Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upCheck pull access when tagging imagestreams #10109
Conversation
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
liggitt
Jul 29, 2016
Contributor
@smarterclayton, shouldn't we be checking pull access for an image stream layer, not just view access on the image stream object?
@deads2k for scoped usage
|
@smarterclayton, shouldn't we be checking pull access for an image stream layer, not just view access on the image stream object? @deads2k for scoped usage |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
smarterclayton
Jul 30, 2016
Member
|
Haven't read through this, but to answer the question, if you can pull
IS "foo", you can pull any image tagged by it. Layers shouldn't
matter.
|
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
liggitt
Jul 30, 2016
Contributor
imagestreams/layers is what the registry checks before letting you pull that image stream
|
imagestreams/layers is what the registry checks before letting you pull that image stream |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
|
[test] |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
|
Hope this doesn't break too many people. Release note please? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
smarterclayton
Jul 31, 2016
Member
Agree with change (logically tag and pull/push are identical permissions), is there an easy test case to add?
Does this have any implications for third party clients?
|
Agree with change (logically tag and pull/push are identical permissions), is there an easy test case to add? Does this have any implications for third party clients? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
smarterclayton
Jul 31, 2016
Member
|
Deployments can tag images in their hook so the deployer SA needs this
permission.
|
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
liggitt
Jul 31, 2016
Contributor
Hope this doesn't break too many people. Release note please?
The only role we have that allows someone to get imagestreams but not pull is the view role. Remind me where we're collecting release notes again?
Deployments can tag images in their hook so the deployer SA needs this permission.
This check is only done when tagging from another namespace... no deployer SA will ever automatically have a permission in another namespace.
The only role we have that allows someone to get imagestreams but not pull is the
This check is only done when tagging from another namespace... no deployer SA will ever automatically have a permission in another namespace. |
deads2k
reviewed
Aug 1, 2016
| @@ -433,19 +432,18 @@ func (v *TagVerifier) Verify(old, stream *api.ImageStream, user user.Info) field | ||
| continue | ||
| } | ||
| subjectAccessReview := authorizationapi.SubjectAccessReview{ | ||
| // Make sure this user can pull the specified image before allowing them to tag it into another imagestream | ||
| subjectAccessReview := authorizationapi.AddUserToSAR(user, &authorizationapi.SubjectAccessReview{ |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
|
re[test] |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
openshift-bot
commented
Aug 2, 2016
|
Evaluated for origin test up to 8115614 |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
openshift-bot
Aug 2, 2016
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/)
openshift-bot
commented
Aug 2, 2016
|
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/) |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
|
[merge] |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
openshift-bot
commented
Aug 2, 2016
|
Evaluated for origin merge up to 8115614 |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
openshift-bot
Aug 2, 2016
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/) (Image: devenv-rhel7_4724)
openshift-bot
commented
Aug 2, 2016
•
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/) (Image: devenv-rhel7_4724) |
liggitt commentedJul 29, 2016
•
edited
When tagging across namespaces, a user must have pull permission on the source image stream. This means they need
getaccess on theimagestreams/layersresource in the source namespace. Theadmin,edit, andsystem:image-pullerroles all grant this permission.