fanhuadesenlinnn/cloudpods
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/yunionio/cloudpods.git synced 2026-09-20 08:03:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(webconsole): fetch kubeconfig with user session for k8s shell (#25484)

Browse Source 
The k8s shell/log endpoints fetched the target cluster kubeconfig
with the admin session, bypassing RBAC and owner scope checks, so any
authenticated user could exec into pods and read logs of any
registered cluster.

Fetch the kubeconfig with the user's own session instead, so policy
checks and owner filtering apply, and command records are attributed
to the real user.

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Jian Qiu
2026-09-04 09:18:52 +08:00
committed by GitHub
parent bebb68775f
commit c805952b40
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/webconsole/service/handlers.go
View File

@@ -93,6 +93,11 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*
body, _ = body.Get("webconsole")
}
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
if userCred == nil {
return nil, httperrors.NewUnauthorizedError("No token founded")
}
k8sReq := webconsole_api.SK8sRequest{}
err := body.Unmarshal(&k8sReq)
if err != nil {
@@ -106,10 +111,12 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*
k8sReq.Namespace = "default"
}
podName := params["<podName>"]
adminSession := auth.GetAdminSession(ctx, o.Options.Region)
// use the user's own session instead of the admin session, so the RBAC
// policy and owner scope of the target cluster are enforced
session := auth.Client().NewSession(ctx, o.Options.Region, "", "internal", userCred)
data := jsonutils.NewDict()
ret, err := k8s.KubeClusters.GetSpecific(adminSession, k8sReq.Cluster, "kubeconfig", data)
ret, err := k8s.KubeClusters.GetSpecific(session, k8sReq.Cluster, "kubeconfig", data)
if err != nil {
return nil, err
}
@@ -125,7 +132,7 @@ func fetchK8sEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*
f.WriteString(conf)
return &command.K8sEnv{
Session: adminSession,
Session: session,
Cluster: k8sReq.Cluster,
Namespace: k8sReq.Namespace,
Pod: podName,