Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kubectl impersonation (e.g. kubectl --as) does not work through infra connector #1948

Open
BruceMacD opened this issue May 12, 2022 · 2 comments
Labels
area/destinations/kubernetes kind/bug A report or a fix for a problem with functional correctness. status/never-stale Indicates to actions/stale that the issue or PR should never be marked stale.

Comments

@BruceMacD
Copy link
Collaborator

Describe the bug

An impersonated user/group specified through kubectl commands is ignored and the command is run as the current user logged in to Infra.

# in this example, I am logged in to Infra as a user that has cluster-admin access to a cluster
# this command should fail, because the "unknown" user does not exist

kubectl create secret generic impersonation-test-secret --from-literal=super-secret=sEcReT --namespace infrahq --as=unknown
impersonation-test-secret created

# the command succeeds because it as run as the user logged into infra

Expected behavior

The command is run as the impersonated user if the user logged into Infra has the appropriate permissions to impersonate that user.

kubectl create secret generic impersonation-test-secret --from-literal=super-secret=sEcReT --namespace infrahq --as=unknown
error: failed to create secret secrets is forbidden: User "unknown" cannot create resource "secrets" in API group "" in the namespace "infrahq"

Environment

$ infra version
 Client: 0.12.2
 Server: 0.12.2
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.5", GitCommit:"5c99e2ac2ff9a3c549d9ca665e7bc05a3e18f07e", GitTreeState:"clean", BuildDate:"2021-12-16T08:38:33Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"darwin/arm64"}
Server Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.5", GitCommit:"5c99e2ac2ff9a3c549d9ca665e7bc05a3e18f07e", GitTreeState:"clean", BuildDate:"2021-12-16T08:32:32Z", GoVersion:"go1.16.12", Compiler:"gc", Platform:"linux/arm64"}

Additional context

Fixing this will require some changes to how the connector relays commands.

@BruceMacD BruceMacD added kind/bug A report or a fix for a problem with functional correctness. area/destinations/kubernetes labels May 12, 2022
@jmorganca jmorganca changed the title kubectl commands specifying user/group impersonation do not work through infra connector connector: kubectl commands specifying user/group impersonation do not work through infra connector May 30, 2022
@jmorganca jmorganca changed the title connector: kubectl commands specifying user/group impersonation do not work through infra connector kubectl commands specifying user/group impersonation do not work through infra connector May 30, 2022
@jmorganca jmorganca changed the title kubectl commands specifying user/group impersonation do not work through infra connector kubectl impersonation (e.g. kubectl --as) does not work through infra connector May 30, 2022
@github-actions
Copy link

This issue has not seen any activity in a while. Add a comment if this issue is still relevant,
otherwise it will be closed in 7 days.

@github-actions github-actions bot added the status/stale Used by actions/stale to mark an issue or PR as stale. label Jul 30, 2022
@github-actions
Copy link

github-actions bot commented Aug 7, 2022

This issue was closed because it is inactive.

@github-actions github-actions bot closed this as completed Aug 7, 2022
@jmorganca jmorganca reopened this Aug 8, 2022
@github-actions github-actions bot removed the status/stale Used by actions/stale to mark an issue or PR as stale. label Aug 9, 2022
@jmorganca jmorganca added the status/never-stale Indicates to actions/stale that the issue or PR should never be marked stale. label Sep 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/destinations/kubernetes kind/bug A report or a fix for a problem with functional correctness. status/never-stale Indicates to actions/stale that the issue or PR should never be marked stale.
Projects
None yet
Development

No branches or pull requests

2 participants