diff --git a/pkg/build/admission/admission.go b/pkg/build/admission/admission.go index abe466d0f115..3cb249aeeb3a 100644 --- a/pkg/build/admission/admission.go +++ b/pkg/build/admission/admission.go @@ -49,6 +49,11 @@ func (a *buildByStrategy) Admit(attr admission.Attributes) error { if resource := attr.GetResource(); resource != buildsResource && resource != buildConfigsResource { return nil } + // Explicitly exclude the builds/details subresource because it's only + // updating commit info and cannot change build type. + if attr.GetResource() == buildsResource && attr.GetSubresource() == "details" { + return nil + } switch obj := attr.GetObject().(type) { case *buildapi.Build: return a.checkBuildAuthorization(obj, attr) diff --git a/pkg/build/admission/admission_test.go b/pkg/build/admission/admission_test.go index 779e4ee406dc..03eb7d0060fc 100644 --- a/pkg/build/admission/admission_test.go +++ b/pkg/build/admission/admission_test.go @@ -128,6 +128,15 @@ func TestBuildAdmission(t *testing.T) { expectAccept: false, expectedError: "Internal error occurred: [Unrecognized request object &admission.fakeObject{}, couldn't find ObjectMeta field in admission.fakeObject{}]", }, + { + name: "details on forbidden docker build", + object: testBuild(buildapi.BuildStrategy{DockerStrategy: &buildapi.DockerBuildStrategy{}}), + kind: "Build", + resource: buildsResource, + subResource: "details", + reviewResponse: reviewResponse(false, "cannot create build of type docker build"), + expectAccept: true, + }, } ops := []admission.Operation{admission.Create, admission.Update}