github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

make rbac authorizer use rule comparison, not covers

Browse Source
This commit is contained in:
deads2k
2016-09-15 15:35:11 -04:00
parent 9bc7e36f4b
commit 1943d256d2
5 changed files with 214 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/apis/rbac/validation/policy_comparator.go
View File

@@ -131,7 +131,6 @@ func nonResourceURLCovers(ownerPath, subPath string) bool {
// ruleCovers determines whether the ownerRule (which may have multiple verbs, resources, and resourceNames) covers
// the subrule (which may only contain at most one verb, resource, and resourceName)
func ruleCovers(ownerRule, subRule rbac.PolicyRule) bool {
verbMatches := has(ownerRule.Verbs, rbac.VerbAll) || hasAll(ownerRule.Verbs, subRule.Verbs)
groupMatches := has(ownerRule.APIGroups, rbac.APIGroupAll) || hasAll(ownerRule.APIGroups, subRule.APIGroups)
resourceMatches := has(ownerRule.Resources, rbac.ResourceAll) || hasAll(ownerRule.Resources, subRule.Resources)