tls update will be possible with 'create' permissions on custom-host. Checks on changing host stay the same.
@@ -214,6 +214,28 @@ func (s routeStrategy) validateHostUpdate(ctx apirequest.Context, route, older *
if hostChanged {
return kvalidation.ValidateImmutableField(route.Spec.Host, older.Spec.Host, field.NewPath("spec", "host"))
}
+
+ // if tls is being updated without host being updated, we check if 'create' permission exists on custom-host subresource
+ res, err := s.sarClient.Create(
+ authorizationutil.AddUserToSAR(
+ user,
+ &authorizationapi.SubjectAccessReview{
+ Spec: authorizationapi.SubjectAccessReviewSpec{
+ ResourceAttributes: &authorizationapi.ResourceAttributes{
+ Namespace: apirequest.NamespaceValue(ctx),
+ Verb: "create",
+ Group: routeapi.GroupName,
+ Resource: "routes",
+ Subresource: "custom-host",
+ },
+ },
+ },
+ ),
+ )
+ if err != nil {
+ return field.ErrorList{field.InternalError(field.NewPath("spec", "host"), err)}
+ }
+ if !res.Status.Allowed {
if route.Spec.TLS == nil || older.Spec.TLS == nil {
return kvalidation.ValidateImmutableField(route.Spec.TLS, older.Spec.TLS, field.NewPath("spec", "tls"))
}
@@ -223,6 +245,7 @@ func (s routeStrategy) validateHostUpdate(ctx apirequest.Context, route, older *
errs = append(errs, kvalidation.ValidateImmutableField(route.Spec.TLS.Key, older.Spec.TLS.Key, field.NewPath("spec", "tls", "key"))...)
return errs
}
+ }
return nil
}
