public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Add namespace matches checks to authorizer and secure value client (#109651)

Browse Source 
* Decrypt: Add namespace matches to authorizer

* SecureValueClient: Add namespace matches when auth checking
This commit is contained in:
Matheus Macabu
2025-08-14 11:50:56 +02:00
committed by GitHub
parent a38a5e0301
commit dfae5e5b4d
7 changed files with 145 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/decrypt/authorizer.go
+6 -1
View File
@@ -11,6 +11,7 @@ import (
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1"
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
)
// decryptAuthorizer is the authorizer implementation for decrypt operations.
@@ -25,7 +26,7 @@ func ProvideDecryptAuthorizer(tracer trace.Tracer) contracts.DecryptAuthorizer {
}
// authorize checks whether the auth info token has the right permissions to decrypt the secure value.
func (a *decryptAuthorizer) Authorize(ctx context.Context, secureValueName string, secureValueDecrypters []string) (id string, isAllowed bool) {
func (a *decryptAuthorizer) Authorize(ctx context.Context, ns xkube.Namespace, secureValueName string, secureValueDecrypters []string) (id string, isAllowed bool) {
ctx, span := a.tracer.Start(ctx, "DecryptAuthorizer.Authorize", trace.WithAttributes(
attribute.String("name", secureValueName),
attribute.StringSlice("decrypters", secureValueDecrypters),
@@ -44,6 +45,10 @@ func (a *decryptAuthorizer) Authorize(ctx context.Context, secureValueName strin
return "", false
}
if !claims.NamespaceMatches(authInfo.GetNamespace(), ns.String()) {
return "", false
}
serviceIdentityList, ok := authInfo.GetExtra()[authn.ServiceIdentityKey]
if !ok {
return "", false