catalog

Author: Shivam-nagar23

api/cluster/ClusterRestHandler.go

@@ -477,7 +477,8 @@ func (impl ClusterRestHandlerImpl) UpdateClusterDescription(w http.ResponseWrite
 		return
 	}
 	// RBAC enforcer applying
-	if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
+	authenticated := impl.clusterRbacService.CheckAuthorisationForAllK8sPermissions(token, clusterDescription.ClusterName, casbin.ActionUpdate)
+	if !authenticated {
 		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
 		return
 	}
@@ -521,7 +522,8 @@ func (impl ClusterRestHandlerImpl) UpdateClusterNote(w http.ResponseWriter, r *h
 		return
 	}
 	// RBAC enforcer applying
-	if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
+	authenticated := impl.clusterRbacService.CheckAuthorisationForAllK8sPermissions(token, clusterDescription.ClusterName, casbin.ActionUpdate)
+	if !authenticated {
 		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
 		return
 	}

pkg/cluster/rbac/ClusterRbacService.go

@@ -18,9 +18,12 @@ package rbac
 
 import (
 	"errors"
+	"github.com/devtron-labs/common-lib/utils/k8s"
 	"github.com/devtron-labs/devtron/pkg/cluster"
 	"github.com/devtron-labs/devtron/pkg/cluster/environment"
+	"github.com/devtron-labs/devtron/pkg/k8s/application/bean"
 	"github.com/devtron-labs/devtron/util/rbac"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"strings"
 
 	"github.com/devtron-labs/devtron/pkg/auth/authorisation/casbin"
@@ -32,6 +35,7 @@ type ClusterRbacService interface {
 	CheckAuthorization(clusterName string, clusterId int, token string, userId int32, rbacForClusterMappingsAlso bool) (bool, error)
 	CheckAuthorisationForNode(token string, clusterName string, nodeName string, action string) (authenticated bool)
 	CheckAuthorisationForNodeWithClusterId(token string, clusterId int, nodeName string, action string) (authenticated bool, err error)
+	CheckAuthorisationForAllK8sPermissions(token string, clusterName string, action string) bool
 }
 
 type ClusterRbacServiceImpl struct {
@@ -139,3 +143,12 @@ func (impl *ClusterRbacServiceImpl) FetchAllowedClusterMap(userId int32) (map[st
 	return allowedClustersMap, err
 
 }
+
+func (impl *ClusterRbacServiceImpl) CheckAuthorisationForAllK8sPermissions(token string, clusterName string, action string) (b2 bool) {
+	resource, object := impl.enforcerUtil.GetRBACNameForClusterEntity(clusterName, k8s.ResourceIdentifier{
+		Name:             bean.ALL,
+		Namespace:        bean.ALL,
+		GroupVersionKind: schema.GroupVersionKind{Group: bean.ALL, Kind: bean.ALL},
+	})
+	return impl.enforcer.Enforce(token, strings.ToLower(resource), action, object)
+}