Skip to content

Add extra field when doing SubjectAccessReview #265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaypipes merged 2 commits into from
Apr 10, 2026
Merged

Add extra field when doing SubjectAccessReview #265

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
97f9d55
add extra field when doing SubjectAccessReview
jinjiaKarl Apr 8, 2026
f3c1056
add comments
jinjiaKarl Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions api/v1alpha1/workerresourcetemplate_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"os"
"strings"

authenticationv1 "k8s.io/api/authentication/v1"
authorizationv1 "k8s.io/api/authorization/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/api/meta"
Expand Down Expand Up @@ -390,6 +391,19 @@ func isEmptyMap(v interface{}) bool {
return ok && len(m) == 0
}

// convertUserInfoExtra converts an authentication ExtraValue map to an authorization ExtraValue map.
// Both types are []string under the hood; the conversion preserves all values exactly.
func convertUserInfoExtra(extra map[string]authenticationv1.ExtraValue) map[string]authorizationv1.ExtraValue {
if len(extra) == 0 {
return nil
}
out := make(map[string]authorizationv1.ExtraValue, len(extra))
for k, v := range extra {
out[k] = authorizationv1.ExtraValue(v)
}
return out
}

// validateWithAPI performs API-dependent validation: RESTMapper scope check and
// SubjectAccessReview for both the requesting user and the controller service account.
// verb is the RBAC verb to check ("create" on create/update, "delete" on delete).
Expand Down Expand Up @@ -456,6 +470,11 @@ func (v *WorkerResourceTemplateValidator) validateWithAPI(ctx context.Context, w
Spec: authorizationv1.SubjectAccessReviewSpec{
User: req.UserInfo.Username,
Groups: req.UserInfo.Groups,
// Some authentication plugins like GKE's IAM plugin rely on certain fields being
// present in the UserInfo.Extra field, so here we make sure to copy any extra
// field values from the authentication request into the extra field of the
// authorization review.
Extra: convertUserInfoExtra(req.UserInfo.Extra),
ResourceAttributes: &authorizationv1.ResourceAttributes{
Namespace: wrt.Namespace,
Verb: verb,
Expand Down
Loading