GO-2026-6568: Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener

tolerationrestriction

package

v1.151.3 Latest Latest Go to latest Published: Oct 8, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Details

This section is empty.

This section is empty.

func LoadConfiguration(config io.Reader) (*shoottolerationrestriction.Configuration, error)

LoadConfiguration loads the provided configuration.

func Register(plugins *admission.Plugins)

Register registers a plugin.

type TolerationRestriction struct {
	*admission.Handler
	// contains filtered or unexported fields
}

TolerationRestriction contains listers and admission handler.

func New(config *shoottolerationrestriction.Configuration) (*TolerationRestriction, error)

New creates a new TolerationRestriction admission plugin.

func (t *TolerationRestriction) Admit(_ context.Context, a admission.Attributes, _ admission.ObjectInterfaces) error

Admit defaults shoot tolerations with both global and project defaults.

func (t *TolerationRestriction) AssignReadyFunc(f admission.ReadyFunc)

AssignReadyFunc assigns the ready function to the admission handler.

func (t *TolerationRestriction) SetCoreInformerFactory(f gardencoreinformers.SharedInformerFactory)

SetCoreInformerFactory sets the internal garden core informer factory.

func (t *TolerationRestriction) Validate(_ context.Context, a admission.Attributes, _ admission.ObjectInterfaces) error

Validate makes admissions decisions based on the allowed project tolerations or globally allowed tolerations.

func (t *TolerationRestriction) ValidateInitialization() error

ValidateInitialization checks whether the plugin was correctly initialized.

Path	Synopsis
apis
shoottolerationrestriction
shoottolerationrestriction/install
shoottolerationrestriction/v1alpha1
shoottolerationrestriction/validation