APIServer does not validate parent resource apiGroup and apiVersion in scoped resource paths

[JoseSzycho]

APIServer does not validate parent resource apiGroup and apiVersion in scoped resource paths

Description

The Milo APIServer is not validating the apiGroup and apiVersion segments when accessing project-scoped or organization-scoped resources. This allows requests with invalid or arbitrary values to succeed and return data.

Steps to Reproduce

1. Make a request with valid parent resource path:

kubectl --kubeconfig datumstaging get --raw \
  /apis/resourcemanager.miloapis.com/v1alpha1/projects/test-mdqzir/control-plane/apis/dns.networking.miloapis.com/v1alpha1/dnszoneclasses

2. Make a request with invalid parent resource apiGroup and apiVersion:

kubectl --kubeconfig datumstaging get --raw \
  /apis/invalidGroup/invalidVersion/projects/test-mdqzir/control-plane/apis/dns.networking.miloapis.com/v1alpha1/dnszoneclasses

Expected Behavior

The second request should return a 404 Not Found or 400 Bad Request error since invalidGroup/invalidVersion is not a valid apiGroup/apiVersion combination.

[JoseSzycho]

@zachsmith1 FYI

[zachsmith1]

@JoseSzycho I believe the auth webhook would validate this for us but we can likely add some additional checks. Were you running this inside the cluster with the admin kubeconfig?

[JoseSzycho]

@zachsmith1 I was running this as an staff user, with a Datum Access token.

It was odd that using a non existent parent resource brings the exact same resource as when using the correct endpoint

[zachsmith1]

@JoseSzycho looks like org should be handling this correctly. can you confirm its just projects? for projects we were not checking group/version so thats why. here is the fix: #445

[zachsmith1]

also, if you were running this inside the cluster you wouldn't get blocked by the auth provider. guessing external users wouldn't see this issue?

[JoseSzycho]

Hey, sorry for the delay in the reply. I was not running inside the cluster. I made an API call outside the cluster using a kubeconfing generated by datumctl