GO-2026-6568: Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener

graph

package

v1.151.4 Latest Latest Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 42 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/gardener/gardener

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func New(logger logr.Logger, client client.Client, forSelfHostedShoots bool) *graph
func NewDebugHandler(graph *graph) http.HandlerFunc
type Interface
type KindObject
type Vertex
- func (v *Vertex) ID() int64
- func (v *Vertex) String() string
type VertexType

Constants ¶

View Source

const DebugHandlerPath = "/debug/resource-dependency-graph"

DebugHandlerPath is the HTTP handler path for this debug handler.

Variables ¶

View Source

var VertexTypes = map[VertexType]KindObject{
	VertexTypeBackupBucket:              {Kind: "BackupBucket", NewObjectFunc: func() client.Object { return &gardencorev1beta1.BackupBucket{} }},
	VertexTypeBackupEntry:               {Kind: "BackupEntry", NewObjectFunc: func() client.Object { return &gardencorev1beta1.BackupEntry{} }},
	VertexTypeBastion:                   {Kind: "Bastion", NewObjectFunc: func() client.Object { return &operationsv1alpha1.Bastion{} }},
	VertexTypeCertificateSigningRequest: {Kind: "CertificateSigningRequest", NewObjectFunc: func() client.Object { return &certificatesv1.CertificateSigningRequest{} }},
	VertexTypeCredentialsBinding:        {Kind: "CredentialsBinding", NewObjectFunc: func() client.Object { return &securityv1alpha1.CredentialsBinding{} }},
	VertexTypeCloudProfile:              {Kind: "CloudProfile", NewObjectFunc: func() client.Object { return &gardencorev1beta1.CloudProfile{} }},
	VertexTypeNamespacedCloudProfile:    {Kind: "NamespacedCloudProfile", NewObjectFunc: func() client.Object { return &gardencorev1beta1.NamespacedCloudProfile{} }},
	VertexTypeClusterRoleBinding:        {Kind: "ClusterRoleBinding", NewObjectFunc: func() client.Object { return &rbacv1.ClusterRoleBinding{} }},
	VertexTypeConfigMap:                 {Kind: "ConfigMap", NewObjectFunc: func() client.Object { return &corev1.ConfigMap{} }},
	VertexTypeControllerDeployment:      {Kind: "ControllerDeployment", NewObjectFunc: func() client.Object { return &gardencorev1.ControllerDeployment{} }},
	VertexTypeControllerInstallation:    {Kind: "ControllerInstallation", NewObjectFunc: func() client.Object { return &gardencorev1beta1.ControllerInstallation{} }},
	VertexTypeControllerRegistration:    {Kind: "ControllerRegistration", NewObjectFunc: func() client.Object { return &gardencorev1beta1.ControllerRegistration{} }},
	VertexTypeExposureClass:             {Kind: "ExposureClass", NewObjectFunc: func() client.Object { return &gardencorev1beta1.ExposureClass{} }},
	VertexTypeGardenlet:                 {Kind: "Gardenlet", NewObjectFunc: func() client.Object { return &seedmanagementv1alpha1.Gardenlet{} }},
	VertexTypeInternalSecret:            {Kind: "InternalSecret", NewObjectFunc: func() client.Object { return &gardencorev1beta1.InternalSecret{} }},
	VertexTypeLease:                     {Kind: "Lease", NewObjectFunc: func() client.Object { return &coordinationv1.Lease{} }},
	VertexTypeManagedSeed:               {Kind: "ManagedSeed", NewObjectFunc: func() client.Object { return &seedmanagementv1alpha1.ManagedSeed{} }},
	VertexTypeNamespace:                 {Kind: "Namespace", NewObjectFunc: func() client.Object { return &corev1.Namespace{} }},
	VertexTypeProject:                   {Kind: "Project", NewObjectFunc: func() client.Object { return &gardencorev1beta1.Project{} }},
	VertexTypeSecret:                    {Kind: "Secret", NewObjectFunc: func() client.Object { return &corev1.Secret{} }},
	VertexTypeSecretBinding:             {Kind: "SecretBinding", NewObjectFunc: func() client.Object { return &gardencorev1beta1.SecretBinding{} }},
	VertexTypeSeed:                      {Kind: "Seed", NewObjectFunc: func() client.Object { return &gardencorev1beta1.Seed{} }},
	VertexTypeServiceAccount:            {Kind: "ServiceAccount", NewObjectFunc: func() client.Object { return &corev1.ServiceAccount{} }},
	VertexTypeShoot:                     {Kind: "Shoot", NewObjectFunc: func() client.Object { return &gardencorev1beta1.Shoot{} }},
	VertexTypeShootState:                {Kind: "ShootState", NewObjectFunc: func() client.Object { return &gardencorev1beta1.ShootState{} }},
	VertexTypeWorkloadIdentity:          {Kind: "WorkloadIdentity", NewObjectFunc: func() client.Object { return &securityv1alpha1.WorkloadIdentity{} }},
}

VertexTypes maps a vertex type to its kind and a function for creation of a new client.Object.

Functions ¶

func New ¶

func New(logger logr.Logger, client client.Client, forSelfHostedShoots bool) *graph

New creates a new graph interface for tracking resource dependencies.

func NewDebugHandler ¶

func NewDebugHandler(graph *graph) http.HandlerFunc

NewDebugHandler creates a new HTTP handler for debugging the resource dependency graph.

Types ¶

type Interface ¶

type Interface interface {
	// Setup registers the event handler functions for the various resource types.
	Setup(ctx context.Context, c cache.Cache) error
	// HasVertex returns true when the given vertex exists in the graph.
	HasVertex(vertexType VertexType, vertexNamespace, vertexName string) bool
	// HasPathFrom returns true when there is a path from <from> to <to>.
	HasPathFrom(fromType VertexType, fromNamespace, fromName string, toType VertexType, toNamespace, toName string) bool
	// Nodes returns all nodes of the graph.
	Nodes() gonumgraph.Nodes
	// Visit loops over all nodes in the graph.
	Visit(nodes gonumgraph.Nodes, visitor func(gonumgraph.Node))
}

Interface is used to track resources dependencies.

type KindObject ¶

type KindObject struct {
	Kind          string
	NewObjectFunc func() client.Object
}

KindObject contains the object kind and a function for creating a new client.Object.

type Vertex ¶

type Vertex struct {
	Type      VertexType
	Namespace string
	Name      string
	// contains filtered or unexported fields
}

Vertex contains the type, namespace, and name of a vertex in the graph.

func (*Vertex) ID ¶

func (v *Vertex) ID() int64

ID returns the unique identifier of the vertex.

func (*Vertex) String ¶

func (v *Vertex) String() string

String returns the string representation of the vertex, which includes its type, namespace, and name.

type VertexType ¶

type VertexType byte

VertexType is a type for specific vertices.

const (
	// VertexTypeBackupBucket is a constant for a 'BackupBucket' vertex.
	VertexTypeBackupBucket VertexType = iota
	// VertexTypeBackupEntry is a constant for a 'BackupEntry' vertex.
	VertexTypeBackupEntry
	// VertexTypeBastion is a constant for a 'Bastion' vertex.
	VertexTypeBastion
	// VertexTypeCertificateSigningRequest is a constant for a 'CertificateSigningRequest' vertex.
	VertexTypeCertificateSigningRequest
	// VertexTypeCloudProfile is a constant for a 'CloudProfile' vertex.
	VertexTypeCloudProfile
	// VertexTypeNamespacedCloudProfile is a constant for a 'NamespacedCloudProfile' vertex.
	VertexTypeNamespacedCloudProfile
	// VertexTypeClusterRoleBinding is a constant for a 'ClusterRoleBinding' vertex.
	VertexTypeClusterRoleBinding
	// VertexTypeConfigMap is a constant for a 'ConfigMap' vertex.
	VertexTypeConfigMap
	// VertexTypeControllerDeployment is a constant for a 'ControllerDeployment' vertex.
	VertexTypeControllerDeployment
	// VertexTypeControllerInstallation is a constant for a 'ControllerInstallation' vertex.
	VertexTypeControllerInstallation
	// VertexTypeControllerRegistration is a constant for a 'ControllerRegistration' vertex.
	VertexTypeControllerRegistration
	// VertexTypeExposureClass is a constant for a 'ExposureClass' vertex.
	VertexTypeExposureClass
	// VertexTypeInternalSecret is a constant for a 'InternalSecret' vertex.
	VertexTypeInternalSecret
	// VertexTypeLease is a constant for a 'Lease' vertex.
	VertexTypeLease
	// VertexTypeManagedSeed is a constant for a 'ManagedSeed' vertex.
	VertexTypeManagedSeed
	// VertexTypeNamespace is a constant for a 'Namespace' vertex.
	VertexTypeNamespace
	// VertexTypeProject is a constant for a 'Project' vertex.
	VertexTypeProject
	// VertexTypeSecret is a constant for a 'Secret' vertex.
	VertexTypeSecret
	// VertexTypeSecretBinding is a constant for a 'SecretBinding' vertex.
	VertexTypeSecretBinding
	// VertexTypeSeed is a constant for a 'Seed' vertex.
	VertexTypeSeed
	// VertexTypeServiceAccount is a constant for a 'ServiceAccount' vertex.
	VertexTypeServiceAccount
	// VertexTypeShoot is a constant for a 'Shoot' vertex.
	VertexTypeShoot
	// VertexTypeShootState is a constant for a 'ShootState' vertex.
	VertexTypeShootState
	// VertexTypeGardenlet is a constant for a 'Gardenlet' vertex.
	VertexTypeGardenlet
	// VertexTypeCredentialsBinding is a constant for a 'CredentialsBinding' vertex.
	VertexTypeCredentialsBinding
	// VertexTypeWorkloadIdentity is a constant for a 'WorkloadIdentity' vertex.
	VertexTypeWorkloadIdentity
)

Directories ¶

Path	Synopsis
mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL