Impersonate only ACE extras

go.mod

@@ -42,7 +42,7 @@ require (
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	kmodules.xyz/apiversion v0.2.0
 	kmodules.xyz/authorizer v0.34.0
-	kmodules.xyz/client-go v0.34.5
+	kmodules.xyz/client-go v0.34.6-0.20260728083845-0d1ff93aa771
 	kmodules.xyz/custom-resources v0.34.0
 	kmodules.xyz/go-containerregistry v0.0.15
 	kmodules.xyz/monitoring-agent-api v0.34.3

go.sum

@@ -1175,8 +1175,8 @@ kmodules.xyz/apply v0.34.0 h1:n6kAuHKAg3uzrlJccaAhjq/O4DdeiKqig9ElzoBXfzU=
 kmodules.xyz/apply v0.34.0/go.mod h1:V8B55uphISoKUHWAfyntveZFEkey6WxVP3cnXOvX4eY=
 kmodules.xyz/authorizer v0.34.0 h1:WEDyKac9u/xmYkdrVtZqUTk4x0+8T8FYPslf3O8cNfU=
 kmodules.xyz/authorizer v0.34.0/go.mod h1:b/aqy4e81jp/Nz0hfmOSHLr1+qUMJ0y6YMkEZ2PtoRo=
-kmodules.xyz/client-go v0.34.5 h1:mzhSQxKwGDXcEiUtABwqTNu5tVc3KsKc53foW5PHbT0=
-kmodules.xyz/client-go v0.34.5/go.mod h1:myCt7AfRao4PBdUtKXu01xxbqqmLZ5U8fW0LQDaifhQ=
+kmodules.xyz/client-go v0.34.6-0.20260728083845-0d1ff93aa771 h1:aInLVWuHm216MQ2hY215HWqyWYwRLDN+8Ty+TMG0Q0I=
+kmodules.xyz/client-go v0.34.6-0.20260728083845-0d1ff93aa771/go.mod h1:TGfM3P0jfFJUoVii8DTNE4An/E5mN9BRhddHDUb0zZY=
 kmodules.xyz/crd-schema-fuzz v0.34.1 h1:YfrFv9LcrVW54BhFSekFAyEuWxp09wic1j8xm3c41T0=
 kmodules.xyz/crd-schema-fuzz v0.34.1/go.mod h1:uer6PA1mrDk4SI6C+kZ2vNZFPZhHvgahuf+YRVKQiHo=
 kmodules.xyz/custom-resources v0.34.0 h1:ljkIYzIq0A3Awj87kkpuYqS9aifuyR3Hr9q2OVKoojM=

pkg/registry/editor/editormodel/storage.go

@@ -90,20 +90,25 @@ func (r *Storage) callerClient(ctx context.Context) (client.Client, error) {
 	return client.New(cfg, client.Options{Scheme: r.scheme, Mapper: r.mapper})
 }
 
-// impersonableExtra drops the reserved authentication.kubernetes.io/* extras
-// (e.g. credential-id added for X509/SA auth on k8s >=1.30). These are injected
-// by the apiserver and impersonating them needs a dedicated userextras RBAC verb
-// that kube-ui-server does not hold; they carry no authorization identity.
+// aceExtraPrefix is the only extra-key namespace kube-ui-server holds
+// `impersonate` on `userextras/<key>` for.
+const aceExtraPrefix = "ace.appscode.com/"
+
+// impersonableExtra keeps only the ACE extras. Every other extra key is provider
+// bookkeeping the apiserver or the platform injected -- Rancher's principalid,
+// EKS' arn, the reserved authentication.kubernetes.io/* keys -- and impersonating
+// any of them needs a userextras/<key> RBAC grant kube-ui-server does not hold,
+// which would fail the whole request in impersonation authorization. They carry
+// no identity for RBAC, which ignores extras.
 func impersonableExtra(in map[string][]string) map[string][]string {
-	if len(in) == 0 {
-		return nil
-	}
 	out := make(map[string][]string, len(in))
 	for k, v := range in {
-		if strings.HasPrefix(k, "authentication.kubernetes.io/") {
-			continue
+		if strings.HasPrefix(k, aceExtraPrefix) {
+			out[k] = v
 		}
-		out[k] = v
+	}
+	if len(out) == 0 {
+		return nil
 	}
 	return out
 }

vendor/kmodules.xyz/client-go/Makefile

@@ -23,7 +23,7 @@ CODE_GENERATOR_IMAGE ?= ghcr.io/appscode/gengo:release-1.32
 
 # This version-strategy uses git tags to set the version string
 git_branch       := $(shell git rev-parse --abbrev-ref HEAD)
-git_tag          := $(shell git describe --exact-match --abbrev=0 2>/dev/null || echo "")
+git_tag          := $(shell git describe --tags --exact-match --abbrev=0 2>/dev/null || echo "")
 commit_hash      := $(shell git rev-parse --verify HEAD)
 commit_timestamp := $(shell date --date="@$$(git show -s --format=%ct)" --utc +%FT%T)
 

vendor/kmodules.xyz/client-go/client/delegated.go

@@ -100,13 +100,38 @@ func (d *DelegatingClient) RestConfig() *restclient.Config {
 	return d.config
 }
 
+// aceExtraPrefix is the only extra-key namespace impersonated identities carry
+// through. See impersonableExtra.
+const aceExtraPrefix = "ace.appscode.com/"
+
+// impersonableExtra keeps only the ACE extras. Every other extra key is provider
+// bookkeeping injected by the apiserver or the platform -- Rancher's principalid,
+// EKS' arn, the reserved authentication.kubernetes.io/* keys -- and impersonating
+// any of them needs an `impersonate` grant on userextras/<key> that callers do not
+// hold, which fails the whole request during impersonation authorization. RBAC
+// ignores extras, so dropping them changes no authorization decision.
+func impersonableExtra(in map[string][]string) map[string][]string {
+	out := make(map[string][]string, len(in))
+	for k, v := range in {
+		if strings.HasPrefix(k, aceExtraPrefix) {
+			out[k] = v
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
 func (d *DelegatingClient) Impersonate(u user.Info) (*restclient.Config, client.Client, error) {
+	extra := impersonableExtra(u.GetExtra())
+
 	config := restclient.CopyConfig(d.config)
 	config.Impersonate = restclient.ImpersonationConfig{
 		UserName: u.GetName(),
 		UID:      u.GetUID(),
 		Groups:   u.GetGroups(),
-		Extra:    u.GetExtra(),
+		Extra:    extra,
 	}
 
 	// share the transport between all clients
@@ -117,7 +142,7 @@ func (d *DelegatingClient) Impersonate(u user.Info) (*restclient.Config, client.
 				UserName: u.GetName(),
 				UID:      u.GetUID(),
 				Groups:   u.GetGroups(),
-				Extra:    u.GetExtra(),
+				Extra:    extra,
 			}, d.options.HTTPClient.Transport),
 		}
 	}

vendor/kmodules.xyz/client-go/discovery/lib.go

@@ -223,7 +223,8 @@ func IsDefaultSupportedVersion(kc kubernetes.Interface) error {
 		kc,
 		DefaultConstraint,
 		DefaultBlackListedVersions,
-		DefaultBlackListedMultiMasterVersions)
+		DefaultBlackListedMultiMasterVersions,
+	)
 }
 
 func IsSupportedVersion(kc kubernetes.Interface, constraint string, blackListedVersions map[string]error, blackListedMultiMasterVersions map[string]error) error {

vendor/kmodules.xyz/client-go/meta/preconditions.go

@@ -37,7 +37,8 @@ func (s PreConditionSet) PreconditionFunc() []mergepatch.PreconditionFunc {
 	}
 
 	for _, field := range sets.List[string](s.Set) {
-		preconditions = append(preconditions,
+		preconditions = append(
+			preconditions,
 			RequireChainKeyUnchanged(field),
 		)
 	}

vendor/kmodules.xyz/client-go/openapi/render.go

@@ -86,7 +86,8 @@ func RenderOpenAPISpec(cfg Config) (string, error) {
 
 	// TODO: keep the generic API server from wanting this
 	unversioned := schema.GroupVersion{Group: "", Version: "v1"}
-	cfg.Scheme.AddUnversionedTypes(unversioned,
+	cfg.Scheme.AddUnversionedTypes(
+		unversioned,
 		&metav1.Status{},
 		&metav1.APIVersions{},
 		&metav1.APIGroupList{},

vendor/modules.txt

@@ -2580,8 +2580,8 @@ kmodules.xyz/authorizer/apiserver
 kmodules.xyz/authorizer/rbac
 kmodules.xyz/authorizer/rbac/helpers
 kmodules.xyz/authorizer/rbac/validation
-# kmodules.xyz/client-go v0.34.5
-## explicit; go 1.24.0
+# kmodules.xyz/client-go v0.34.6-0.20260728083845-0d1ff93aa771
+## explicit; go 1.25.0
 kmodules.xyz/client-go
 kmodules.xyz/client-go/api/v1
 kmodules.xyz/client-go/apiextensions