This change add nonResourceURL to kubectl auth cani #46432

CaoShuFeng · 2017-05-25T12:14:15Z

Release note:

support nonResourceURL to kubectl auth cani

k8s-ci-robot · 2017-05-25T12:14:23Z

Hi @CaoShuFeng. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

CaoShuFeng · 2017-05-25T12:14:28Z

@deads2k

deads2k · 2017-05-26T12:34:51Z

pkg/kubectl/cmd/auth/cani.go

-	errors := []error{}
-	return utilerrors.NewAggregate(errors)
+	if o.NonResourceURL != "" && o.Subresource != "" {
+		return fmt.Errorf("--subresource can not be used with nonResourceURL")


neither can resources or resourceNames

deads2k · 2017-05-26T12:36:49Z

pkg/kubectl/cmd/auth/cani.go

-				Subresource: o.Subresource,
-				Name:        o.ResourceName,
+	var sar *authorizationapi.SelfSubjectAccessReview
+	if o.Resource != (schema.GroupVersionResource{}) {


Seems like we should check for the presence of a nonresourceurl instead.

deads2k · 2017-05-26T12:37:17Z

Minor comments. I like the way it works.

@fabianofranz any comment on usage?

fabianofranz · 2017-05-26T19:18:58Z

pkg/kubectl/cmd/auth/cani.go

@@ -57,7 +57,7 @@ var (
 		Check whether an action is allowed.

 		VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc.
-		TYPE is a Kubernetes resource.  Shortcuts and groups will be resolved.
+		TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. If start with "/", TYPE will be treated as nonResourceURL.


Need to adjust the command usage to add the new arg type, something like:

kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]

fabianofranz · 2017-05-26T19:19:49Z

pkg/kubectl/cmd/auth/cani.go

+		# Check to see if I can read pod logs
+		kubectl auth can-i get pods --subresource=log
+
+		# Check to see if I can access url /logs/


Check to see if I can access the URL "/logs"

fabianofranz · 2017-05-26T19:24:20Z

pkg/kubectl/cmd/auth/cani.go

@@ -57,7 +57,7 @@ var (
 		Check whether an action is allowed.

 		VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc.
-		TYPE is a Kubernetes resource.  Shortcuts and groups will be resolved.
+		TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. If start with "/", TYPE will be treated as nonResourceURL.


Here in the description refer to it as a "Non-Resource URL".

deads2k · 2017-05-31T13:27:01Z

@k8s-bot ok to test

deads2k · 2017-05-31T13:27:06Z

/lgtm

k8s-github-robot · 2017-05-31T13:30:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CaoShuFeng, deads2k

Needs approval from an approver in each of these OWNERS Files:

~~pkg/kubectl/OWNERS~~ [deads2k]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

CaoShuFeng · 2017-06-01T01:27:50Z

@k8s-bot pull-kubernetes-kubemark-e2e-gce test this
@k8s-bot pull-kubernetes-verify test this
@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this

CaoShuFeng · 2017-06-01T05:23:49Z

@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this

k8s-github-robot · 2017-06-02T16:27:13Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

foxish · 2017-06-02T17:09:31Z

@k8s-bot pull-kubernetes-verify test this
@k8s-bot pull-kubernetes-node-e2e test this

k8s-ci-robot · 2017-06-02T17:11:41Z

@CaoShuFeng: The following test(s) failed:

Test name	Commit	Details	Rerun command
pull-kubernetes-federation-e2e-gce	`3bf3a03`	link	`@k8s-bot pull-kubernetes-federation-e2e-gce test this`
pull-kubernetes-unit	`3bf3a03`	link	`@k8s-bot pull-kubernetes-unit test this`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-github-robot · 2017-06-02T18:47:01Z

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 25, 2017

k8s-github-robot assigned smarterclayton and pwittrock May 25, 2017

k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels May 25, 2017

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 25, 2017

CaoShuFeng force-pushed the can-i-non-resource-url branch from 5b5dfba to 2741590 Compare May 25, 2017 12:44

pwittrock assigned deads2k and unassigned pwittrock May 26, 2017

deads2k reviewed May 26, 2017

View reviewed changes

fabianofranz reviewed May 26, 2017

View reviewed changes

This change add nonResourceURL to kubectl auth cani

3bf3a03

CaoShuFeng force-pushed the can-i-non-resource-url branch from 2741590 to 3bf3a03 Compare May 31, 2017 04:19

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 31, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 31, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 31, 2017

deads2k added this to the v1.7 milestone Jun 1, 2017

CaoShuFeng mentioned this pull request Jun 2, 2017

add cmd test for kubectl auth can-i #46755

Merged

k8s-github-robot merged commit 54cf289 into kubernetes:master Jun 2, 2017

CaoShuFeng deleted the can-i-non-resource-url branch November 6, 2017 05:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

This change add nonResourceURL to kubectl auth cani #46432

This change add nonResourceURL to kubectl auth cani #46432

CaoShuFeng commented May 25, 2017

k8s-ci-robot commented May 25, 2017

CaoShuFeng commented May 25, 2017

deads2k May 26, 2017

CaoShuFeng May 31, 2017

deads2k May 26, 2017

CaoShuFeng May 31, 2017

deads2k commented May 26, 2017

fabianofranz May 26, 2017

CaoShuFeng May 31, 2017

fabianofranz May 26, 2017

CaoShuFeng May 31, 2017

fabianofranz May 26, 2017

CaoShuFeng May 31, 2017

deads2k commented May 31, 2017

deads2k commented May 31, 2017

k8s-github-robot commented May 31, 2017

CaoShuFeng commented Jun 1, 2017

CaoShuFeng commented Jun 1, 2017

k8s-github-robot commented Jun 2, 2017

foxish commented Jun 2, 2017

k8s-ci-robot commented Jun 2, 2017 •

edited

Loading

k8s-github-robot commented Jun 2, 2017

This change add nonResourceURL to kubectl auth cani #46432

This change add nonResourceURL to kubectl auth cani #46432

Conversation

CaoShuFeng commented May 25, 2017

k8s-ci-robot commented May 25, 2017

CaoShuFeng commented May 25, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented May 26, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented May 31, 2017

deads2k commented May 31, 2017

k8s-github-robot commented May 31, 2017

CaoShuFeng commented Jun 1, 2017

CaoShuFeng commented Jun 1, 2017

k8s-github-robot commented Jun 2, 2017

foxish commented Jun 2, 2017

k8s-ci-robot commented Jun 2, 2017 • edited Loading

k8s-github-robot commented Jun 2, 2017

k8s-ci-robot commented Jun 2, 2017 •

edited

Loading