Skip to content

Commit 7101684

Browse files
reggie-kreggie-k
committed
gotestsum locally from dist, containerized from /usr/local/bin
Signed-off-by: reggie-k <[email protected]>
1 parent bcf2143 commit 7101684

File tree

12 files changed

+45
-372
lines changed

12 files changed

+45
-372
lines changed

‎cmd/argocd/commands/admin/settings.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ func NewSettingsCommand() *cobra.Command {
162162

163163
command.AddCommand(NewValidateSettingsCommand(&opts))
164164
command.AddCommand(NewResourceOverridesCommand(&opts))
165-
command.AddCommand(NewRBACCommand(&opts))
165+
command.AddCommand(NewRBACCommand())
166166

167167
opts.clientConfig = cli.AddKubectlFlagsToCmd(command)
168168
command.PersistentFlags().StringVar(&opts.argocdCMPath, "argocd-cm-path", "", "Path to local argocd-cm.yaml file")

‎cmd/argocd/commands/admin/settings_rbac.go

Lines changed: 5 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ import (
1818
"github.com/argoproj/argo-cd/v3/server/rbacpolicy"
1919
"github.com/argoproj/argo-cd/v3/util/assets"
2020
"github.com/argoproj/argo-cd/v3/util/cli"
21-
"github.com/argoproj/argo-cd/v3/util/errors"
2221
"github.com/argoproj/argo-cd/v3/util/rbac"
2322
)
2423

@@ -119,21 +118,21 @@ var extensionActions = actionTraitMap{
119118
}
120119

121120
// NewRBACCommand is the command for 'rbac'
122-
func NewRBACCommand(cmdCtx commandContext) *cobra.Command {
121+
func NewRBACCommand() *cobra.Command {
123122
command := &cobra.Command{
124123
Use: "rbac",
125124
Short: "Validate and test RBAC configuration",
126125
Run: func(c *cobra.Command, args []string) {
127126
c.HelpFunc()(c, args)
128127
},
129128
}
130-
command.AddCommand(NewRBACCanCommand(cmdCtx))
129+
command.AddCommand(NewRBACCanCommand())
131130
command.AddCommand(NewRBACValidateCommand())
132131
return command
133132
}
134133

135134
// NewRBACCanCommand is the command for 'rbac can'
136-
func NewRBACCanCommand(cmdCtx commandContext) *cobra.Command {
135+
func NewRBACCanCommand() *cobra.Command {
137136
var (
138137
policyFile string
139138
defaultRole string
@@ -219,29 +218,7 @@ argocd admin settings rbac can someuser create application 'default/app' --defau
219218
defaultRole = newDefaultRole
220219
}
221220

222-
// Logs RBAC will be enforced only if an internal var serverRBACLogEnforceEnable
223-
// (representing server.rbac.log.enforce.enable env var in argocd-cm)
224-
// is defined and has a "true" value
225-
// Otherwise, no RBAC enforcement for logs will take place (meaning, 'can' request on a logs resource will result in "yes",
226-
// even if there is no explicit RBAC allow, or if there is an explicit RBAC deny)
227-
var isLogRbacEnforced func() bool
228-
if nsOverride && policyFile == "" {
229-
if resolveRBACResourceName(resource) == rbacpolicy.ResourceLogs {
230-
isLogRbacEnforced = func() bool {
231-
if opts, ok := cmdCtx.(*settingsOpts); ok {
232-
opts.loadClusterSettings = true
233-
opts.clientConfig = clientConfig
234-
settingsMgr, err := opts.createSettingsManager(ctx)
235-
errors.CheckError(err)
236-
logEnforceEnable, err := settingsMgr.GetServerRBACLogEnforceEnable()
237-
errors.CheckError(err)
238-
return logEnforceEnable
239-
}
240-
return false
241-
}
242-
}
243-
}
244-
res := checkPolicy(subject, action, resource, subResource, builtinPolicy, userPolicy, defaultRole, matchMode, strict, isLogRbacEnforced)
221+
res := checkPolicy(subject, action, resource, subResource, builtinPolicy, userPolicy, defaultRole, matchMode, strict)
245222

246223
if res {
247224
if !quiet {
@@ -408,7 +385,7 @@ func getPolicyConfigMap(ctx context.Context, client kubernetes.Interface, namesp
408385

409386
// checkPolicy checks whether given subject is allowed to execute specified
410387
// action against specified resource
411-
func checkPolicy(subject, action, resource, subResource, builtinPolicy, userPolicy, defaultRole, matchMode string, strict bool, isLogRbacEnforced func() bool) bool {
388+
func checkPolicy(subject, action, resource, subResource, builtinPolicy, userPolicy, defaultRole, matchMode string, strict bool) bool {
412389
enf := rbac.NewEnforcer(nil, "argocd", "argocd-rbac-cm", nil)
413390
enf.SetDefaultRole(defaultRole)
414391
enf.SetMatchMode(matchMode)
@@ -450,11 +427,6 @@ func checkPolicy(subject, action, resource, subResource, builtinPolicy, userPoli
450427
subResource = "*/*"
451428
}
452429
}
453-
if realResource == rbacpolicy.ResourceLogs {
454-
if isLogRbacEnforced != nil && !isLogRbacEnforced() {
455-
return true
456-
}
457-
}
458430
return enf.Enforce(subject, realResource, action, subResource)
459431
}
460432

‎cmd/argocd/commands/admin/settings_rbac_test.go

Lines changed: 27 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -131,15 +131,7 @@ func Test_PolicyFromYAML(t *testing.T) {
131131
require.Equal(t, "role:unknown", dRole)
132132
require.Empty(t, matchMode)
133133
require.True(t, checkPolicy("my-org:team-qa", "update", "project", "foo",
134-
"", uPol, dRole, matchMode, true, nil))
135-
}
136-
137-
func trueLogRbacEnforce() bool {
138-
return true
139-
}
140-
141-
func falseLogRbacEnforce() bool {
142-
return false
134+
"", uPol, dRole, matchMode, true))
143135
}
144136

145137
func Test_PolicyFromK8s(t *testing.T) {
@@ -163,105 +155,63 @@ func Test_PolicyFromK8s(t *testing.T) {
163155
require.Equal(t, "", matchMode)
164156

165157
t.Run("get applications", func(t *testing.T) {
166-
ok := checkPolicy("role:user", "get", "applications", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
158+
ok := checkPolicy("role:user", "get", "applications", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
167159
require.True(t, ok)
168160
})
169161
t.Run("get clusters", func(t *testing.T) {
170-
ok := checkPolicy("role:user", "get", "clusters", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
162+
ok := checkPolicy("role:user", "get", "clusters", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
171163
require.True(t, ok)
172164
})
173165
t.Run("get certificates", func(t *testing.T) {
174-
ok := checkPolicy("role:user", "get", "certificates", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
166+
ok := checkPolicy("role:user", "get", "certificates", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
175167
require.False(t, ok)
176168
})
177169
t.Run("get certificates by default role", func(t *testing.T) {
178-
ok := checkPolicy("role:user", "get", "certificates", "*", assets.BuiltinPolicyCSV, uPol, "role:readonly", "glob", true, nil)
170+
ok := checkPolicy("role:user", "get", "certificates", "*", assets.BuiltinPolicyCSV, uPol, "role:readonly", "glob", true)
179171
require.True(t, ok)
180172
})
181173
t.Run("get certificates by default role without builtin policy", func(t *testing.T) {
182-
ok := checkPolicy("role:user", "get", "certificates", "*", "", uPol, "role:readonly", "glob", true, nil)
174+
ok := checkPolicy("role:user", "get", "certificates", "*", "", uPol, "role:readonly", "glob", true)
183175
require.False(t, ok)
184176
})
185177
t.Run("use regex match mode instead of glob", func(t *testing.T) {
186-
ok := checkPolicy("role:user", "get", "certificates", ".*", assets.BuiltinPolicyCSV, uPol, "role:readonly", "regex", true, nil)
178+
ok := checkPolicy("role:user", "get", "certificates", ".*", assets.BuiltinPolicyCSV, uPol, "role:readonly", "regex", true)
187179
require.False(t, ok)
188180
})
189181
t.Run("get logs", func(t *testing.T) {
190-
ok := checkPolicy("role:test", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
182+
ok := checkPolicy("role:test", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
191183
require.True(t, ok)
192184
})
193-
// no function is provided to check if logs rbac is enforced or not, so the policy permissions are queried to determine if no-such-user can get logs
194185
t.Run("no-such-user get logs", func(t *testing.T) {
195-
ok := checkPolicy("no-such-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
196-
require.False(t, ok)
197-
})
198-
// logs rbac policy is enforced, and no-such-user is not granted logs permission in user policy, so the result should be false (cannot get logs)
199-
t.Run("no-such-user get logs rbac enforced", func(t *testing.T) {
200-
ok := checkPolicy("no-such-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, trueLogRbacEnforce)
186+
ok := checkPolicy("no-such-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
201187
require.False(t, ok)
202188
})
203-
// no-such-user is not granted logs permission in user policy, but logs rbac policy is not enforced, so logs permission is open to all
204-
t.Run("no-such-user get logs rbac not enforced", func(t *testing.T) {
205-
ok := checkPolicy("no-such-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, falseLogRbacEnforce)
206-
require.True(t, ok)
207-
})
208-
// no function is provided to check if logs rbac is enforced or not, so the policy permissions are queried to determine if log-deny-user can get logs
209189
t.Run("log-deny-user get logs", func(t *testing.T) {
210-
ok := checkPolicy("log-deny-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
211-
require.False(t, ok)
212-
})
213-
// logs rbac policy is enforced, and log-deny-user is denied logs permission in user policy, so the result should be false (cannot get logs)
214-
t.Run("log-deny-user get logs rbac enforced", func(t *testing.T) {
215-
ok := checkPolicy("log-deny-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, trueLogRbacEnforce)
190+
ok := checkPolicy("log-deny-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
216191
require.False(t, ok)
217192
})
218-
// log-deny-user is denied logs permission in user policy, but logs rbac policy is not enforced, so logs permission is open to all
219-
t.Run("log-deny-user get logs rbac not enforced", func(t *testing.T) {
220-
ok := checkPolicy("log-deny-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, falseLogRbacEnforce)
221-
require.True(t, ok)
222-
})
223-
// no function is provided to check if logs rbac is enforced or not, so the policy permissions are queried to determine if log-allow-user can get logs
224193
t.Run("log-allow-user get logs", func(t *testing.T) {
225-
ok := checkPolicy("log-allow-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
226-
require.True(t, ok)
227-
})
228-
// logs rbac policy is enforced, and log-allow-user is granted logs permission in user policy, so the result should be true (can get logs)
229-
t.Run("log-allow-user get logs rbac enforced", func(t *testing.T) {
230-
ok := checkPolicy("log-allow-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, trueLogRbacEnforce)
231-
require.True(t, ok)
232-
})
233-
// log-allow-user is granted logs permission in user policy, and logs rbac policy is not enforced, so logs permission is open to all
234-
t.Run("log-allow-user get logs rbac not enforced", func(t *testing.T) {
235-
ok := checkPolicy("log-allow-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, falseLogRbacEnforce)
194+
ok := checkPolicy("log-allow-user", "get", "logs", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
236195
require.True(t, ok)
237196
})
238197
t.Run("get logs", func(t *testing.T) {
239-
ok := checkPolicy("role:test", "get", "logs", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
198+
ok := checkPolicy("role:test", "get", "logs", "*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
240199
require.True(t, ok)
241200
})
242201
t.Run("get logs", func(t *testing.T) {
243-
ok := checkPolicy("role:test", "get", "logs", "", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
202+
ok := checkPolicy("role:test", "get", "logs", "", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
244203
require.True(t, ok)
245204
})
246205
t.Run("create exec", func(t *testing.T) {
247-
ok := checkPolicy("role:test", "create", "exec", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
206+
ok := checkPolicy("role:test", "create", "exec", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
248207
require.True(t, ok)
249208
})
250209
t.Run("create applicationsets", func(t *testing.T) {
251-
ok := checkPolicy("role:user", "create", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
252-
require.True(t, ok)
253-
})
254-
// trueLogRbacEnforce or falseLogRbacEnforce should not affect non-logs resources
255-
t.Run("create applicationsets with trueLogRbacEnforce", func(t *testing.T) {
256-
ok := checkPolicy("role:user", "create", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, trueLogRbacEnforce)
257-
require.True(t, ok)
258-
})
259-
t.Run("create applicationsets with falseLogRbacEnforce", func(t *testing.T) {
260-
ok := checkPolicy("role:user", "create", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, trueLogRbacEnforce)
210+
ok := checkPolicy("role:user", "create", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
261211
require.True(t, ok)
262212
})
263213
t.Run("delete applicationsets", func(t *testing.T) {
264-
ok := checkPolicy("role:user", "delete", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true, nil)
214+
ok := checkPolicy("role:user", "delete", "applicationsets", "*/*", assets.BuiltinPolicyCSV, uPol, dRole, "", true)
265215
require.True(t, ok)
266216
})
267217
}
@@ -301,49 +251,49 @@ p, role:readonly, certificates, get, .*, allow
301251
p, role:, certificates, get, .*, allow`
302252

303253
t.Run("get applications", func(t *testing.T) {
304-
ok := checkPolicy("role:user", "get", "applications", ".*/.*", builtInPolicy, uPol, dRole, "regex", true, nil)
254+
ok := checkPolicy("role:user", "get", "applications", ".*/.*", builtInPolicy, uPol, dRole, "regex", true)
305255
require.True(t, ok)
306256
})
307257
t.Run("get clusters", func(t *testing.T) {
308-
ok := checkPolicy("role:user", "get", "clusters", ".*", builtInPolicy, uPol, dRole, "regex", true, nil)
258+
ok := checkPolicy("role:user", "get", "clusters", ".*", builtInPolicy, uPol, dRole, "regex", true)
309259
require.True(t, ok)
310260
})
311261
t.Run("get certificates", func(t *testing.T) {
312-
ok := checkPolicy("role:user", "get", "certificates", ".*", builtInPolicy, uPol, dRole, "regex", true, nil)
262+
ok := checkPolicy("role:user", "get", "certificates", ".*", builtInPolicy, uPol, dRole, "regex", true)
313263
require.False(t, ok)
314264
})
315265
t.Run("get certificates by default role", func(t *testing.T) {
316-
ok := checkPolicy("role:user", "get", "certificates", ".*", builtInPolicy, uPol, "role:readonly", "regex", true, nil)
266+
ok := checkPolicy("role:user", "get", "certificates", ".*", builtInPolicy, uPol, "role:readonly", "regex", true)
317267
require.True(t, ok)
318268
})
319269
t.Run("get certificates by default role without builtin policy", func(t *testing.T) {
320-
ok := checkPolicy("role:user", "get", "certificates", ".*", "", uPol, "role:readonly", "regex", true, nil)
270+
ok := checkPolicy("role:user", "get", "certificates", ".*", "", uPol, "role:readonly", "regex", true)
321271
require.False(t, ok)
322272
})
323273
t.Run("use glob match mode instead of regex", func(t *testing.T) {
324-
ok := checkPolicy("role:user", "get", "certificates", ".+", builtInPolicy, uPol, dRole, "glob", true, nil)
274+
ok := checkPolicy("role:user", "get", "certificates", ".+", builtInPolicy, uPol, dRole, "glob", true)
325275
require.False(t, ok)
326276
})
327277
t.Run("get logs via glob match mode", func(t *testing.T) {
328-
ok := checkPolicy("role:user", "get", "logs", ".*/.*", builtInPolicy, uPol, dRole, "glob", true, nil)
278+
ok := checkPolicy("role:user", "get", "logs", ".*/.*", builtInPolicy, uPol, dRole, "glob", true)
329279
require.True(t, ok)
330280
})
331281
t.Run("create exec", func(t *testing.T) {
332-
ok := checkPolicy("role:user", "create", "exec", ".*/.*", builtInPolicy, uPol, dRole, "regex", true, nil)
282+
ok := checkPolicy("role:user", "create", "exec", ".*/.*", builtInPolicy, uPol, dRole, "regex", true)
333283
require.True(t, ok)
334284
})
335285
t.Run("create applicationsets", func(t *testing.T) {
336-
ok := checkPolicy("role:user", "create", "applicationsets", ".*/.*", builtInPolicy, uPol, dRole, "regex", true, nil)
286+
ok := checkPolicy("role:user", "create", "applicationsets", ".*/.*", builtInPolicy, uPol, dRole, "regex", true)
337287
require.True(t, ok)
338288
})
339289
t.Run("delete applicationsets", func(t *testing.T) {
340-
ok := checkPolicy("role:user", "delete", "applicationsets", ".*/.*", builtInPolicy, uPol, dRole, "regex", true, nil)
290+
ok := checkPolicy("role:user", "delete", "applicationsets", ".*/.*", builtInPolicy, uPol, dRole, "regex", true)
341291
require.True(t, ok)
342292
})
343293
}
344294

345295
func TestNewRBACCanCommand(t *testing.T) {
346-
command := NewRBACCanCommand(&settingsOpts{})
296+
command := NewRBACCanCommand()
347297

348298
require.NotNil(t, command)
349299
assert.Equal(t, "can", command.Name())

‎docs/operator-manual/argocd-cm.yaml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -345,12 +345,6 @@ data:
345345
# This is to prevent the UI from becoming unresponsive when rendering a large number of logs. Default is 10.
346346
server.maxPodLogsToRender: "10"
347347

348-
# Application pod logs RBAC enforcement enables control over who can and who can't view application pod logs.
349-
# When you enable the switch, pod logs will be visible only to admin role by default. Other roles/users will not be able to view them via cli and UI.
350-
# When you enable the switch, viewing pod logs for other roles/users will require explicit RBAC allow policies (allow get on logs subresource).
351-
# When you disable the switch (either add it to the configmap with a "false" value or do not add it to the configmap), no actual RBAC enforcement will take place.
352-
server.rbac.log.enforce.enable: "false"
353-
354348
# exec.enabled indicates whether the UI exec feature is enabled. It is disabled by default.
355349
exec.enabled: "false"
356350

‎server/account/account.go

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -125,21 +125,6 @@ func (s *Server) CanI(ctx context.Context, r *account.CanIRequest) (*account.Can
125125
return nil, status.Errorf(codes.InvalidArgument, "%v does not contain %s", rbacpolicy.Resources, r.Resource)
126126
}
127127

128-
// Logs RBAC will be enforced only if an internal var serverRBACLogEnforceEnable (representing server.rbac.log.enforce.enable env var)
129-
// is defined and has a "true" value
130-
// Otherwise, no RBAC enforcement for logs will take place (meaning, can-i request on a logs resource will result in "yes",
131-
// even if there is no explicit RBAC allow, or if there is an explicit RBAC deny)
132-
if r.Resource == "logs" {
133-
serverRBACLogEnforceEnable, err := s.settingsMgr.GetServerRBACLogEnforceEnable()
134-
if err != nil {
135-
return nil, fmt.Errorf("failed to get server RBAC log enforcement setting: %w", err)
136-
}
137-
138-
if !serverRBACLogEnforceEnable {
139-
return &account.CanIResponse{Value: "yes"}, nil
140-
}
141-
}
142-
143128
ok := s.enf.Enforce(ctx.Value("claims"), r.Resource, r.Action, r.Subresource)
144129
if ok {
145130
return &account.CanIResponse{Value: "yes"}, nil

‎server/account/account_test.go

Lines changed: 3 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func TestDeleteToken_SuccessfullyRemoved(t *testing.T) {
308308
assert.Empty(t, acc.Tokens)
309309
}
310310

311-
func TestCanI_GetLogsAllowNoSwitch(t *testing.T) {
311+
func TestCanI_GetLogsAllow(t *testing.T) {
312312
accountServer, _ := newTestAccountServer(context.Background(), func(_ *corev1.ConfigMap, _ *corev1.Secret) {
313313
})
314314

@@ -318,39 +318,16 @@ func TestCanI_GetLogsAllowNoSwitch(t *testing.T) {
318318
assert.EqualValues(t, "yes", resp.Value)
319319
}
320320

321-
func TestCanI_GetLogsDenySwitchOn(t *testing.T) {
321+
func TestCanI_GetLogsDeny(t *testing.T) {
322322
enforcer := func(_ jwt.Claims, _ ...any) bool {
323323
return false
324324
}
325325

326-
accountServer, _ := newTestAccountServerExt(context.Background(), enforcer, func(cm *corev1.ConfigMap, _ *corev1.Secret) {
327-
cm.Data["server.rbac.log.enforce.enable"] = "true"
326+
accountServer, _ := newTestAccountServerExt(context.Background(), enforcer, func(_ *corev1.ConfigMap, _ *corev1.Secret) {
328327
})
329328

330329
ctx := projTokenContext(context.Background())
331330
resp, err := accountServer.CanI(ctx, &account.CanIRequest{Resource: "logs", Action: "get", Subresource: "*/*"})
332331
require.NoError(t, err)
333332
assert.EqualValues(t, "no", resp.Value)
334333
}
335-
336-
func TestCanI_GetLogsAllowSwitchOn(t *testing.T) {
337-
accountServer, _ := newTestAccountServer(context.Background(), func(cm *corev1.ConfigMap, _ *corev1.Secret) {
338-
cm.Data["server.rbac.log.enforce.enable"] = "true"
339-
})
340-
341-
ctx := projTokenContext(context.Background())
342-
resp, err := accountServer.CanI(ctx, &account.CanIRequest{Resource: "logs", Action: "get", Subresource: ""})
343-
require.NoError(t, err)
344-
assert.EqualValues(t, "yes", resp.Value)
345-
}
346-
347-
func TestCanI_GetLogsAllowSwitchOff(t *testing.T) {
348-
accountServer, _ := newTestAccountServer(context.Background(), func(cm *corev1.ConfigMap, _ *corev1.Secret) {
349-
cm.Data["server.rbac.log.enforce.enable"] = "false"
350-
})
351-
352-
ctx := projTokenContext(context.Background())
353-
resp, err := accountServer.CanI(ctx, &account.CanIRequest{Resource: "logs", Action: "get", Subresource: ""})
354-
require.NoError(t, err)
355-
assert.EqualValues(t, "yes", resp.Value)
356-
}

0 commit comments

Comments
 (0)