add test to ensure namespaced SAR and RAR return 404
@@ -12,6 +12,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
+ "k8s.io/apimachinery/pkg/runtime/serializer"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/wait"
@@ -1970,3 +1971,59 @@ func TestLegacyLocalRoleEndpoint(t *testing.T) {
t.Errorf("unexpected error: %v", err)
}
}
+
+func TestOldLocalAccessReviewEndpoints(t *testing.T) {
+ masterConfig, clusterAdminKubeConfig, err := testserver.StartTestMasterAPI()
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ defer testserver.CleanupMasterEtcd(t, masterConfig)
+
+ clusterAdminClientConfig, err := testutil.GetClusterAdminClientConfig(clusterAdminKubeConfig)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ clusterAdminAuthorizationClient := authorizationclient.NewForConfigOrDie(clusterAdminClientConfig).Authorization()
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+
+ namespace := "hammer-project"
+ if _, _, err := testserver.CreateNewProject(clusterAdminClientConfig, namespace, "harold"); err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+
+ // install the legacy types into the client for decoding
+ legacy.InstallLegacyAuthorization(authorizationclientscheme.Scheme)
+ codecFactory := serializer.NewCodecFactory(authorizationclientscheme.Scheme)
+
+ sar := &authorizationapi.SubjectAccessReview{
+ Action: authorizationapi.Action{
+ Verb: "get",
+ Resource: "imagestreams/layers",
+ },
+ }
+ sarBytes, err := runtime.Encode(codecFactory.LegacyCodec(schema.GroupVersion{Version: "v1"}), sar)
+ if err != nil {
+ t.Fatal(err)
+ }
+ err = clusterAdminAuthorizationClient.RESTClient().Post().AbsPath("/oapi/v1/namespaces/" + namespace + "/subjectaccessreviews").Body(sarBytes).Do().Into(&authorizationapi.SubjectAccessReviewResponse{})
+ if !kapierror.IsNotFound(err) {
+ t.Fatal(err)
+ }
+
+ rar := &authorizationapi.ResourceAccessReview{
+ Action: authorizationapi.Action{
+ Verb: "get",
+ Resource: "imagestreams/layers",
+ },
+ }
+ rarBytes, err := runtime.Encode(codecFactory.LegacyCodec(schema.GroupVersion{Version: "v1"}), rar)
+ if err != nil {
+ t.Fatal(err)
+ }
+ err = clusterAdminAuthorizationClient.RESTClient().Post().AbsPath("/oapi/v1/namespaces/" + namespace + "/resourceaccessreviews").Body(rarBytes).Do().Into(&authorizationapi.ResourceAccessReviewResponse{})
+ if !kapierror.IsNotFound(err) {
+ t.Fatal(err)
+ }
+}
