Check cluster permission for create/update workspacetemplate #5302
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com>
ks-ci-bot
added
kind/feature
wansir
reviewed
Oct 20, 2022
|
/cherry-pick release-3.3 |
|
@zhou1203: once the present PR merges, I will cherry-pick it on top of release-3.3 in a new PR and assign it to you. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
zhou1203
changed the title
|
/lgtm |
|
LGTM label has been added. Git tree hash: 69fa49fa65f617169ea942a85e98f9aeb3467a66
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: wansir, zhou1203 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
ks-ci-bot
added
the
approved
|
@zhou1203: new pull request created: #5310 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
sologgfun
pushed a commit
to sologgfun/kubesphere
that referenced
this pull request
Apr 24, 2023
…ere#5302) * add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * add handle forbidden err * add forbidden error log * allow to use clusters of public visibility Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com>
wanjunlei
pushed a commit
to wanjunlei/kubesphere
that referenced
this pull request
Aug 11, 2023
…ere#5302) * add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * add handle forbidden err * add forbidden error log * allow to use clusters of public visibility Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com>
zhou1203
added a commit
to zhou1203/kubesphere
that referenced
this pull request
Jan 24, 2024
…#404) * Fix: Can not resolve the resource scope correctly (kubesphere#5263) Fix: can not resolve the resource scope of clusters.cluster.kubesphere.io correctly Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * Dependency: update storageClass-accessor (kubesphere#5271) Dependency: update storageClass-accessor to v0.2.2, deleting storage source no longer requires validation now. Signed-off-by: f10atin9 <f10atin9@kubesphere.io> Signed-off-by: f10atin9 <f10atin9@kubesphere.io> * fix kubesphere#5267 by renaming yaml struct tag (kubesphere#5268) Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> * support scoped nodes and workloads for global rules (kubesphere#5279) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * support route notifications to specified users (kubesphere#5206) Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> * refactor: move from io/ioutil to io and os packages (kubesphere#5266) The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. [1]: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com> * fix empty rules in rulegroup of prometheusrules (kubesphere#5298) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * Check the cluster ID (kube-system UID) when updating the cluster (kubesphere#5299) * Add an admission webhook to check cluster ID (kube-system UID) before updating * Add an admission webhook to check cluster ID (kube-system UID) before updating * Add switch for notification (kubesphere#5283) Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Co-authored-by: Gentleelephant <birdhk@kubesphere.io> * Use controller-gen to generate deepcopy code replacing deepcopy-gen. (kubesphere#5297) Use controller-gen to generate deepcopy code, and replace the deepcopy-gen tags with the kubebuilder tags. Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * optimize ks-core chart (kubesphere#5305) Signed-off-by: 24sama <jacksama@foxmail.com> Signed-off-by: 24sama <jacksama@foxmail.com> * Check cluster permission for create/update workspacetemplate (kubesphere#5302) * add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * add handle forbidden err * add forbidden error log * allow to use clusters of public visibility Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * fix global alerts filter (kubesphere#5311) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * support fieldselector filter query secrets (kubesphere#5300) * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * Fix: globalrole has cluster management right can not manage cluster (kubesphere#5331) Fix: globalrole has permision of cluster management can not manage cluster * update readme for cloud (kubesphere#5335) * update readme for cloud Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> * update readme for cloud Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * 3.3.1 CHANGELOG (kubesphere#5337) Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * Upgrade dependent version: github.com/open-policy-agent/opa (kubesphere#5315) Upgrade dependent version: github.com/open-policy-agent/opa v0.18.0 -> v0.45.0 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * Upgrade dependent version: github.com/containerd/containerd (kubesphere#5324) Upgrade dependent version: github.com/containerd/containerd v1.3.0 -> v1.4.13 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * fix rulegroup state filter (kubesphere#5340) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * update k8s versions (kubesphere#5345) Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * limit rule count per group (kubesphere#5350) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * fix rulegroup typemeta miss (kubesphere#5349) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * Calculating the Number of Logs in opensearch (kubesphere#5352) Calculating the Number of Logs Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Co-authored-by: chengdehao <dehaocheng@kubesphere.io> Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> Signed-off-by: f10atin9 <f10atin9@kubesphere.io> Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: 24sama <jacksama@foxmail.com> Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Co-authored-by: Wenhao Zhou <34303854+zhou1203@users.noreply.github.com> Co-authored-by: f10atin9 <f10atin9@kubesphere.io> Co-authored-by: chavacava <salvadorcavadini+github@gmail.com> Co-authored-by: junot <49136171+junotx@users.noreply.github.com> Co-authored-by: wanjunlei <53003665+wanjunlei@users.noreply.github.com> Co-authored-by: Eng Zer Jun <engzerjun@gmail.com> Co-authored-by: yuyu <yaozhenxiu@gmail.com> Co-authored-by: zhangpeng <1132960613@qq.com> Co-authored-by: Gentleelephant <birdhk@kubesphere.io> Co-authored-by: hongzhouzi <36416216+hongzhouzi@users.noreply.github.com> Co-authored-by: Leo Li <jacksama@foxmail.com> Co-authored-by: nuclearwu <wuzhongjian_yewu@cmss.chinamobile.com> Co-authored-by: Bettygogo2021 <91529409+Bettygogo2021@users.noreply.github.com> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Elon Cheng <dehaocheng@yunify.com> Co-authored-by: chengdehao <dehaocheng@kubesphere.io>
zhou1203
added a commit
to zhou1203/kubesphere
that referenced
this pull request
Jan 24, 2024
…#445) * Fix: Can not resolve the resource scope correctly (kubesphere#5263) Fix: can not resolve the resource scope of clusters.cluster.kubesphere.io correctly Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * Dependency: update storageClass-accessor (kubesphere#5271) Dependency: update storageClass-accessor to v0.2.2, deleting storage source no longer requires validation now. Signed-off-by: f10atin9 <f10atin9@kubesphere.io> Signed-off-by: f10atin9 <f10atin9@kubesphere.io> * fix kubesphere#5267 by renaming yaml struct tag (kubesphere#5268) Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> * support scoped nodes and workloads for global rules (kubesphere#5279) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * support route notifications to specified users (kubesphere#5206) Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> * refactor: move from io/ioutil to io and os packages (kubesphere#5266) The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. [1]: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com> * fix empty rules in rulegroup of prometheusrules (kubesphere#5298) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * Check the cluster ID (kube-system UID) when updating the cluster (kubesphere#5299) * Add an admission webhook to check cluster ID (kube-system UID) before updating * Add an admission webhook to check cluster ID (kube-system UID) before updating * Add switch for notification (kubesphere#5283) Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Co-authored-by: Gentleelephant <birdhk@kubesphere.io> * Use controller-gen to generate deepcopy code replacing deepcopy-gen. (kubesphere#5297) Use controller-gen to generate deepcopy code, and replace the deepcopy-gen tags with the kubebuilder tags. Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * optimize ks-core chart (kubesphere#5305) Signed-off-by: 24sama <jacksama@foxmail.com> Signed-off-by: 24sama <jacksama@foxmail.com> * Check cluster permission for create/update workspacetemplate (kubesphere#5302) * add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> add cluster authorization for create/update workspacetemplate Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * add handle forbidden err * add forbidden error log * allow to use clusters of public visibility Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * fix global alerts filter (kubesphere#5311) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * support fieldselector filter query secrets (kubesphere#5300) * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * support fieldselector filter query secrets Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * Fix: globalrole has cluster management right can not manage cluster (kubesphere#5331) Fix: globalrole has permision of cluster management can not manage cluster * update readme for cloud (kubesphere#5335) * update readme for cloud Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> * update readme for cloud Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * 3.3.1 CHANGELOG (kubesphere#5337) Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * Upgrade dependent version: github.com/open-policy-agent/opa (kubesphere#5315) Upgrade dependent version: github.com/open-policy-agent/opa v0.18.0 -> v0.45.0 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * Upgrade dependent version: github.com/containerd/containerd (kubesphere#5324) Upgrade dependent version: github.com/containerd/containerd v1.3.0 -> v1.4.13 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * fix rulegroup state filter (kubesphere#5340) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * update k8s versions (kubesphere#5345) Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * limit rule count per group (kubesphere#5350) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * fix rulegroup typemeta miss (kubesphere#5349) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * Calculating the Number of Logs in opensearch (kubesphere#5352) Calculating the Number of Logs Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Co-authored-by: chengdehao <dehaocheng@kubesphere.io> * add label_matcher param to filter alerts (kubesphere#5353) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * update k8s versions (kubesphere#5351) Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> * Fix:Goroutine leaks when getting audit event sender times out (kubesphere#5342) * Fix:Goroutine leaks when getting audit event sender times out * make it more readable * Add GitHub action for release drafter * Upgrade k8s package verison (kubesphere#5358) * upgrade k8s package version Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * Script upgrade and code formatting. Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * Fix: remove unnecessary case in field selector (kubesphere#5367) Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> * Upgrade dependent version: github.com/opencontainers/runc (kubesphere#5316) Upgrade dependent version: github.com/opencontainers/runc v0.1.1 -> v1.1.4 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> * fix rule status (kubesphere#5381) Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: junot <junotxiang@kubesphere.io> * Remove the VolumeSnapshot controller that creates a snapshot class automatically (kubesphere#5380) Signed-off-by: dkeven <dkvvven@gmail.com> Signed-off-by: dkeven <dkvvven@gmail.com> * Add api /version and deprecated api /kapi/version (kubesphere#5390) add /version api and deprecated api /kapi/version Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> * Upgrade dependent version: go.mongodb.org/mongo-driver (kubesphere#5320) Upgrade dependent version: go.mongodb.org/mongo-driver v1.3.2 -> v1.10.4 Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: Wenhao Zhou <wenhaozhou@yunify.com> Signed-off-by: f10atin9 <f10atin9@kubesphere.io> Signed-off-by: chavacava <salvadorcavadini+github@gmail.com> Signed-off-by: junot <junotxiang@kubesphere.io> Signed-off-by: wanjunlei <wanjunlei@kubesphere.io> Signed-off-by: Gentleelephant <birdhk@kubesphere.io> Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io> Signed-off-by: 24sama <jacksama@foxmail.com> Signed-off-by: wuzhongjian <wuzhongjian_yewu@cmss.chinamobile.com> Signed-off-by: Bettygogo2021 <bettygogo@kubesphere.io> Signed-off-by: chengdehao <dehaocheng@kubesphere.io> Signed-off-by: dkeven <dkvvven@gmail.com> Co-authored-by: Wenhao Zhou <34303854+zhou1203@users.noreply.github.com> Co-authored-by: f10atin9 <f10atin9@kubesphere.io> Co-authored-by: chavacava <salvadorcavadini+github@gmail.com> Co-authored-by: junot <49136171+junotx@users.noreply.github.com> Co-authored-by: wanjunlei <53003665+wanjunlei@users.noreply.github.com> Co-authored-by: Eng Zer Jun <engzerjun@gmail.com> Co-authored-by: yuyu <yaozhenxiu@gmail.com> Co-authored-by: zhangpeng <1132960613@qq.com> Co-authored-by: Gentleelephant <birdhk@kubesphere.io> Co-authored-by: hongzhouzi <36416216+hongzhouzi@users.noreply.github.com> Co-authored-by: Leo Li <jacksama@foxmail.com> Co-authored-by: nuclearwu <wuzhongjian_yewu@cmss.chinamobile.com> Co-authored-by: Bettygogo2021 <91529409+Bettygogo2021@users.noreply.github.com> Co-authored-by: Bettygogo2021 <bettygogo@kubesphere.io> Co-authored-by: Elon Cheng <dehaocheng@yunify.com> Co-authored-by: chengdehao <dehaocheng@kubesphere.io> Co-authored-by: hzhhong <hung.z.h916@gmail.com> Co-authored-by: pixiake <guofeng@kubesphere.io> Co-authored-by: dkeven <82354774+dkeven@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Wenhao Zhou wenhaozhou@yunify.com
add cluster authorization for create/update workspacetemplate
What type of PR is this?
/kind feature
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #5301
Special notes for reviewers:
Does this PR introduced a user-facing change?
Additional documentation, usage docs, etc.: