From 72e97b99604e6f77b601d1f1eaa9e62e5951a117 Mon Sep 17 00:00:00 2001
From: Dario Tranchitella <dario@tranchitella.eu>
Date: Mon, 21 Jun 2021 13:23:57 +0200
Subject: [PATCH] feat: providing utility for webhook auth identification

---
 pkg/webhook/utils/is_tenant_or_sa_request.go | 31 ++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 pkg/webhook/utils/is_tenant_or_sa_request.go

diff --git a/pkg/webhook/utils/is_tenant_or_sa_request.go b/pkg/webhook/utils/is_tenant_or_sa_request.go
new file mode 100644
index 00000000..de3a16ca
--- /dev/null
+++ b/pkg/webhook/utils/is_tenant_or_sa_request.go
@@ -0,0 +1,31 @@
+package utils
+
+import (
+	"strings"
+
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+	"github.com/clastix/capsule/pkg/utils"
+)
+
+func RequestFromOwnerOrSA(tenant v1alpha1.Tenant, req admission.Request, userGroups []string) bool {
+	switch {
+	case tenant.Spec.Owner.Kind == "User" && req.UserInfo.Username == tenant.Spec.Owner.Name:
+		return true
+	case tenant.Spec.Owner.Kind == "Group":
+		groupList := utils.NewUserGroupList(req.UserInfo.Groups)
+		for _, group := range userGroups {
+			if groupList.Find(group) {
+				return true
+			}
+		}
+	default:
+		for _, group := range req.UserInfo.Groups {
+			if len(req.Namespace) > 0 && strings.HasPrefix(group, "system:serviceaccounts:"+req.Namespace) {
+				return true
+			}
+		}
+	}
+	return false
+}