Adjust deep SAR for SA

[mjudeikis]

Summary

fix: strip scopes from ServiceAccount tokens in maximal permission policy check

What Type of PR Is This?

/kind bug
Fix 403 Forbidden when ServiceAccount accesses claimed resources via APIExport virtual workspace
Strip scope-related Extra fields only for ServiceAccounts in maximal permission policy authorizer
Add e2e test to prevent regression

When an APIExport includes a permissionClaim on resources from another APIExport (e.g., tenancy.kcp.io/workspaces), and a consumer accepts that claim in an APIBinding, the provider's ServiceAccount receives a 403 Forbidden when accessing the claimed resources via the APIExport virtual workspace—even though it has proper apiexports/content RBAC.

Root Cause

ServiceAccount tokens are scoped to their originating workspace (e.g., cluster:root:org:provider). When accessing claimed resources, the maximal permission policy check runs in the workspace where the claimed APIExport lives (e.g., root for tenancy.kcp.io). The deep SubjectAccessReview fails because the SA token's scope doesn't include the target workspace.

Solution

Strip scope-related Extra fields (authentication.kcp.io/scopes and authentication.kcp.io/cluster-name) from ServiceAccounts only in prefixAttributes() before running the maximal permission policy check.

This is safe because:

• BoundAPIAuthorizer already verified the request targets a valid bound resource
• APIExportsContentAuthorizer already verified apiexports/content permission in the provider workspace
• MaximalPermissionAuthorizer checks what the claimed APIExport allows—scope mismatch is a false negative here
• Regular users are intentionally not affected—their scopes are preserved. This is the expected behavior since users may have scopes set via impersonation for security reasons.

Related Issue(s)

Fixes #3840

Release Notes

Strip scopes from ServiceAccount tokens in maximal permission policy check

[mjudeikis]

This is early, want to see how much of things breaks

[mjudeikis]

/retest

[mjudeikis]

/test all

[ntnn]

/lgtm
/approve

[kcp-ci-bot]

LGTM label has been added.

Details

Git tree hash: f16a182d2a34870ce542d2ca2f8acfa7626630fb

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ntnn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ntnn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment