scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-10-31 10:18:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Authorize PSP usage for pods without service accounts

Browse Source
This commit is contained in:
Jordan Liggitt
2017-03-02 01:49:49 -05:00
parent 2b6e318ea0
commit dd7561801a
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
plugin/pkg/admission/security/podsecuritypolicy/admission.go
View File

@@ -288,7 +288,8 @@ func getMatchingPolicies(lister extensionslisters.PodSecurityPolicyLister, user
} }
for _, constraint := range list { for _, constraint := range list {
if authorizedForPolicy(user, constraint, authz) || authorizedForPolicy(sa, constraint, authz) { // if no user info exists then the API is being hit via the unsecured port. In this case authorize the request.
if user == nil || authorizedForPolicy(user, constraint, authz) || authorizedForPolicy(sa, constraint, authz) {
matchedPolicies = append(matchedPolicies, constraint) matchedPolicies = append(matchedPolicies, constraint)
} }
} }
@@ -298,10 +299,8 @@ func getMatchingPolicies(lister extensionslisters.PodSecurityPolicyLister, user
// authorizedForPolicy returns true if info is authorized to perform a "get" on policy. // authorizedForPolicy returns true if info is authorized to perform a "get" on policy.
func authorizedForPolicy(info user.Info, policy *extensions.PodSecurityPolicy, authz authorizer.Authorizer) bool { func authorizedForPolicy(info user.Info, policy *extensions.PodSecurityPolicy, authz authorizer.Authorizer) bool {
// if no info exists then the API is being hit via the unsecured port. In this case
// authorize the request.
if info == nil { if info == nil {
return true return false
} }
attr := buildAttributes(info, policy) attr := buildAttributes(info, policy)
allowed, reason, err := authz.Authorize(attr) allowed, reason, err := authz.Authorize(attr)

7
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go
View File

@@ -1610,7 +1610,7 @@ func TestGetMatchingPolicies(t *testing.T) {
// (ie. a request hitting the unsecure port) // (ie. a request hitting the unsecure port)
expectedPolicies: sets.NewString("policy1", "policy2", "policy3"), expectedPolicies: sets.NewString("policy1", "policy2", "policy3"),
}, },
"policies are allowed for nil sa info": { "policies are not allowed for nil sa info": {
user: &user.DefaultInfo{Name: "user"}, user: &user.DefaultInfo{Name: "user"},
sa: nil, sa: nil,
disallowedPolicies: map[string][]string{ disallowedPolicies: map[string][]string{
@@ -1622,9 +1622,8 @@ func TestGetMatchingPolicies(t *testing.T) {
policyWithName("policy2"), policyWithName("policy2"),
policyWithName("policy3"), policyWithName("policy3"),
}, },
// all policies are allowed regardless of the permissions when sa info is nil // only the policies for the user are allowed when sa info is nil
// (ie. a request hitting the unsecure port) expectedPolicies: sets.NewString("policy2"),
expectedPolicies: sets.NewString("policy1", "policy2", "policy3"),
}, },
} }
for k, v := range tests { for k, v := range tests {