virtual/apiexport: pass through request user with additional warrent …

…for the target workspace

Signed-off-by: Dr. Stefan Schimanski <[email protected]>

pkg/virtual/apiexport/builder/build.go

@@ -18,14 +18,14 @@ package builder
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"strings"
 
 	kcpdynamic "github.com/kcp-dev/client-go/dynamic"
 	kcpkubernetesclientset "github.com/kcp-dev/client-go/kubernetes"
 	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apiserver/pkg/authentication/serviceaccount"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
@@ -100,19 +100,41 @@ func BuildVirtualWorkspace(
 					return nil, fmt.Errorf("error getting valid cluster from context: %w", err)
 				}
 
+				user, found := genericapirequest.UserFrom(ctx)
+				if !found {
+					return nil, fmt.Errorf("error getting user from context")
+				}
+
 				// Wildcard requests cannot be impersonated against a concrete cluster.
 				if cluster.Wildcard {
 					return dynamicClient, nil
 				}
 
-				impersonationConfig := rest.CopyConfig(cfg)
-				impersonationConfig.Impersonate = rest.ImpersonationConfig{
-					UserName: "system:serviceaccount:default:rest",
-					Groups:   []string{bootstrap.SystemKcpAdminGroup},
+				// Add a warrant of a fake local service account giving full access
+				warrant := authorization.Warrant{
+					User:   "system:serviceaccount:default:rest",
+					Groups: []string{bootstrap.SystemKcpAdminGroup},
 					Extra: map[string][]string{
 						serviceaccount.ClusterNameKey: {cluster.Name.Path().String()},
 					},
 				}
+				bs, err := json.Marshal(warrant)
+				if err != nil {
+					return nil, fmt.Errorf("error marshaling warrant: %w", err)
+				}
+
+				// Impersonate the request user and add the warrant as an extra
+				impersonationConfig := rest.CopyConfig(cfg)
+				impersonationConfig.Impersonate = rest.ImpersonationConfig{
+					UserName: user.GetName(),
+					Groups:   user.GetGroups(),
+					UID:      user.GetUID(),
+					Extra:    user.GetExtra(),
+				}
+				if impersonationConfig.Impersonate.Extra == nil {
+					impersonationConfig.Impersonate.Extra = map[string][]string{}
+				}
+				impersonationConfig.Impersonate.Extra[authorization.WarrantExtraKey] = append(impersonationConfig.Impersonate.Extra[authorization.WarrantExtraKey], string(bs))
 				impersonatedClient, err := kcpdynamic.NewForConfig(impersonationConfig)
 				if err != nil {
 					return nil, fmt.Errorf("error generating dynamic client: %w", err)