Skip to content

Commit de1319e

Browse files
deads2kdeads2k
committed
add user options to can-i
1 parent bc0f360 commit de1319e

File tree

8 files changed

+92
-28
lines changed

8 files changed

+92
-28
lines changed

‎contrib/completions/bash/oc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10712,6 +10712,8 @@ _oc_policy_can-i()
1071210712

1071310713
flags+=("--all-namespaces")
1071410714
local_nonpersistent_flags+=("--all-namespaces")
10715+
flags+=("--groups=")
10716+
local_nonpersistent_flags+=("--groups=")
1071510717
flags+=("--ignore-scopes")
1071610718
local_nonpersistent_flags+=("--ignore-scopes")
1071710719
flags+=("--list")
@@ -10721,6 +10723,8 @@ _oc_policy_can-i()
1072110723
local_nonpersistent_flags+=("--quiet")
1072210724
flags+=("--scopes=")
1072310725
local_nonpersistent_flags+=("--scopes=")
10726+
flags+=("--user=")
10727+
local_nonpersistent_flags+=("--user=")
1072410728
flags+=("--as=")
1072510729
flags+=("--certificate-authority=")
1072610730
flags_with_completion+=("--certificate-authority")
@@ -10745,7 +10749,6 @@ _oc_policy_can-i()
1074510749
two_word_flags+=("-n")
1074610750
flags+=("--server=")
1074710751
flags+=("--token=")
10748-
flags+=("--user=")
1074910752

1075010753
must_have_one_flag=()
1075110754
must_have_one_noun=()

‎contrib/completions/bash/openshift

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15258,6 +15258,8 @@ _openshift_cli_policy_can-i()
1525815258

1525915259
flags+=("--all-namespaces")
1526015260
local_nonpersistent_flags+=("--all-namespaces")
15261+
flags+=("--groups=")
15262+
local_nonpersistent_flags+=("--groups=")
1526115263
flags+=("--ignore-scopes")
1526215264
local_nonpersistent_flags+=("--ignore-scopes")
1526315265
flags+=("--list")
@@ -15267,6 +15269,8 @@ _openshift_cli_policy_can-i()
1526715269
local_nonpersistent_flags+=("--quiet")
1526815270
flags+=("--scopes=")
1526915271
local_nonpersistent_flags+=("--scopes=")
15272+
flags+=("--user=")
15273+
local_nonpersistent_flags+=("--user=")
1527015274
flags+=("--as=")
1527115275
flags+=("--certificate-authority=")
1527215276
flags_with_completion+=("--certificate-authority")
@@ -15292,7 +15296,6 @@ _openshift_cli_policy_can-i()
1529215296
two_word_flags+=("-n")
1529315297
flags+=("--server=")
1529415298
flags+=("--token=")
15295-
flags+=("--user=")
1529615299

1529715300
must_have_one_flag=()
1529815301
must_have_one_noun=()

‎contrib/completions/zsh/oc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10873,6 +10873,8 @@ _oc_policy_can-i()
1087310873

1087410874
flags+=("--all-namespaces")
1087510875
local_nonpersistent_flags+=("--all-namespaces")
10876+
flags+=("--groups=")
10877+
local_nonpersistent_flags+=("--groups=")
1087610878
flags+=("--ignore-scopes")
1087710879
local_nonpersistent_flags+=("--ignore-scopes")
1087810880
flags+=("--list")
@@ -10882,6 +10884,8 @@ _oc_policy_can-i()
1088210884
local_nonpersistent_flags+=("--quiet")
1088310885
flags+=("--scopes=")
1088410886
local_nonpersistent_flags+=("--scopes=")
10887+
flags+=("--user=")
10888+
local_nonpersistent_flags+=("--user=")
1088510889
flags+=("--as=")
1088610890
flags+=("--certificate-authority=")
1088710891
flags_with_completion+=("--certificate-authority")
@@ -10906,7 +10910,6 @@ _oc_policy_can-i()
1090610910
two_word_flags+=("-n")
1090710911
flags+=("--server=")
1090810912
flags+=("--token=")
10909-
flags+=("--user=")
1091010913

1091110914
must_have_one_flag=()
1091210915
must_have_one_noun=()

‎contrib/completions/zsh/openshift

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15419,6 +15419,8 @@ _openshift_cli_policy_can-i()
1541915419

1542015420
flags+=("--all-namespaces")
1542115421
local_nonpersistent_flags+=("--all-namespaces")
15422+
flags+=("--groups=")
15423+
local_nonpersistent_flags+=("--groups=")
1542215424
flags+=("--ignore-scopes")
1542315425
local_nonpersistent_flags+=("--ignore-scopes")
1542415426
flags+=("--list")
@@ -15428,6 +15430,8 @@ _openshift_cli_policy_can-i()
1542815430
local_nonpersistent_flags+=("--quiet")
1542915431
flags+=("--scopes=")
1543015432
local_nonpersistent_flags+=("--scopes=")
15433+
flags+=("--user=")
15434+
local_nonpersistent_flags+=("--user=")
1543115435
flags+=("--as=")
1543215436
flags+=("--certificate-authority=")
1543315437
flags_with_completion+=("--certificate-authority")
@@ -15453,7 +15457,6 @@ _openshift_cli_policy_can-i()
1545315457
two_word_flags+=("-n")
1545415458
flags+=("--server=")
1545515459
flags+=("--token=")
15456-
flags+=("--user=")
1545715460

1545815461
must_have_one_flag=()
1545915462
must_have_one_noun=()

‎docs/man/man1/oc-policy-can-i.1

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ Check whether an action is allowed
2121
\fB\-\-all\-namespaces\fP=false
2222
Check the specified action in all namespaces.
2323

24+
.PP
25+
\fB\-\-groups\fP=[]
26+
Check the specified action using these groups instead of your groups.
27+
2428
.PP
2529
\fB\-\-ignore\-scopes\fP=false
2630
Disregard any scopes present on this request and evaluate considering full permissions.
@@ -37,6 +41,10 @@ Check whether an action is allowed
3741
\fB\-\-scopes\fP=[]
3842
Check the specified action using these scopes. By default, the scopes on the current token will be used.
3943

44+
.PP
45+
\fB\-\-user\fP=""
46+
Check the specified action using this user instead of your user.
47+
4048

4149
.SH OPTIONS INHERITED FROM PARENT COMMANDS
4250
.PP
@@ -99,10 +107,6 @@ Check whether an action is allowed
99107
\fB\-\-token\fP=""
100108
Bearer token for authentication to the API server
101109

102-
.PP
103-
\fB\-\-user\fP=""
104-
The name of the kubeconfig user to use
105-
106110

107111
.SH SEE ALSO
108112
.PP

‎docs/man/man1/openshift-cli-policy-can-i.1

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ Check whether an action is allowed
2121
\fB\-\-all\-namespaces\fP=false
2222
Check the specified action in all namespaces.
2323

24+
.PP
25+
\fB\-\-groups\fP=[]
26+
Check the specified action using these groups instead of your groups.
27+
2428
.PP
2529
\fB\-\-ignore\-scopes\fP=false
2630
Disregard any scopes present on this request and evaluate considering full permissions.
@@ -37,6 +41,10 @@ Check whether an action is allowed
3741
\fB\-\-scopes\fP=[]
3842
Check the specified action using these scopes. By default, the scopes on the current token will be used.
3943

44+
.PP
45+
\fB\-\-user\fP=""
46+
Check the specified action using this user instead of your user.
47+
4048

4149
.SH OPTIONS INHERITED FROM PARENT COMMANDS
4250
.PP
@@ -99,10 +107,6 @@ Check whether an action is allowed
99107
\fB\-\-token\fP=""
100108
Bearer token for authentication to the API server
101109

102-
.PP
103-
\fB\-\-user\fP=""
104-
The name of the kubeconfig user to use
105-
106110

107111
.SH SEE ALSO
108112
.PP

‎pkg/cmd/admin/policy/cani.go

Lines changed: 46 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
kapi "k8s.io/kubernetes/pkg/api"
1515
"k8s.io/kubernetes/pkg/api/unversioned"
1616
kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
17+
"k8s.io/kubernetes/pkg/util/sets"
1718

1819
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
1920
"github.com/openshift/origin/pkg/client"
@@ -24,14 +25,17 @@ import (
2425
const CanIRecommendedName = "can-i"
2526

2627
type canIOptions struct {
27-
AllNamespaces bool
28-
ListAll bool
29-
Quiet bool
30-
IgnoreScopes bool
31-
Scopes []string
32-
Namespace string
33-
RulesReviewClient client.SelfSubjectRulesReviewsNamespacer
34-
SARClient client.SubjectAccessReviews
28+
AllNamespaces bool
29+
ListAll bool
30+
Quiet bool
31+
IgnoreScopes bool
32+
User string
33+
Groups []string
34+
Scopes []string
35+
Namespace string
36+
SelfRulesReviewClient client.SelfSubjectRulesReviewsNamespacer
37+
RulesReviewClient client.SubjectRulesReviewsNamespacer
38+
SARClient client.SubjectAccessReviews
3539

3640
Verb string
3741
Resource unversioned.GroupVersionResource
@@ -72,6 +76,8 @@ func NewCmdCanI(name, fullName string, f *clientcmd.Factory, out io.Writer) *cob
7276
cmd.Flags().BoolVarP(&o.Quiet, "quiet", "q", o.Quiet, "Suppress output and just return the exit code.")
7377
cmd.Flags().BoolVar(&o.IgnoreScopes, "ignore-scopes", o.IgnoreScopes, "Disregard any scopes present on this request and evaluate considering full permissions.")
7478
cmd.Flags().StringSliceVar(&o.Scopes, "scopes", o.Scopes, "Check the specified action using these scopes. By default, the scopes on the current token will be used.")
79+
cmd.Flags().StringVar(&o.User, "user", o.User, "Check the specified action using this user instead of your user.")
80+
cmd.Flags().StringSliceVar(&o.Groups, "groups", o.Groups, "Check the specified action using these groups instead of your groups.")
7581

7682
return cmd
7783
}
@@ -115,6 +121,7 @@ func (o *canIOptions) Complete(f *clientcmd.Factory, args []string) error {
115121
if err != nil {
116122
return err
117123
}
124+
o.SelfRulesReviewClient = oclient
118125
o.RulesReviewClient = oclient
119126
o.SARClient = oclient
120127

@@ -146,6 +153,8 @@ func (o *canIOptions) Run() (bool, error) {
146153
Resource: o.Resource.Resource,
147154
ResourceName: o.ResourceName,
148155
},
156+
User: o.User,
157+
Groups: sets.NewString(o.Groups...),
149158
}
150159
if o.IgnoreScopes {
151160
sar.Scopes = []string{}
@@ -173,19 +182,40 @@ func (o *canIOptions) Run() (bool, error) {
173182
}
174183

175184
func (o *canIOptions) listAllPermissions() error {
176-
rulesReview := &authorizationapi.SelfSubjectRulesReview{}
177-
if len(o.Scopes) > 0 {
178-
rulesReview.Spec.Scopes = o.Scopes
179-
}
185+
var rulesReviewStatus authorizationapi.SubjectRulesReviewStatus
186+
187+
if len(o.User) == 0 && len(o.Groups) == 0 {
188+
rulesReview := &authorizationapi.SelfSubjectRulesReview{}
189+
if len(o.Scopes) > 0 {
190+
rulesReview.Spec.Scopes = o.Scopes
191+
}
192+
193+
whatCanIDo, err := o.SelfRulesReviewClient.SelfSubjectRulesReviews(o.Namespace).Create(rulesReview)
194+
if err != nil {
195+
return err
196+
}
197+
rulesReviewStatus = whatCanIDo.Status
198+
199+
} else {
200+
rulesReview := &authorizationapi.SubjectRulesReview{
201+
Spec: authorizationapi.SubjectRulesReviewSpec{
202+
User: o.User,
203+
Groups: o.Groups,
204+
Scopes: o.Scopes,
205+
},
206+
}
207+
208+
whatCanYouDo, err := o.RulesReviewClient.SubjectRulesReviews(o.Namespace).Create(rulesReview)
209+
if err != nil {
210+
return err
211+
}
212+
rulesReviewStatus = whatCanYouDo.Status
180213

181-
whatCanIDo, err := o.RulesReviewClient.SelfSubjectRulesReviews(o.Namespace).Create(rulesReview)
182-
if err != nil {
183-
return err
184214
}
185215

186216
writer := tabwriter.NewWriter(o.Out, tabwriterMinWidth, tabwriterWidth, tabwriterPadding, tabwriterPadChar, tabwriterFlags)
187217
fmt.Fprint(writer, describe.PolicyRuleHeadings+"\n")
188-
for _, rule := range whatCanIDo.Status.Rules {
218+
for _, rule := range rulesReviewStatus.Rules {
189219
describe.DescribePolicyRule(writer, rule, "")
190220

191221
}

‎test/cmd/policy.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,22 @@ os::cmd::expect_success_and_text 'oc policy can-i --list' 'get update.*imagestre
8080
os::cmd::expect_success_and_text 'oc policy can-i create pods --all-namespaces' 'yes'
8181
os::cmd::expect_success_and_text 'oc policy can-i create pods' 'yes'
8282
os::cmd::expect_success_and_text 'oc policy can-i create pods --as harold' 'no'
83+
os::cmd::expect_failure 'oc policy can-i create pods --as harold --user harold'
84+
os::cmd::expect_failure 'oc policy can-i --list --as harold --user harold'
8385
os::cmd::expect_failure 'oc policy can-i create pods --as harold -q'
8486

87+
os::cmd::expect_success_and_text 'oc policy can-i create pods --user system:admin' 'yes'
88+
os::cmd::expect_success_and_text 'oc policy can-i create pods --groups system:unauthenticated --groups system:masters' 'yes'
89+
os::cmd::expect_success_and_text 'oc policy can-i create pods --groups system:unauthenticated' 'no'
90+
os::cmd::expect_success_and_text 'oc policy can-i create pods --user harold' 'no'
91+
92+
os::cmd::expect_success_and_text 'oc policy can-i --list --user system:admin' 'get update.*imagestreams/layers'
93+
os::cmd::expect_success_and_text 'oc policy can-i --list --groups system:unauthenticated --groups system:cluster-readers' 'get.*imagestreams/layers'
94+
os::cmd::expect_success_and_not_text 'oc policy can-i --list --groups system:unauthenticated' 'get update.*imagestreams/layers'
95+
os::cmd::expect_success_and_not_text 'oc policy can-i --list --user harold --groups system:authenticated' 'get update.*imagestreams/layers'
96+
os::cmd::expect_success_and_text 'oc policy can-i --list --user harold --groups system:authenticated' 'create get.*buildconfigs/webhooks'
97+
98+
8599

86100
# adjust the cluster-admin role to check defaulting and coverage checks
87101
# this is done here instead of an integration test because we need to make sure the actual yaml serializations work

0 commit comments

Comments
 (0)