app,rewrite: remove non-resource attrs

Masking the resource attributes value to "just" path, verb and user is
potentially suboptimal, as it ignores other fields that would be of
interest for a SAR request.
This use-case makes sense for regular HTTP request (non kubernetes
resource request), but those kind of requests, don't populate the other
fields in the resource attributes anyway.
Is theoretically a regression, which we should keep in mind.

Author: ibihim

cmd/kube-rbac-proxy/app/authorizer.go

@@ -57,8 +57,6 @@ func setupAuthorizer(krbInfo *server.KubeRBACProxyInfo, delegatedAuthz *serverco
 		attrsGenerator = rewrite.NewTemplatedResourceAttributesGenerator(
 			krbInfo.Authorization.ResourceAttributes,
 		)
-	default:
-		attrsGenerator = &rewrite.NonResourceAttributesGenerator{}
 	}
 
 	if attrsGenerator != nil {
@@ -93,4 +91,3 @@ func setupAuthorizer(krbInfo *server.KubeRBACProxyInfo, delegatedAuthz *serverco
 
 	return authz, nil
 }
-

cmd/kube-rbac-proxy/app/kube-rbac-proxy.go

@@ -155,7 +155,6 @@ func (opts *completedProxyRunOptions) ProxyConfig() (*server.KubeRBACProxyConfig
 // Complete sets defaults for the ProxyRunOptions.
 // Should be called after the flags are parsed.
 func Complete(o *options.ProxyRunOptions) (*completedProxyRunOptions, error) {
-
 	hostname, err := os.Hostname()
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve hostname for self-signed cert: %w", err)
@@ -266,7 +265,6 @@ func Run(cfg *server.KubeRBACProxyConfig) error {
 	return nil
 }
 
-
 func setupProxyHandler(cfg *server.KubeRBACProxyInfo) http.Handler {
 	proxy := &httputil.ReverseProxy{
 		Rewrite: func(pr *httputil.ProxyRequest) {

pkg/authorization/rewrite/attributes.go

@@ -30,24 +30,6 @@ type AttributesGenerator interface {
 	Generate(context.Context, authorizer.Attributes) []authorizer.Attributes
 }
 
-// NonResourceAttributesGenerator reduces a given attribute to user and http based
-// attributes.
-type NonResourceAttributesGenerator struct{}
-
-var _ AttributesGenerator = &NonResourceAttributesGenerator{}
-
-// Generate reduces the original attributes to user and http based attributes.
-func (d *NonResourceAttributesGenerator) Generate(ctx context.Context, attr authorizer.Attributes) []authorizer.Attributes {
-	return []authorizer.Attributes{
-		authorizer.AttributesRecord{
-			User:            attr.GetUser(),
-			Verb:            attr.GetVerb(),
-			ResourceRequest: false,
-			Path:            attr.GetPath(),
-		},
-	}
-}
-
 // ResourceAttributesGenerator uses the given attributes' user, http verb and
 // verifies its authorization against a static kubernetes resource. The
 // authorization is bound to that given kubernetes resource.

pkg/authorization/rewrite/attributes_test.go

@@ -25,142 +25,6 @@ import (
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
 
-func TestDefaultAttributesGenerator(t *testing.T) {
-	generator := &rewrite.NonResourceAttributesGenerator{}
-	testCases := []struct {
-		name       string
-		attributes authorizer.AttributesRecord
-		expected   authorizer.AttributesRecord
-	}{
-		{
-			name: "basic HTTP attributes",
-			attributes: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 0"},
-				Verb:            "post",
-				Namespace:       "",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/users",
-			},
-			expected: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 0"},
-				Verb:            "post",
-				Namespace:       "",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/users",
-			},
-		},
-		{
-			name: "basic attributes",
-			attributes: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 1"},
-				Verb:            "get",
-				Namespace:       "default",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "pods",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/namespaces/default/pods",
-			},
-			expected: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 1"},
-				Verb:            "get",
-				Namespace:       "",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/namespaces/default/pods",
-			},
-		},
-		{
-			name: "attributes with subresource",
-			attributes: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 2"},
-				Verb:            "update",
-				Namespace:       "default",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "pods",
-				Subresource:     "status",
-				Name:            "pod1",
-				ResourceRequest: false,
-				Path:            "/api/v1/namespaces/default/pods/pod1/status",
-			},
-			expected: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 2"},
-				Verb:            "update",
-				Namespace:       "",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/namespaces/default/pods/pod1/status",
-			},
-		},
-		{
-			name: "resource request attributes",
-			attributes: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 3"},
-				Verb:            "get",
-				Namespace:       "default",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "pods",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: true,
-				Path:            "/api/v1/namespaces/default/pods",
-			},
-			expected: authorizer.AttributesRecord{
-				User:            &user.DefaultInfo{Name: "test user 3"},
-				Verb:            "get",
-				Namespace:       "",
-				APIGroup:        "",
-				APIVersion:      "",
-				Resource:        "",
-				Subresource:     "",
-				Name:            "",
-				ResourceRequest: false,
-				Path:            "/api/v1/namespaces/default/pods",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			generatedAttributes := generator.Generate(context.Background(), tc.attributes)
-
-			if len(generatedAttributes) != 1 {
-				t.Errorf("Expected 1 generated attribute, but got %d", len(generatedAttributes))
-			}
-
-			generatedRecord := generatedAttributes[0]
-			if !reflect.DeepEqual(generatedRecord, tc.expected) {
-				t.Errorf(
-					"Generated attribute does not match expected attribute.\nHave: %+v,\nWant: %+v",
-					generatedRecord, tc.expected,
-				)
-			}
-		})
-	}
-}
-
 func TestBoundAttributesGenerator(t *testing.T) {
 	boundResource := &rewrite.ResourceAttributes{
 		Namespace:  "kube-system",