if (request.authenticationData) {
ok := validate(etc);
if (!ok) {
return authenticationFailure;
}
}
void doFoo(PermissionToDoFoo permission, ...){...}
from request import getAuth, respond
\\ Maybe<AuthenticationData> getAuth(Request request)
\\ void respond(String response)
from permissions import askForPermissionToDoFoo
\\ Maybe<PermissionToDoFoo> askForPermissionToDoFoo(AuthenticationData auth)
response =
try
auth <- getAuth(request)
permission <- askForPermissionToDoFoo(auth)
doFoo(permission)
"Success!"
fail
"Oopsie!"
respond(response)
[1] - https://en.wikipedia.org/wiki/Midori_(operating_system)
If there is no authenticationData then the if !Ok is never run and the code continues execution as it were authenticated.
Link to the patch fixing it: https://github.com/kubernetes/kubernetes/commit/7fef0a4f6a44...
Of course, we'd already fixed other issues like Kubelet listening on a secondary debug port with no authentication. Those problems stemmed from its origins as a make-it-possible hacker project and it took a while to pivot it to something usable in an enterprise.
Correct. The only thing that changed is the number of level of abstractions.