Merge pull request #65906 from liggitt/union-authz-message

Automatic merge from submit-queue (batch tested with PRs 65946, 65904, 65913, 65906, 65920). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Improve multi-authorizer errors Fixes #52279 Includes an indication from the RBAC authorizer that it attempted to authorize the request. this reduces confusion when combined with a webhook authorizer that returns specific reasons for rejection /sig auth ```release-note NONE ```

Merge pull request #65906 from liggitt/union-authz-message
5b052de4 · Kubernetes Submit Queue · GitHub · c899ccf4 · 1c012f1c · 5b052de4
Unverified Commit 5b052de4 authored Jul 07, 2018 by Kubernetes Submit Queue Committed by GitHub Jul 07, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 1 deletion

abac.go pkg/auth/authorizer/abac/abac.go +1 -1

rbac.go plugin/pkg/auth/authorizer/rbac/rbac.go +2 -0

No files found.
--- a/pkg/auth/authorizer/abac/abac.go
+++ b/pkg/auth/authorizer/abac/abac.go
@@ -227,7 +227,7 @@ func (pl policyList) Authorize(a authorizer.Attributes) (authorizer.Decision, st
 			return authorizer.DecisionAllow, "", nil
 		}
 	}
-	return authorizer.DecisionNoOpinion, "No policy matched.", nil
+	return authorizer.DecisionNoOpinion, "no ABAC policy matched", nil
 	// TODO: Benchmark how much time policy matching takes with a medium size
 	// policy file, compared to other steps such as encoding/decoding.
 	// Then, add Caching only if needed.

--- a/plugin/pkg/auth/authorizer/rbac/rbac.go
+++ b/plugin/pkg/auth/authorizer/rbac/rbac.go
@@ -121,6 +121,8 @@ func (r *RBACAuthorizer) Authorize(requestAttributes authorizer.Attributes) (aut
 	reason := ""
 	if len(ruleCheckingVisitor.errors) > 0 {
 		reason = fmt.Sprintf("RBAC: %v", utilerrors.NewAggregate(ruleCheckingVisitor.errors))
+	} else {
+		reason = "no RBAC policy matched"
 	}
 	return authorizer.DecisionNoOpinion, reason, nil
 }