Skip to content

Commit

Permalink
Merge pull request #18 from spreadshirt/feat/always-allow-usernames
Browse files Browse the repository at this point in the history
Add flag to always allow users by username
  • Loading branch information
ivangonzalezacuna authored Jun 27, 2023
2 parents 188d9ea + bdf92e6 commit 879b99b
Showing 1 changed file with 27 additions and 1 deletion.
28 changes: 27 additions & 1 deletion kube-request-access.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"net/http"
"os"
"path"
"strings"
"time"

"github.com/gorilla/handlers"
Expand Down Expand Up @@ -61,6 +62,7 @@ type admissionConfig struct {

grantedRoleName string
alwaysAllowedGroupNames []string
alwaysAllowedUserNames []string
usernamePrefix string

auditWebhookURL string
Expand Down Expand Up @@ -88,6 +90,7 @@ func main() {

cmd.Flags().StringVar(&cfg.grantedRoleName, "granted-role-name", "", "Name of the role that is given to a user temporarily when a request is granted")
cmd.Flags().StringSliceVar(&cfg.alwaysAllowedGroupNames, "always-allowed-group-name", nil, "Name of a group whose members will be allowed to execute commands without a request and grant")
cmd.Flags().StringSliceVar(&cfg.alwaysAllowedUserNames, "always-allowed-user-name", nil, "User name of a user who will be allowed to execute commands without a request and grant")
cmd.Flags().StringVar(&cfg.usernamePrefix, "username-prefix", "", "Prefix for usernames to use when verifying and granting access (optional)")

cmd.Flags().StringVar(&cfg.auditWebhookURL, "audit-webhook-url", "", "URL of the audit webhook to be used")
Expand Down Expand Up @@ -133,6 +136,13 @@ type admissionHandler struct {
// with stdin or tty set for interactive commands.
AlwaysAllowedGroupNames map[string]bool

// AlwaysAllowedUserNames can be set to always allow users with a given
// user name. They won't need to request or grant and will always be allowed.
//
// Additionally they won't have the regular restrictions applied, like exec
// with stdin or tty set for interactive commands.
AlwaysAllowedUserNames map[string]bool

// UsernamePrefix can be set to work with systems that add a prefix to the
// usernames in Kubernetes.
UsernamePrefix string
Expand Down Expand Up @@ -205,6 +215,13 @@ func (cfg *admissionConfig) run(_ *cobra.Command, _ []string) error {
}
}

if len(cfg.alwaysAllowedUserNames) > 0 {
handler.AlwaysAllowedUserNames = make(map[string]bool, len(cfg.alwaysAllowedUserNames))
for _, alwaysAllowedUser := range cfg.alwaysAllowedUserNames {
handler.AlwaysAllowedUserNames[alwaysAllowedUser] = true
}
}

router := mux.NewRouter()
router.HandleFunc("/ready", func(w http.ResponseWriter, req *http.Request) {
w.Write([]byte("ok"))
Expand Down Expand Up @@ -736,7 +753,7 @@ func (ah *admissionHandler) handleReview(ctx context.Context, admissionReview *a
}

func (ah *admissionHandler) isAlwaysAllowed(userInfo authenticationv1.UserInfo) bool {
if len(ah.AlwaysAllowedGroupNames) < 1 {
if len(ah.AlwaysAllowedGroupNames) < 1 && len(ah.AlwaysAllowedUserNames) < 1 {
return false
}

Expand All @@ -746,5 +763,14 @@ func (ah *admissionHandler) isAlwaysAllowed(userInfo authenticationv1.UserInfo)
}
}

username := userInfo.Username
if ah.UsernamePrefix != "" {
// if the usernamePrefix is set, let's remove it
username = strings.Replace(username, ah.UsernamePrefix, "", 1)
}
if _, found := ah.AlwaysAllowedUserNames[username]; found {
return true
}

return false
}

0 comments on commit 879b99b

Please sign in to comment.