Merge pull request #53359 from liggitt/swagger.json

Automatic merge from submit-queue (batch tested with PRs 50749, 52869, 53359). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Add /swagger.json and /swagger-2.0.0.pb-v1 to discovery role Allow access to openapi docs Fixes #53349

Merge pull request #53359 from liggitt/swagger.json
8eb37aee · Kubernetes Submit Queue · GitHub · 5502e74b · d657261f · 8eb37aee
Commit 8eb37aee authored Oct 02, 2017 by Kubernetes Submit Queue Committed by GitHub Oct 02, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 12 additions and 1 deletion

policy.go plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go +10 -1

cluster-roles.yaml ...thorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml +2 -0

No files found.
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
@@ -152,7 +152,16 @@ func ClusterRoles() []rbac.ClusterRole {
 			// a role which provides just enough power to determine if the server is ready and discover API versions for negotiation
 			ObjectMeta: metav1.ObjectMeta{Name: "system:discovery"},
 			Rules: []rbac.PolicyRule{
-				rbac.NewRule("get").URLs("/healthz", "/version", "/swaggerapi", "/swaggerapi/*", "/api", "/api/*", "/apis", "/apis/*").RuleOrDie(),
+				rbac.NewRule("get").URLs(
+					"/healthz", "/version",
+					// remove once swagger 1.2 support is removed
+					"/swaggerapi", "/swaggerapi/*",
+					// do not expand this pattern for openapi discovery docs
+					// move to a single openapi endpoint that takes accept/accept-encoding headers
+					"/swagger.json", "/swagger-2.0.0.pb-v1",
+					"/api", "/api/*",
+					"/apis", "/apis/*",
+				).RuleOrDie(),
 			},
 		},
 		{

--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -434,6 +434,8 @@ items:
    - /apis
    - /apis/*
    - /healthz
+    - /swagger-2.0.0.pb-v1
+    - /swagger.json
    - /swaggerapi
    - /swaggerapi/*
    - /version