Merge pull request #13345 from rhamilto/OCPBUGS-23248

OCPBUGS-23125: add access review for impersonate

Author: openshift-merge-bot[bot]

frontend/packages/console-dynamic-plugin-sdk/src/api/common-types.ts

@@ -101,7 +101,8 @@ type K8sVerb =
   | 'patch'
   | 'delete'
   | 'deletecollection'
-  | 'watch';
+  | 'watch'
+  | 'impersonate';
 
 enum BadgeType {
   DEV = 'Dev Preview',

frontend/packages/console-dynamic-plugin-sdk/src/extensions/console-types.ts

@@ -78,7 +78,8 @@ export type K8sVerb =
   | 'patch'
   | 'delete'
   | 'deletecollection'
-  | 'watch';
+  | 'watch'
+  | 'impersonate';
 
 export type AccessReviewResourceAttributes = {
   group?: string;

frontend/public/components/RBAC/bindings.jsx

@@ -146,6 +146,14 @@ const menuActions = ({ subjectIndex, subjects }, startImpersonate) => {
     actions.unshift(() => ({
       label: i18next.t('public~Impersonate {{kind}} "{{name}}"', subject),
       callback: () => startImpersonate(subject.kind, subject.name),
+      // Must use API group authorization.k8s.io, NOT user.openshift.io
+      // See https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation
+      accessReview: {
+        group: 'authorization.k8s.io',
+        resource: subject.kind === 'Group' ? 'groups' : 'users',
+        name: subject.name,
+        verb: 'impersonate',
+      },
     }));
   }
 

frontend/public/components/user.tsx

@@ -35,6 +35,14 @@ const UserKebab_: React.FC<UserKebabProps & UserKebabDispatchProps> = ({
   const impersonateAction: KebabAction = (kind: K8sKind, obj: UserKind) => ({
     label: t('public~Impersonate User {{name}}', obj.metadata),
     callback: () => startImpersonate('User', obj.metadata.name),
+    // Must use API group authorization.k8s.io, NOT user.openshift.io
+    // See https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation
+    accessReview: {
+      group: 'authorization.k8s.io',
+      resource: 'users',
+      name: obj.metadata.name,
+      verb: 'impersonate',
+    },
   });
   return (
     <ResourceKebab
@@ -218,6 +226,14 @@ const UserDetailsPage_: React.FC<UserDetailsPageProps & UserKebabDispatchProps>
   const impersonateAction: KebabAction = (kind: K8sKind, obj: UserKind) => ({
     label: t('public~Impersonate User {{name}}', obj.metadata),
     callback: () => startImpersonate('User', obj.metadata.name),
+    // Must use API group authorization.k8s.io, NOT user.openshift.io
+    // See https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation
+    accessReview: {
+      group: 'authorization.k8s.io',
+      resource: 'users',
+      name: obj.metadata.name,
+      verb: 'impersonate',
+    },
   });
   return (
     <DetailsPage