diff --git a/pkg/apis/user/v1/user_types.go b/pkg/apis/user/v1/user_types.go index d9ec1edf..789cf095 100644 --- a/pkg/apis/user/v1/user_types.go +++ b/pkg/apis/user/v1/user_types.go @@ -130,3 +130,14 @@ type UserList struct { func init() { SchemeBuilder.Register(&User{}, &UserList{}) } + +func (u *User) IsUserPlatformScope() bool { + platformScope := false + for _, scope := range u.Spec.ScopeBindings { + if scope.ScopeType == PlatformScope { + platformScope = true + break + } + } + return platformScope +} diff --git a/pkg/apiserver/cubeapi/authorization/handler.go b/pkg/apiserver/cubeapi/authorization/handler.go index 9f72be81..f190bd73 100644 --- a/pkg/apiserver/cubeapi/authorization/handler.go +++ b/pkg/apiserver/cubeapi/authorization/handler.go @@ -597,6 +597,7 @@ func getUserProjects(user *user.User, projectList *tenantv1.ProjectList, tenantA projectSet.Insert(p.Project) } tenantSet := sets.NewString(user.Status.BelongTenants...) + isUserPlatform := user.IsUserPlatformScope() for _, p := range projectList.Items { t, ok := p.Labels[constants.TenantLabel] @@ -607,7 +608,7 @@ func getUserProjects(user *user.User, projectList *tenantv1.ProjectList, tenantA // 1. user is platform admin // 2. user's belong projects had this queried project // 3. user's belong tenants had this queried tenant - if !user.Status.PlatformAdmin && !projectSet.Has(p.Name) && !tenantSet.Has(t) { + if !isUserPlatform && !user.Status.PlatformAdmin && !projectSet.Has(p.Name) && !tenantSet.Has(t) { continue } diff --git a/pkg/apiserver/cubeapi/authorization/helper.go b/pkg/apiserver/cubeapi/authorization/helper.go index 15113fb8..1a87154a 100644 --- a/pkg/apiserver/cubeapi/authorization/helper.go +++ b/pkg/apiserver/cubeapi/authorization/helper.go @@ -272,7 +272,7 @@ func GetVisibleTenants(ctx context.Context, cli mgrclient.Client, username strin return nil, err } - if user.Status.PlatformAdmin { + if user.Status.PlatformAdmin || user.IsUserPlatformScope() { return tenants.Items, nil }