@@ -89,9 +89,10 @@ type K8sApplicationRestHandlerImpl struct {
8989 helmAppService client.HelmAppService
9090 userService user.UserService
9191 k8sCommonService k8s.K8sCommonService
92+ terminalEnvVariables * util.TerminalEnvVariables
9293}
9394
94- func NewK8sApplicationRestHandlerImpl (logger * zap.SugaredLogger , k8sApplicationService application2.K8sApplicationService , pump connector.Pump , terminalSessionHandler terminal.TerminalSessionHandler , enforcer casbin.Enforcer , enforcerUtilHelm rbac.EnforcerUtilHelm , enforcerUtil rbac.EnforcerUtil , helmAppService client.HelmAppService , userService user.UserService , k8sCommonService k8s.K8sCommonService , validator * validator.Validate ) * K8sApplicationRestHandlerImpl {
95+ func NewK8sApplicationRestHandlerImpl (logger * zap.SugaredLogger , k8sApplicationService application2.K8sApplicationService , pump connector.Pump , terminalSessionHandler terminal.TerminalSessionHandler , enforcer casbin.Enforcer , enforcerUtilHelm rbac.EnforcerUtilHelm , enforcerUtil rbac.EnforcerUtil , helmAppService client.HelmAppService , userService user.UserService , k8sCommonService k8s.K8sCommonService , validator * validator.Validate , envVariables * util. EnvironmentVariables ) * K8sApplicationRestHandlerImpl {
9596 return & K8sApplicationRestHandlerImpl {
9697 logger : logger ,
9798 k8sApplicationService : k8sApplicationService ,
@@ -104,6 +105,7 @@ func NewK8sApplicationRestHandlerImpl(logger *zap.SugaredLogger, k8sApplicationS
104105 helmAppService : helmAppService ,
105106 userService : userService ,
106107 k8sCommonService : k8sCommonService ,
108+ terminalEnvVariables : envVariables .TerminalEnvVariables ,
107109 }
108110}
109111
@@ -820,6 +822,17 @@ func (handler *K8sApplicationRestHandlerImpl) requestValidationAndRBAC(w http.Re
820822 }
821823}
822824
825+ func (handler * K8sApplicationRestHandlerImpl ) restrictTerminalAccessForNonSuperUsers (w http.ResponseWriter , token string ) bool {
826+ // if RESTRICT_TERMINAL_ACCESS_FOR_NON_SUPER_USER is set to true, only super admins can access terminal/ephemeral containers
827+ if handler .terminalEnvVariables .RestrictTerminalAccessForNonSuperUser {
828+ if isSuperAdmin := handler .enforcer .Enforce (token , casbin .ResourceGlobal , casbin .ActionGet , "*" ); ! isSuperAdmin {
829+ common .WriteJsonResp (w , errors .New ("unauthorized, only super-admins can access terminal" ), nil , http .StatusForbidden )
830+ return true
831+ }
832+ }
833+ return false
834+ }
835+
823836func (handler * K8sApplicationRestHandlerImpl ) GetTerminalSession (w http.ResponseWriter , r * http.Request ) {
824837 token := r .Header .Get ("token" )
825838 userId , err := handler .userService .GetLoggedInUser (r )
@@ -836,6 +849,11 @@ func (handler *K8sApplicationRestHandlerImpl) GetTerminalSession(w http.Response
836849 return
837850 }
838851 request .ExternalArgoApplicationName = vars .Get ("externalArgoApplicationName" )
852+ // check for super admin
853+ restricted := handler .restrictTerminalAccessForNonSuperUsers (w , token )
854+ if restricted {
855+ return
856+ }
839857 if resourceRequestBean .AppIdentifier != nil {
840858 // RBAC enforcer applying For Helm App
841859 rbacObject , rbacObject2 := handler .enforcerUtilHelm .GetHelmObjectByClusterIdNamespaceAndAppName (resourceRequestBean .AppIdentifier .ClusterId , resourceRequestBean .AppIdentifier .Namespace , resourceRequestBean .AppIdentifier .ReleaseName )
@@ -1013,6 +1031,7 @@ func (handler *K8sApplicationRestHandlerImpl) verifyRbacForCluster(token string,
10131031}
10141032
10151033func (handler * K8sApplicationRestHandlerImpl ) CreateEphemeralContainer (w http.ResponseWriter , r * http.Request ) {
1034+ token := r .Header .Get ("token" )
10161035 userId , err := handler .userService .GetLoggedInUser (r )
10171036 if userId == 0 || err != nil {
10181037 common .WriteJsonResp (w , err , "Unauthorized User" , http .StatusUnauthorized )
@@ -1034,6 +1053,11 @@ func (handler *K8sApplicationRestHandlerImpl) CreateEphemeralContainer(w http.Re
10341053 common .WriteJsonResp (w , err , nil , http .StatusBadRequest )
10351054 return
10361055 }
1056+ // check for super admin
1057+ restricted := handler .restrictTerminalAccessForNonSuperUsers (w , token )
1058+ if restricted {
1059+ return
1060+ }
10371061 //rbac applied in below function
10381062 resourceRequestBean := handler .handleEphemeralRBAC (request .PodName , request .Namespace , w , r )
10391063 if resourceRequestBean == nil {
@@ -1057,6 +1081,7 @@ func (handler *K8sApplicationRestHandlerImpl) CreateEphemeralContainer(w http.Re
10571081}
10581082
10591083func (handler * K8sApplicationRestHandlerImpl ) DeleteEphemeralContainer (w http.ResponseWriter , r * http.Request ) {
1084+ token := r .Header .Get ("token" )
10601085 userId , err := handler .userService .GetLoggedInUser (r )
10611086 if userId == 0 || err != nil {
10621087 common .WriteJsonResp (w , err , "Unauthorized User" , http .StatusUnauthorized )
@@ -1078,6 +1103,11 @@ func (handler *K8sApplicationRestHandlerImpl) DeleteEphemeralContainer(w http.Re
10781103 common .WriteJsonResp (w , err , nil , http .StatusBadRequest )
10791104 return
10801105 }
1106+ // check for super admin
1107+ restricted := handler .restrictTerminalAccessForNonSuperUsers (w , token )
1108+ if restricted {
1109+ return
1110+ }
10811111 //rbac applied in below function
10821112 resourceRequestBean := handler .handleEphemeralRBAC (request .PodName , request .Namespace , w , r )
10831113 if resourceRequestBean == nil {
0 commit comments