github/kubevela
1
0
Fork 0
mirror of https://github.com/kubevela/kubevela.git synced 2026-08-27 16:17:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: grant privilege readonly incorrect binding (#3953)

Browse Source 
Signed-off-by: Somefive <yd219913@alibaba-inc.com>
This commit is contained in:
Somefive
2022-05-23 17:23:08 +08:00
committed by GitHub
parent ec0b12861b
commit 7976b32ba4
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/auth/privileges.go
+9 -7
View File
@@ -273,23 +273,25 @@ func (p *ScopedPrivilege) GetRoles() []client.Object {
// GetRoleBinding the underlying RoleBinding/ClusterRoleBinding for the privilege
func (p *ScopedPrivilege) GetRoleBinding(subs []rbacv1.Subject) client.Object {
var binding client.Object
var roleName string
if p.ReadOnly {
roleName = KubeVelaReaderRoleName
} else {
roleName = KubeVelaWriterRoleName
}
if p.Namespace == "" {
binding = &rbacv1.ClusterRoleBinding{
RoleRef: rbacv1.RoleRef{Kind: "ClusterRole", APIGroup: rbacv1.GroupName, Name: KubeVelaReaderRoleName},
RoleRef: rbacv1.RoleRef{Kind: "ClusterRole", APIGroup: rbacv1.GroupName, Name: roleName},
Subjects: subs,
}
} else {
binding = &rbacv1.RoleBinding{
RoleRef: rbacv1.RoleRef{Kind: "ClusterRole", APIGroup: rbacv1.GroupName, Name: KubeVelaWriterRoleName},
RoleRef: rbacv1.RoleRef{Kind: "ClusterRole", APIGroup: rbacv1.GroupName, Name: roleName},
Subjects: subs,
}
binding.SetNamespace(p.Namespace)
}
if p.ReadOnly {
binding.SetName(p.Prefix + KubeVelaReaderRoleName + ":binding")
} else {
binding.SetName(p.Prefix + KubeVelaWriterRoleName + ":binding")
}
binding.SetName(p.Prefix + roleName + ":binding")
return binding
}