Additional checks for security concerns during Import YAML and Template process

[jwforres]

Also enables the ability to create cluster scoped resources from Import YAML

Implements https://trello.com/c/RCU304BD

[jwforres]

@spadgett think this is ready for a first pass

@liggitt FYI

[spadgett]

Did you mean to bump this?

[jwforres]

Yes, won't be able to create cluster resources without this.

[spadgett]

Right of course :)

[spadgett]

Probably want to make sure there are no duplicates in case the same kind appears in the list twice. Also suggest _.map here.

var clusterStrs = _.uniq(_.map(clusterScopedResources, function(resource) {
  return humanizeKind(resource.kind);
}));

[spadgett]

The role name in this message I'm more worried about than the other. It might be a role created in the same YAML/template and sound harmless, but isn't. I'd just say it will add roles to subject-names.

[jwforres]

@spadgett ok think this is ready for final review, added a uniq call for roleBindingStrs as well since its only showing the subjects now

[smarterclayton]

Here's what I think the whitelist should be:

    * buildconfigs (aka 'bc')
    * builds
    * configmaps (aka 'cm')
    * daemonsets (aka 'ds')
    * deployments (aka 'deploy')
    * deploymentconfigs (aka 'dc')
    * endpoints (aka 'ep')
    * events (aka 'ev')
    * horizontalpodautoscalers (aka 'hpa')
    * imagestreamimages (aka 'isimage')
    * imagestreams (aka 'is')
    * imagestreamtags (aka 'istag')
    * ingresses (aka 'ing')
    * jobs
    * persistentvolumeclaims (aka 'pvc')
    * pods (aka 'po')
    * podtemplates
    * replicasets (aka 'rs')
    * replicationcontrollers (aka 'rc')
    * routes
    * secrets
    * serviceaccounts (aka 'sa')
    * services (aka 'svc')
    * statefulsets

If you're not in this list, you get warned

[jwforres]

@spadgett added a second commit with the feedback from @smarterclayton

can you review those changes, and then i'll squash and rebuild the dist

[jwforres]

I put the whitelist in Constants just in case someone yells, but I don't think I want to document it exists

[spadgett]

Second commit looks good to me

[smarterclayton]

Thank you for your tolerance of my opinions :)

[jwforres]

[merge]

[openshift-bot]

Evaluated for origin web console merge up to fb82c39

[openshift-bot]

Origin Web Console Merge Results: SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_requests_origin_web_console/1145/) (Base Commit: d733d79)