Reduce the number of SAR checks we make
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 739
- Forks
- 85
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 1
Description
We currently make a lot of remote calls back to the Kube API server for authz checks. At the bare minimum we should stop making these calls for:
authorizationOptions := genericapiserveroptions.NewDelegatingAuthorizationOptions().
WithAlwaysAllowPaths("/healthz", "/healthz/").
WithAlwaysAllowGroups(user.SystemPrivilegedGroup)
We should also create a wrapper authorizer.AuthorizerFunc that skips authz for TokenCredentialRequest since it is a pre-authentication API.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the authorization setup using genericapiserveroptions.NewDelegatingAuthorizationOptions and the authorizer.AuthorizerFunc handling for TokenCredentialRequest. Verify that /healthz paths, the privileged group, and TokenCredentialRequest avoid remote authorization calls. Done means the exemptions are implemented and covered by the repository's relevant tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authorization
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100