Include system:authenticated group when impersonating #44076
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
This change is |
k8s-github-robot
added
approved
liggitt
added
release-note
liggitt
force-pushed
the
impersonation-groupify
branch
from
9e7bc0f
to
0660c7a
Compare
k8s-github-robot
added
size/M
liggitt
added
area/security
sig/auth
|
@k8s-bot non-cri e2e test this |
| } | ||
| } | ||
| if !found { | ||
| groups = append(groups, user.AllAuthenticated) |
There was a problem hiding this comment.
If any groups have been specified, I don't think that we should auto-add something else to the list. The caller knew how to send the groups and chose not to.
There was a problem hiding this comment.
I'm hard pressed to think of any scenario where that behavior would be helpful and not confusing.
There was a problem hiding this comment.
I'm hard pressed to think of any scenario where that behavior would be helpful and not confusing.
If you don't do that, you're stealing power from the API. I can see why you'd add the group for cases where its not found (same as the downstream "groupify for me"), but to take what the user requested and decide, "I'll add this too" (which we don't do downstream), seems wrong to me.
liggitt
force-pushed
the
impersonation-groupify
branch
from
0660c7a
to
86623ed
Compare
|
@k8s-bot cvm gce e2e test this |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, liggitt
Needs approval from an approver in each of these OWNERS Files:
You can indicate your approval by writing |
|
Automatic merge from submit-queue |
Fixes #43227
An authorized impersonation request solely for a specific username previously resulted in a
user.Infothat did not include either thesystem:authenticatedorsystem:unauthenticatedgroups. That meant that permissions intended to be granted to all users, like discovery, would be denied the impersonated user.This allows
kubectl get pods --as=<username>to work as expected