From 5d94293305730f564341dcd3b3b4528580a3f2f9 Mon Sep 17 00:00:00 2001
From: Karl Persson <23356117+kalleep@users.noreply.github.com>
Date: Thu, 13 Mar 2025 14:54:35 +0100
Subject: [PATCH] Authz: Fix namespace authorization when calling a cluster
 resource (#102110)

---
 pkg/services/apiserver/auth/authorizer/namespace.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/services/apiserver/auth/authorizer/namespace.go b/pkg/services/apiserver/auth/authorizer/namespace.go
index 45a792d084f..836218fbd9d 100644
--- a/pkg/services/apiserver/auth/authorizer/namespace.go
+++ b/pkg/services/apiserver/auth/authorizer/namespace.go
@@ -40,6 +40,11 @@ func (auth namespaceAuthorizer) Authorize(ctx context.Context, a authorizer.Attr
 		return authorizer.DecisionDeny, "invalid namespace", err
 	}
 
+	// If we call a cluster resource we delegate to the next authorizer
+	if ns.Value == "" {
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
 	if ns.OrgID != ident.GetOrgID() {
 		return authorizer.DecisionDeny, "invalid org", nil
 	}