Fix: CloudShell read-only authorization is not automatically revoked #4495
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
barnettZQG
added
the
backport release-1.5
barnettZQG
requested review from
yangsoon,
FogDong,
wonderflow,
leejanee,
Somefive and
jefree-cat
as code owners
Codecov Report
@@ Coverage Diff @@
## master #4495 +/- ##
==========================================
- Coverage 61.50% 61.50% -0.01%
==========================================
Files 348 348
Lines 34510 34554 +44
==========================================
+ Hits 21227 21253 +26
- Misses 10520 10543 +23
+ Partials 2763 2758 -5
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
wonderflow
reviewed
Jul 28, 2022
| @@ -61,6 +61,14 @@ func (c *CloudShellAPIInterface) GetWebServiceRoute() *restful.WebService { | |||
| Returns(400, "Bad Request", bcode.Bcode{}). | |||
| Writes(apis.CloudShellPrepareResponse{}).Do(returns200, returns500)) | |||
|
|
|||
| ws.Route(ws.DELETE("/").To(c.destroyCloudShell). | |||
There was a problem hiding this comment.
who will invoke this API to detroy？
There was a problem hiding this comment.
Users could destroy the cloud shell environment and recreate it, this could get the new permissions.
wonderflow
reviewed
Jul 28, 2022
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
wonderflow
approved these changes
Jul 29, 2022
yangsoon
approved these changes
Jul 29, 2022
|
Successfully created backport PR #4503 for |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: barnettZQG barnett.zqg@gmail.com
Description of your changes
The role is only bound to the group, the user is bound to the group and gets permissions. the relationship between the user and the group save to the cert in the Kube config, which will be updated before the cloud shell environment is created.
Fixes #4489
I have:
make reviewableto ensure this PR is ready for review.backport release-x.ylabels to auto-backport this PR if necessary.Special notes for your reviewer
/cc @wonderflow