Check pull access when tagging imagestreams #10109
Conversation
|
@smarterclayton, shouldn't we be checking pull access for an image stream layer, not just view access on the image stream object? @deads2k for scoped usage |
|
Haven't read through this, but to answer the question, if you can pull
IS "foo", you can pull any image tagged by it. Layers shouldn't
matter.
|
|
imagestreams/layers is what the registry checks before letting you pull that image stream |
|
[test] |
|
Hope this doesn't break too many people. Release note please? |
|
Agree with change (logically tag and pull/push are identical permissions), is there an easy test case to add? Does this have any implications for third party clients? |
|
Deployments can tag images in their hook so the deployer SA needs this
permission.
|
The only role we have that allows someone to get imagestreams but not pull is the
This check is only done when tagging from another namespace... no deployer SA will ever automatically have a permission in another namespace. |
| @@ -433,19 +432,18 @@ func (v *TagVerifier) Verify(old, stream *api.ImageStream, user user.Info) field | |||
| continue | |||
| } | |||
|
|
|||
| subjectAccessReview := authorizationapi.SubjectAccessReview{ | |||
| // Make sure this user can pull the specified image before allowing them to tag it into another imagestream | |||
| subjectAccessReview := authorizationapi.AddUserToSAR(user, &authorizationapi.SubjectAccessReview{ | |||
There was a problem hiding this comment.
AddUserToSAR usage is correct.
|
re[test] |
|
Evaluated for origin test up to 8115614 |
|
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/) |
|
[merge] |
|
Evaluated for origin merge up to 8115614 |
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/7350/) (Image: devenv-rhel7_4724) |
When tagging across namespaces, a user must have pull permission on the source image stream. This means they need
getaccess on theimagestreams/layersresource in the source namespace. Theadmin,edit, andsystem:image-pullerroles all grant this permission.