RBAC: Add legacy authorization checks to service accounts (#93753)

* Extract a helper funtion to perform list with authorization checks

* Add k8s verb to utils package

* Construct default mapping when no custom mapping is passed

* Configure authorization checks for service accounts

* Fix helper and add filtering to service accounts

pkg/apis/iam/v0alpha1/types_servier_account.go

@@ -1,6 +1,8 @@
 package v0alpha1
 
 import (
+	"fmt"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -12,9 +14,15 @@ type ServiceAccount struct {
 	Spec ServiceAccountSpec `json:"spec,omitempty"`
 }
 
+func (s ServiceAccount) AuthID() string {
+	return fmt.Sprintf("%d", s.Spec.InternalID)
+}
+
 type ServiceAccountSpec struct {
 	Title    string `json:"title,omitempty"`
 	Disabled bool   `json:"disabled,omitempty"`
+	// This is currently used for authorization checks but we don't want to expose it
+	InternalID int64 `json:"-"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

pkg/apis/iam/v0alpha1/types_user.go

@@ -1,6 +1,10 @@
 package v0alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type User struct {
@@ -10,12 +14,18 @@ type User struct {
 	Spec UserSpec `json:"spec,omitempty"`
 }
 
+func (u User) AuthID() string {
+	return fmt.Sprintf("%d", u.Spec.InternalID)
+}
+
 type UserSpec struct {
 	Name          string `json:"name,omitempty"`
 	Login         string `json:"login,omitempty"`
 	Email         string `json:"email,omitempty"`
 	EmailVerified bool   `json:"emailVerified,omitempty"`
 	Disabled      bool   `json:"disabled,omitempty"`
+	// This is currently used for authorization checks but we don't want to expose it
+	InternalID int64 `json:"-"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object