CKS: check access when get kubernetescluster config (#7854)

weizhouapache · web-flow · commit bf9c71430b64 · 2023-08-14T10:02:20.000+02:00
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@ -1285,6 +1285,8 @@ public KubernetesClusterConfigResponse getKubernetesClusterConfig(GetKubernetesC
         if (kubernetesCluster == null) {
             throw new InvalidParameterValueException("Invalid Kubernetes cluster ID specified");
         }
+        Account caller = CallContext.current().getCallingAccount();
+        accountManager.checkAccess(caller, SecurityChecker.AccessType.OperateEntry, false, kubernetesCluster);
         KubernetesClusterConfigResponse response = new KubernetesClusterConfigResponse();
         response.setId(kubernetesCluster.getUuid());
         response.setName(kubernetesCluster.getName());

Original file line number	Diff line number	Diff line change
`@@ -1285,6 +1285,8 @@ public KubernetesClusterConfigResponse getKubernetesClusterConfig(GetKubernetesC`
`1285`	`1285`	`if (kubernetesCluster == null) {`
`1286`	`1286`	`throw new InvalidParameterValueException("Invalid Kubernetes cluster ID specified");`
`1287`	`1287`	`}`
	`1288`	`+ Account caller = CallContext.current().getCallingAccount();`
	`1289`	`+ accountManager.checkAccess(caller, SecurityChecker.AccessType.OperateEntry, false, kubernetesCluster);`
`1288`	`1290`	`KubernetesClusterConfigResponse response = new KubernetesClusterConfigResponse();`
`1289`	`1291`	`response.setId(kubernetesCluster.getUuid());`
`1290`	`1292`	`response.setName(kubernetesCluster.getName());`