mirror of
https://github.com/portainer/portainer.git
synced 2025-07-19 13:29:41 +02:00
51ef2c2aa9
* fix(advance deploy): EE-1141 A standard user can escalate to cluster administrator privileges on Kubernetes * fix(advance deploy): EE-1141 reuse existing token cache when do deployment * fix: EE-1141 use user's SA token to exec pod command * fix: EE-1141 stop advanced-deploy or pod-exec if user's SA token is empty * fix: EE-1141 resolve merge conflicts Co-authored-by: Simon Meng <simon.meng@portainer.io>
40 lines
1.5 KiB
Go
40 lines
1.5 KiB
Go
package websocket
|
|
|
|
import (
|
|
"github.com/gorilla/mux"
|
|
"github.com/gorilla/websocket"
|
|
httperror "github.com/portainer/libhttp/error"
|
|
portainer "github.com/portainer/portainer/api"
|
|
"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
|
|
"github.com/portainer/portainer/api/http/security"
|
|
"github.com/portainer/portainer/api/kubernetes/cli"
|
|
)
|
|
|
|
// Handler is the HTTP handler used to handle websocket operations.
|
|
type Handler struct {
|
|
*mux.Router
|
|
DataStore portainer.DataStore
|
|
SignatureService portainer.DigitalSignatureService
|
|
ReverseTunnelService portainer.ReverseTunnelService
|
|
KubernetesClientFactory *cli.ClientFactory
|
|
requestBouncer *security.RequestBouncer
|
|
connectionUpgrader websocket.Upgrader
|
|
kubernetesTokenCacheManager *kubernetes.TokenCacheManager
|
|
}
|
|
|
|
// NewHandler creates a handler to manage websocket operations.
|
|
func NewHandler(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, bouncer *security.RequestBouncer) *Handler {
|
|
h := &Handler{
|
|
Router: mux.NewRouter(),
|
|
connectionUpgrader: websocket.Upgrader{},
|
|
requestBouncer: bouncer,
|
|
kubernetesTokenCacheManager: kubernetesTokenCacheManager,
|
|
}
|
|
h.PathPrefix("/websocket/exec").Handler(
|
|
bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketExec)))
|
|
h.PathPrefix("/websocket/attach").Handler(
|
|
bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketAttach)))
|
|
h.PathPrefix("/websocket/pod").Handler(
|
|
bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.websocketPodExec)))
|
|
return h
|
|
}
|