From c805952b40f3bd3356728b5110eb91e8d7863f77 Mon Sep 17 00:00:00 2001 From: Jian Qiu Date: Fri, 4 Sep 2026 09:18:52 +0800 Subject: [PATCH] fix(webconsole): fetch kubeconfig with user session for k8s shell (#25484) The k8s shell/log endpoints fetched the target cluster kubeconfig with the admin session, bypassing RBAC and owner scope checks, so any authenticated user could exec into pods and read logs of any registered cluster. Fetch the kubeconfig with the user's own session instead, so policy checks and owner filtering apply, and command records are attributed to the real user. Co-authored-by: Qiu Jian Co-authored-by: Claude --- pkg/webconsole/service/handlers.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/pkg/webconsole/service/handlers.go b/pkg/webconsole/service/handlers.go index cc33ab4246..8f281756f6 100644 --- a/pkg/webconsole/service/handlers.go +++ b/pkg/webconsole/service/handlers.go @@ -93,6 +93,11 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (* body, _ = body.Get("webconsole") } + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) + if userCred == nil { + return nil, httperrors.NewUnauthorizedError("No token founded") + } + k8sReq := webconsole_api.SK8sRequest{} err := body.Unmarshal(&k8sReq) if err != nil { @@ -106,10 +111,12 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (* k8sReq.Namespace = "default" } podName := params[""] - adminSession := auth.GetAdminSession(ctx, o.Options.Region) + // use the user's own session instead of the admin session, so the RBAC + // policy and owner scope of the target cluster are enforced + session := auth.Client().NewSession(ctx, o.Options.Region, "", "internal", userCred) data := jsonutils.NewDict() - ret, err := k8s.KubeClusters.GetSpecific(adminSession, k8sReq.Cluster, "kubeconfig", data) + ret, err := k8s.KubeClusters.GetSpecific(session, k8sReq.Cluster, "kubeconfig", data) if err != nil { return nil, err } @@ -125,7 +132,7 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (* f.WriteString(conf) return &command.K8sEnv{ - Session: adminSession, + Session: session, Cluster: k8sReq.Cluster, Namespace: k8sReq.Namespace, Pod: podName,