mirror of
https://github.com/projectcapsule/capsule.git
synced 2026-08-19 12:36:39 +00:00
cc4fb45d70
feat: upstream enterprise preview --------- Signed-off-by: Oliver Baehler <oliver@sudo-i.net> Co-authored-by: CorentinPtrl <pitrel.corentin@gmail.com>
32 lines
880 B
Go
32 lines
880 B
Go
// Copyright 2020-2026 Project Capsule Authors
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package users
|
|
|
|
import (
|
|
"k8s.io/apiserver/pkg/authentication/serviceaccount"
|
|
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
|
|
|
|
"github.com/projectcapsule/capsule/pkg/api/rbac"
|
|
"github.com/projectcapsule/capsule/pkg/runtime/configuration"
|
|
)
|
|
|
|
func IsAdminUser(req admission.Request, administrators rbac.UserListSpec) bool {
|
|
if IsControllerServiceAccount(req.UserInfo.Username) {
|
|
return true
|
|
}
|
|
|
|
return administrators.IsPresent(req.UserInfo.Username, req.UserInfo.Groups)
|
|
}
|
|
|
|
func IsControllerServiceAccount(username string) bool {
|
|
namespace, name, err := serviceaccount.SplitUsername(username)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
controllerName, controllerNamespace := configuration.ControllerServiceAccount()
|
|
|
|
return namespace == controllerNamespace && name == controllerName
|
|
}
|