Merge pull request #39193 from xilabao/add-rules-failed-message

Automatic merge from submit-queue add rules not allow message when authorize failed old result: ``` # ./cluster/kubectl.sh --token=/test get po Error from server (Forbidden): User "" cannot list pods in the namespace "default".: "<nil>" (get pods) ``` new result: ``` # ./cluster/kubectl.sh --token=/test get po Error from server (Forbidden): User "" cannot list pods in the namespace "default".: "rules not allow" (get pods) ``` test.yaml ``` kind: Role apiVersion: rbac.authorization.k8s.io/v1alpha1 metadata: name: test rules: - apiGroups: ["*"] verbs: ["create"] resources: ["*"] --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1alpha1 metadata: name: admin-resource-binding subjects: - kind: Group name: test roleRef: kind: Role name: test ```

Merge pull request #39193 from xilabao/add-rules-failed-message
dedec2d1 · Kubernetes Submit Queue · GitHub · f95362f9 · 9b38eaf9 · dedec2d1
Commit dedec2d1 authored Jan 03, 2017 by Kubernetes Submit Queue Committed by GitHub Jan 03, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 11 additions and 2 deletions

errors.go pkg/genericapiserver/api/handlers/responsewriters/errors.go +6 -1

rbac.go plugin/pkg/auth/authorizer/rbac/rbac.go +5 -1

No files found.
--- a/pkg/genericapiserver/api/handlers/responsewriters/errors.go
+++ b/pkg/genericapiserver/api/handlers/responsewriters/errors.go
@@ -38,7 +38,12 @@ func Forbidden(attributes authorizer.Attributes, w http.ResponseWriter, req *htt
 	w.Header().Set("Content-Type", "text/plain")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.WriteHeader(http.StatusForbidden)
-	fmt.Fprintf(w, "%s: %q", msg, reason)
+	if len(reason) == 0 {
+		fmt.Fprintf(w, "%s", msg)
+	} else {
+		fmt.Fprintf(w, "%s: %q", msg, reason)
+	}
 }
 func forbiddenMessage(attributes authorizer.Attributes) string {

--- a/plugin/pkg/auth/authorizer/rbac/rbac.go
+++ b/plugin/pkg/auth/authorizer/rbac/rbac.go
@@ -48,7 +48,11 @@ func (r *RBACAuthorizer) Authorize(requestAttributes authorizer.Attributes) (boo
 	glog.V(2).Infof("RBAC DENY: user %q groups %v cannot %q on \"%v.%v/%v\"", requestAttributes.GetUser().GetName(), requestAttributes.GetUser().GetGroups(),
 		requestAttributes.GetVerb(), requestAttributes.GetResource(), requestAttributes.GetAPIGroup(), requestAttributes.GetSubresource())
-	return false, fmt.Sprintf("%v", ruleResolutionError), nil
+	reason := ""
+	if ruleResolutionError != nil {
+		reason = fmt.Sprintf("%v", ruleResolutionError)
+	}
+	return false, reason, nil
 }
 func New(roles validation.RoleGetter, roleBindings validation.RoleBindingLister, clusterRoles validation.ClusterRoleGetter, clusterRoleBindings validation.ClusterRoleBindingLister) *RBACAuthorizer {