for req without tenant, set as default: global
@@ -337,13 +337,28 @@ func (m *StandardClientManager) GetClientInfoFromContext(c echo.Context) (*Clien
clientInfo.Groups = []string{}
}
+ decideClientInfoTenant(&clientInfo, c)
+
+ m.SetImpersonation(&clientInfo, c.Request().Header.Get("Kalm-Impersonation"))
+ return &clientInfo, nil
+ }
+
+ return nil, errors.NewUnauthorized("")
+}
+
+func decideClientInfoTenant(clientInfo *ClientInfo, c echo.Context) {
+
if clientInfo.Tenants == nil {
clientInfo.Tenants = []string{}
}
switch len(clientInfo.Tenants) {
case 0:
- clientInfo.Tenant = ""
+ // if no tenant is specified, fallback to default tenant: global
+ // mainly used in local & BYOC mode
+ // tenant only indicates which cluster current user is trying to operate,
+ // whether this use has the permission to operator is controlled by RBAC rules.
+ clientInfo.Tenant = v1alpha1.DefaultGlobalTenantName
case 1:
parts := strings.Split(clientInfo.Tenants[0], "/")
@@ -394,12 +409,6 @@ func (m *StandardClientManager) GetClientInfoFromContext(c echo.Context) (*Clien
}
}
}
-
- m.SetImpersonation(&clientInfo, c.Request().Header.Get("Kalm-Impersonation"))
- return &clientInfo, nil
- }
-
- return nil, errors.NewUnauthorized("")
}
// Since the token is validated by api server, so we don't need to valid the token again here.
