Skip to content

Commit 77812b9

Browse files
committed
config: support username impersonation
This commit adds support for username impersonation. This does not implement group, UID, or extra impersonation. Refs: #2355
1 parent ecd208c commit 77812b9

File tree

3 files changed

+43
-0
lines changed

3 files changed

+43
-0
lines changed

src/config.ts

+5
Original file line numberDiff line numberDiff line change
@@ -582,6 +582,11 @@ export class KubeConfig implements SecurityAuthentication {
582582
if (key) {
583583
opts.key = key;
584584
}
585+
586+
if (user.impersonateUser != null) {
587+
opts.headers ??= {};
588+
opts.headers['Impersonate-User'] = user.impersonateUser;
589+
}
585590
}
586591

587592
private async applyAuthorizationHeader(

src/config_test.ts

+35
Original file line numberDiff line numberDiff line change
@@ -642,6 +642,20 @@ describe('KubeConfig', () => {
642642
strictEqual(password, users[0].password);
643643
strictEqual(username, users[0].username);
644644
strictEqual(name, users[0].name);
645+
strictEqual(undefined, users[0].impersonateUser);
646+
});
647+
it('should load impersonation information', () => {
648+
const name = 'some-name';
649+
const as = 'impersonated-user';
650+
const users = newUsers([
651+
{
652+
name,
653+
as: 'impersonated-user',
654+
user: {},
655+
},
656+
]);
657+
strictEqual(name, users[0].name);
658+
strictEqual(as, users[0].impersonateUser);
645659
});
646660
});
647661

@@ -1787,4 +1801,25 @@ describe('KubeConfig', () => {
17871801
strictEqual(opts.headers!.Authorization, 'Bearer test-token');
17881802
});
17891803
});
1804+
1805+
describe('Impersonation', () => {
1806+
it('injects Impersonate-User header', async () => {
1807+
const kc = new KubeConfig();
1808+
const cluster: Cluster = {
1809+
name: 'test-cluster',
1810+
server: 'https://localhost:6443',
1811+
skipTLSVerify: false,
1812+
};
1813+
const user: User = {
1814+
name: 'test-user',
1815+
authProvider: 'custom',
1816+
impersonateUser: 'impersonate-user',
1817+
};
1818+
1819+
kc.loadFromClusterAndUser(cluster, user);
1820+
const opts: RequestOptions = {};
1821+
await kc.applyToHTTPSOptions(opts);
1822+
strictEqual(opts.headers!['Impersonate-User'], 'impersonate-user');
1823+
});
1824+
});
17901825
});

src/config_types.ts

+3
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ export interface User {
9797
readonly token?: string;
9898
readonly username?: string;
9999
readonly password?: string;
100+
readonly impersonateUser?: string;
100101
}
101102

102103
export function newUsers(a: any, opts?: Partial<ConfigOptions>): User[] {
@@ -112,6 +113,7 @@ export function newUsers(a: any, opts?: Partial<ConfigOptions>): User[] {
112113
export function exportUser(user: User): any {
113114
return {
114115
name: user.name,
116+
as: user.impersonateUser,
115117
user: {
116118
'auth-provider': user.authProvider,
117119
'client-certificate-data': user.certData,
@@ -143,6 +145,7 @@ function userIterator(onInvalidEntry: ActionOnInvalid): (elt: any, i: number, li
143145
token: findToken(elt.user),
144146
password: elt.user ? elt.user.password : null,
145147
username: elt.user ? elt.user.username : null,
148+
impersonateUser: elt.as,
146149
};
147150
} catch (err) {
148151
switch (onInvalidEntry) {

0 commit comments

Comments
 (0)