DecisionNoOpinion when denied field is missing

[sjanota]

Webhook authorizer checks denied field of SubjectAccessReviewStatus to make a decision if access is denied. According to SubjectAccessReviewStatus docs field denied is optional. On the other hand the same doc states that "If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action". It makes perfect sense when both fields are set, but when denied is missing bool's default value kicks in and the result is the same. This is example response from api server:

apiVersion: authorization.k8s.io/v1
kind: SubjectAccessReview
spec:
  user: admin@kyma.cx
  resourceAttributes:
    group: servicecatalog.k8s.io
    resource: serviceinstance
    verb: list
    namespace: stage
EOF
apiVersion: authorization.k8s.io/v1
kind: SubjectAccessReview
metadata:
  creationTimestamp: null
spec:
  resourceAttributes:
    group: servicecatalog.k8s.io
    namespace: stage
    resource: serviceinstance
    verb: list
  user: admin@kyma.cx
status:
  allowed: false

Status clearly states that access is denied, but webhook authorizer would return DecisionNoOpinion in this scenario. I'm using k8s version 1.10.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.