbiddenMessageMaker("delete", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot delete `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} in project "{{.Namespace}}"`))
44-
messageResolver.addRootScopedForbiddenMessageMaker("delete", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot delete `+apiGroupIfNotEmpty+`{{.Attributes.GetResource}} at the cluster scope`))
34+
messageResolver.addNamespacedForbiddenMessageMaker("create", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot create `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
35+
messageResolver.addRootScopedForbiddenMessageMaker("create", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot create `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` at the cluster scope`))
36+
messageResolver.addNamespacedForbiddenMessageMaker("get", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot get `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
37+
messageResolver.addRootScopedForbiddenMessageMaker("get", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot get `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` at the cluster scope`))
38+
messageResolver.addNamespacedForbiddenMessageMaker("list", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot list `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
39+
messageResolver.addRootScopedForbiddenMessageMaker("list", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot list all `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in the cluster`))
40+
messageResolver.addNamespacedForbiddenMessageMaker("watch", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot watch `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
41+
messageResolver.addRootScopedForbiddenMessageMaker("watch", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot watch all `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in the cluster`))
42+
messageResolver.addNamespacedForbiddenMessageMaker("update", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot update `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
43+
messageResolver.addRootScopedForbiddenMessageMaker("update", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot update `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` at the cluster scope`))
44+
messageResolver.addNamespacedForbiddenMessageMaker("delete", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot delete `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` in project "{{.Namespace}}"`))
45+
messageResolver.addRootScopedForbiddenMessageMaker("delete", authorizationapi.ResourceAll, newTemplateForbiddenMessageMaker(`User "{{.User.GetName}}" cannot delete `+apiGroupIfNotEmpty+resourceWithSubresourceIfNotEmpty+` at the cluster scope`))
4546

4647
// project request rejection
4748
projectRequestDeny := projectRequestForbiddenTemplate

‎pkg/authorization/authorizer/remote/authorizer.go

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -93,21 +93,19 @@ func (r *RemoteAuthorizer) GetAllowedSubjects(ctx kapi.Context, attributes autho
9393
}
9494

9595
func getAction(namespace string, attributes authorizer.Action) authzapi.Action {
96+
resource := attributes.GetResource()
97+
if len(attributes.GetSubresource()) > 0 {
98+
resource = resource + "/" + attributes.GetSubresource()
99+
}
96100
return authzapi.Action{
97101
Namespace: namespace,
98102
Verb: attributes.GetVerb(),
99103
Group: attributes.GetAPIGroup(),
100104
Version: attributes.GetAPIVersion(),
101-
Resource: attributes.GetResource(),
105+
Resource: resource,
102106
ResourceName: attributes.GetResourceName(),
103107

104108
Path: attributes.GetURL(),
105109
IsNonResourceURL: attributes.IsNonResourceURL(),
106-
107-
// TODO: missing from authorizer.Action:
108-
// Content
109-
110-
// TODO: missing from authzapi.Action
111-
// RequestAttributes (unserializable?)
112110
}
113111
}

‎pkg/cmd/server/kubernetes/node_auth.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ func (n NodeAuthorizerAttributesGetter) GetRequestAttributes(u user.Info, r *htt
6060
APIVersion: "v1",
6161
APIGroup: "",
6262
Verb: apiVerb,
63-
Resource: "nodes/proxy",
63+
Resource: "nodes",
64+
Subresource: "proxy",
6465
ResourceName: n.nodeName,
6566
URL: r.URL.Path,
6667
}

‎pkg/cmd/server/origin/master_config.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -826,9 +826,9 @@ func newAuthorizationAttributeBuilder(requestContextMapper kapi.RequestContextMa
826826
sets.NewString(bootstrappolicy.AuthenticatedGroup),
827827
requestInfoFactory,
828828
)
829-
personalSARRequestInfoResolveer := authorizer.NewPersonalSARRequestInfoResolver(browserSafeRequestInfoResolver)
829+
personalSARRequestInfoResolver := authorizer.NewPersonalSARRequestInfoResolver(browserSafeRequestInfoResolver)
830830

831-
authorizationAttributeBuilder := authorizer.NewAuthorizationAttributeBuilder(requestContextMapper, personalSARRequestInfoResolveer)
831+
authorizationAttributeBuilder := authorizer.NewAuthorizationAttributeBuilder(requestContextMapper, personalSARRequestInfoResolver)
832832
return authorizationAttributeBuilder
833833
}
834834

‎pkg/scheduler/admission/podnodeconstraints/admission.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,9 +177,10 @@ func (o *podNodeConstraints) Validate() error {
177177
func (o *podNodeConstraints) checkPodsBindAccess(attr admission.Attributes) (bool, error) {
178178
ctx := kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), attr.GetNamespace()), attr.GetUserInfo())
179179
authzAttr := authorizer.DefaultAuthorizationAttributes{
180-
Verb: "create",
181-
Resource: "pods/binding",
182-
APIGroup: kapi.GroupName,
180+
Verb: "create",
181+
Resource: "pods",
182+
Subresource: "binding",
183+
APIGroup: kapi.GroupName,
183184
}
184185
if attr.GetResource().GroupResource() == kapi.Resource("pods") {
185186
authzAttr.ResourceName = attr.GetName()

‎pkg/service/admission/endpoint_admission.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"net"
77
"reflect"
88

9-
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
109
"github.com/openshift/origin/pkg/authorization/authorizer"
1110
"github.com/openshift/origin/pkg/client"
1211
oadmission "github.com/openshift/origin/pkg/cmd/server/admission"
@@ -86,7 +85,8 @@ func (r *restrictedEndpointsAdmission) checkAccess(attr kadmission.Attributes) (
8685
ctx := kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), attr.GetNamespace()), attr.GetUserInfo())
8786
authzAttr := authorizer.DefaultAuthorizationAttributes{
8887
Verb: "create",
89-
Resource: authorizationapi.RestrictedEndpointsResource,
88+
Resource: "endpoints",
89+
Subresource: "restricted",
9090
APIGroup: kapi.GroupName,
9191
ResourceName: attr.GetName(),
9292
}

0 commit comments

Comments
 (0)