Authz: Fix namespace authorization when calling a cluster resource (#102110)

2025-03-13 14:54:35 +01:00
parent 2bbd5faf6d
commit 5d94293305
1 changed files with 5 additions and 0 deletions
@@ -40,6 +40,11 @@ func (auth namespaceAuthorizer) Authorize(ctx context.Context, a authorizer.Attr
 		return authorizer.DecisionDeny, "invalid namespace", err
 	}

+	// If we call a cluster resource we delegate to the next authorizer
+	if ns.Value == "" {
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
 	if ns.OrgID != ident.GetOrgID() {
 		return authorizer.DecisionDeny, "invalid org", nil
 	}