github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: correct tenant ownerships resolution with deduplicaiton (#2059)

Browse Source 
* chore

* perfromance improvements

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* perfromance improvements

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat(performance): removed duplicate client calls from all admission paths

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: correct tenant ownerships resolution with deduplicaiton

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-07-28 19:30:00 +02:00
committed by GitHub
parent 2252c530f4
commit 613b43aa21
5 changed files with 598 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tenant/get_by.go
+20 -4
View File
@@ -178,7 +178,23 @@ func GetTenantByUserInfo(
ns *corev1.Namespace,
user users.AdmissionUser,
) (sortedTenants, error) {
var tenants sortedTenants
tenants := make(sortedTenants, 0)
seen := make(map[string]struct{})
// A requester can match the same Tenant through multiple owner identities
// (for example, both directly and through one or more groups).
appendUnique := func(items []capsulev1beta2.Tenant) {
for i := range items {
name := items[i].GetName()
if _, ok := seen[name]; ok {
continue
}
seen[name] = struct{}{}
tenants = append(tenants, items[i])
}
}
// User tenants.
userTntList := &capsulev1beta2.TenantList{}
@@ -191,7 +207,7 @@ func GetTenantByUserInfo(
return nil, err
}
tenants = userTntList.Items
appendUnique(userTntList.Items)
// ServiceAccount tenants.
if strings.HasPrefix(user.Username, "system:serviceaccount:") {
@@ -205,7 +221,7 @@ func GetTenantByUserInfo(
return nil, err
}
tenants = append(tenants, saTntList.Items...)
appendUnique(saTntList.Items)
}
// Group tenants.
@@ -221,7 +237,7 @@ func GetTenantByUserInfo(
return nil, err
}
tenants = append(tenants, groupTntList.Items...)
appendUnique(groupTntList.Items)
}
sort.Sort(sort.Reverse(tenants))
pkg/tenant/get_by_test.go
+7 -2
View File
@@ -158,6 +158,11 @@ func TestGetTenantByUserInfo(t *testing.T) {
tenantObject("short", withSpecOwner(rbac.UserOwner, "alice")),
tenantObject("very-long-name", withSpecOwner(rbac.GroupOwner, "developers")),
tenantObject("service", withSpecOwner(rbac.ServiceAccountOwner, users.ServiceAccountUsername("tenant-a", "builder"))),
tenantObject(
"shared",
withSpecOwner(rbac.ServiceAccountOwner, users.ServiceAccountUsername("tenant-a", "builder")),
withSpecOwner(rbac.GroupOwner, "developers"),
),
)
got, err := tenant.GetTenantByUserInfo(ctx, cl, nil, nil, users.AdmissionUser{
@@ -173,8 +178,8 @@ func TestGetTenantByUserInfo(t *testing.T) {
names = append(names, tnt.Name)
}
if !reflect.DeepEqual(names, []string{"very-long-name", "service"}) {
t.Fatalf("GetTenantByUserInfo() names = %#v, want sorted matching tenants", names)
if !reflect.DeepEqual(names, []string{"very-long-name", "service", "shared"}) {
t.Fatalf("GetTenantByUserInfo() names = %#v, want unique sorted matching tenants", names)
}
}