Skip to content

Commit

Permalink
Cascading Service Account Deletion (#142)
Browse files Browse the repository at this point in the history
We need to remove any reference to a service account on deletion, so if
it's recreated it doesn't instantly get privilege escallation.  Plus it
keeps things nice and tidy.
  • Loading branch information
spjmurray authored Jan 9, 2025
1 parent 0ead13b commit 7a8838d
Showing 1 changed file with 24 additions and 0 deletions.
24 changes: 24 additions & 0 deletions pkg/handler/serviceaccounts/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ package serviceaccounts

import (
"context"
"slices"
"time"

"github.com/spf13/pflag"
Expand Down Expand Up @@ -307,6 +308,29 @@ func (c *Client) Delete(ctx context.Context, organizationID, serviceAccountID st
return errors.OAuth2ServerError("failed to get service account for delete").WithError(err)
}

// Unlink the service account from any groups that reference it.
groups := &unikornv1.GroupList{}

if err := c.client.List(ctx, groups, &client.ListOptions{Namespace: organization.Namespace}); err != nil {
return errors.OAuth2ServerError("failed to list organization groups").WithError(err)
}

groups.Items = slices.DeleteFunc(groups.Items, func(group unikornv1.Group) bool {
return !slices.Contains(group.Spec.Users, resource.Labels[constants.NameLabel])
})

for i := range groups.Items {
group := &groups.Items[i]

group.Spec.Users = slices.DeleteFunc(group.Spec.Users, func(name string) bool {
return name == resource.Labels[constants.NameLabel]
})

if err := c.client.Update(ctx, group); err != nil {
return errors.OAuth2ServerError("failed to remove service account from group").WithError(err)
}
}

if err := c.client.Delete(ctx, resource); err != nil {
if kerrors.IsNotFound(err) {
return errors.HTTPNotFound().WithError(err)
Expand Down

0 comments on commit 7a8838d

Please sign in to comment.