Skip to content

Commit

Permalink
(chore): Ignore request originated from terminal when allowed all ori…
Browse files Browse the repository at this point in the history
…gin serviceAccount is set

Signed-off-by: Shubham Chaudhary <[email protected]>
  • Loading branch information
ispeakc0de committed Aug 13, 2024
1 parent 8daf11f commit b590193
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion internal/pods/restrict.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ func validateOriginServiceAccount(serviceAccount string) (bool, string) {

serviceAccountList := strings.Split(serviceAccount, ":")
if len(serviceAccountList) != 4 {
return false, fmt.Sprintf("%v serviceAccount is not in a valid format 'system:serviceaccount:<ns><name>'")
return false, fmt.Sprintf("%v serviceAccount is not in a valid format 'system:serviceaccount:<ns><name>'", serviceAccount)
}

for _, v := range utils.WebHookFilters.AllowedOriginServiceAccount.AllowedList {
Expand Down Expand Up @@ -79,6 +79,9 @@ func validateOriginPodImage(namespace string, extras map[string]v1.ExtraValue, c
}

func originFromTerminal(serviceAccount string) bool {
if utils.WebHookFilters.AllowedOriginServiceAccount.AllowedAll {
return true
}
if strings.Contains(serviceAccount, "system:serviceaccount") {
return false
}
Expand Down

0 comments on commit b590193

Please sign in to comment.