Add missing UID in SubjectAccessReviewSpec #49677

dims · 2017-07-27T01:50:57Z

What this PR does / why we need it:
WebhookAuthorizer's Authorize should send all the information
present in the user.Info data structure. We are not sending the
UID currently.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

Special notes for your reviewer:

Release note:

The SubjectAccessReview API in the authorization.k8s.io API group now allows providing the user uid.

ericchiang · 2017-07-27T16:27:09Z

/cc @kubernetes/sig-auth-pr-reviews

deads2k · 2017-07-27T17:06:46Z

/approve

liggitt · 2017-07-27T17:12:05Z

staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go

@@ -144,6 +144,7 @@ func (w *WebhookAuthorizer) Authorize(attr authorizer.Attributes) (authorized bo
 	if user := attr.GetUser(); user != nil {
 		r.Spec = authorization.SubjectAccessReviewSpec{
 			User:   user.GetName(),
+			UID:	user.GetUID(),


a corresponding change in sarApprover.authorize and the CSR API propagating the uid would make sense to me

@dims want to take that in this PR? If not i can send one.

Fixed a few more spots. Will wait for the CI to run to see if the changes hold up

@ericchiang i found the "sarApprover.authorize" but not sure if i have covered all the cases, please see latest patch.

liggitt · 2017-07-28T13:31:40Z

cc @cjcullen for a new field sent to the authz webhook

dims · 2017-07-28T16:51:12Z

/assign @smarterclayton

ncdc · 2017-07-31T15:36:33Z

/unassign

k8s-github-robot · 2017-08-01T20:19:35Z

@k8s-bot test this

Tests are more than 96 hours old. Re-running tests.

dims · 2017-08-02T00:44:53Z

/retest

WebhookAuthorizer's Authorize should send *all* the information present in the user.Info data structure. We are not sending the UID currently.

dims · 2017-08-02T16:51:06Z

/retest

dims · 2017-08-02T19:16:51Z

/retest

dims · 2017-08-02T21:37:55Z

/retest

dims · 2017-08-02T23:59:04Z

/assign @thockin
Can you please help with a review from the API perspective? This one is caught in the rebase+hack/update-all.sh+retest hell

liggitt · 2017-08-03T00:00:49Z

/lgtm
Needs approval

smarterclayton · 2017-08-03T18:58:24Z

/approve

This is relevant info and is important. It was not omitted intentionally.

@dims are there other endpoints that need this like external web hooks?

smarterclayton · 2017-08-03T19:08:53Z

/approve no-issue

k8s-github-robot · 2017-08-03T19:09:33Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, dims, liggitt, smarterclayton

Associated issue requirement bypassed by: smarterclayton

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~api/OWNERS~~ [smarterclayton]
~~docs/OWNERS~~ [smarterclayton]
~~pkg/apis/OWNERS~~ [smarterclayton]
~~pkg/controller/OWNERS~~ [deads2k,smarterclayton]
~~pkg/registry/OWNERS~~ [deads2k,smarterclayton]
~~staging/src/k8s.io/api/OWNERS~~ [smarterclayton]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

dims · 2017-08-03T19:29:56Z

@smarterclayton : thanks a ton. I will review more to see where else we are missing UID. i was focused on SubjectAccessReview, but will widen the net.

k8s-github-robot · 2017-08-03T23:43:33Z

Automatic merge from submit-queue (batch tested with PRs 50103, 49677, 49449, 43586, 48969)

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 27, 2017

k8s-github-robot assigned ncdc and wojtek-t Jul 27, 2017

k8s-github-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. release-note-label-needed release-note-none Denotes a PR that doesn't merit a release note. and removed release-note-label-needed labels Jul 27, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from 8430aed to 8d94f4d Compare July 27, 2017 03:37

k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 27, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from 8d94f4d to 54e4880 Compare July 27, 2017 03:49

k8s-github-robot added kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 27, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from 54e4880 to 9821d49 Compare July 27, 2017 04:05

k8s-github-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 27, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from 9821d49 to c8f3420 Compare July 27, 2017 11:47

k8s-github-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 27, 2017

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jul 27, 2017

liggitt reviewed Jul 27, 2017

View reviewed changes

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from c8f3420 to beb83f6 Compare July 27, 2017 17:16

dims changed the title ~~WIP : Add missing UID in SubjectAccessReviewSpec~~ Add missing UID in SubjectAccessReviewSpec Jul 27, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch 2 times, most recently from ef4ea5a to 5835a10 Compare July 27, 2017 17:29

wojtek-t assigned liggitt and unassigned wojtek-t Jul 27, 2017

k8s-ci-robot assigned smarterclayton Jul 28, 2017

k8s-ci-robot unassigned ncdc Jul 31, 2017

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from d412fad to ca8696f Compare August 2, 2017 09:50

k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 2, 2017

Add missing UID in SubjectAccessReviewSpec

9a761b1

WebhookAuthorizer's Authorize should send *all* the information present in the user.Info data structure. We are not sending the UID currently.

dims force-pushed the send-missing-uid-field-during-webhook-authorize branch from ca8696f to 9a761b1 Compare August 2, 2017 14:52

k8s-github-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 2, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 3, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 3, 2017

k8s-github-robot merged commit 40d66b8 into kubernetes:master Aug 3, 2017

dims deleted the send-missing-uid-field-during-webhook-authorize branch November 16, 2017 22:08

reith mentioned this pull request Aug 4, 2020

UserInfo.UID is not passed by client-go #93699

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add missing UID in SubjectAccessReviewSpec #49677

Add missing UID in SubjectAccessReviewSpec #49677

dims commented Jul 27, 2017 •

edited by liggitt

Loading

ericchiang commented Jul 27, 2017

deads2k commented Jul 27, 2017

liggitt Jul 27, 2017

ericchiang Jul 27, 2017

dims Jul 27, 2017

dims Jul 27, 2017

liggitt commented Jul 28, 2017

dims commented Jul 28, 2017

ncdc commented Jul 31, 2017

k8s-github-robot commented Aug 1, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017 •

edited

Loading

liggitt commented Aug 3, 2017

smarterclayton commented Aug 3, 2017

smarterclayton commented Aug 3, 2017

k8s-github-robot commented Aug 3, 2017

dims commented Aug 3, 2017

k8s-github-robot commented Aug 3, 2017

Add missing UID in SubjectAccessReviewSpec #49677

Add missing UID in SubjectAccessReviewSpec #49677

Conversation

dims commented Jul 27, 2017 • edited by liggitt Loading

ericchiang commented Jul 27, 2017

deads2k commented Jul 27, 2017

liggitt Jul 27, 2017

Choose a reason for hiding this comment

ericchiang Jul 27, 2017

Choose a reason for hiding this comment

dims Jul 27, 2017

Choose a reason for hiding this comment

dims Jul 27, 2017

Choose a reason for hiding this comment

liggitt commented Jul 28, 2017

dims commented Jul 28, 2017

ncdc commented Jul 31, 2017

k8s-github-robot commented Aug 1, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017

dims commented Aug 2, 2017 • edited Loading

liggitt commented Aug 3, 2017

smarterclayton commented Aug 3, 2017

smarterclayton commented Aug 3, 2017

k8s-github-robot commented Aug 3, 2017

dims commented Aug 3, 2017

k8s-github-robot commented Aug 3, 2017

dims commented Jul 27, 2017 •

edited by liggitt

Loading

dims commented Aug 2, 2017 •

edited

Loading