permissions

Documentation

Index

• Constants
• func NewPreflight(depsFactory cmdcore.DepsFactory, enabled bool) preflight.Check
• func RulesForBinding(ctx context.Context, rbacClient rbacv1client.RbacV1Interface, ...) ([]rbacv1.PolicyRule, error)
• func RulesForClusterRoleBinding(ctx context.Context, crGetter rbacv1client.ClusterRolesGetter, ...) ([]rbacv1.PolicyRule, error)
• func RulesForRole(res ctlres.Resource) ([]rbacv1.PolicyRule, error)
• func RulesForRoleBinding(ctx context.Context, rbacClient rbacv1client.RbacV1Interface, ...) ([]rbacv1.PolicyRule, error)
• type BasicValidator
  • func NewBasicValidator(pv PermissionValidator, mapper meta.RESTMapper) *BasicValidator
  • func (bv *BasicValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error
• type BindingValidator
  • func NewBindingValidator(pv PermissionValidator, rbacClient rbacv1client.RbacV1Interface, ...) *BindingValidator
  • func (bv *BindingValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error
• type CompositeValidator
  • func NewCompositeValidator(defaultValidator Validator, validators map[schema.GroupVersionKind]Validator) *CompositeValidator
  • func (cv *CompositeValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error
• type PermissionValidator
• type Preflight
  • func (p *Preflight) Enabled() bool
  • func (p *Preflight) Run(ctx context.Context, changeGraph *ctldgraph.ChangeGraph) error
  • func (p *Preflight) SetConfig(cfg preflight.CheckConfig) error
  • func (p *Preflight) SetEnabled(enabled bool)
• type PreflightConfig
• type RoleValidator
  • func NewRoleValidator(pv PermissionValidator, mapper meta.RESTMapper) *RoleValidator
  • func (rv *RoleValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error
• type SelfSubjectAccessReviewValidator
  • func NewSelfSubjectAccessReviewValidator(ssarClient authv1client.SelfSubjectAccessReviewInterface) *SelfSubjectAccessReviewValidator
  • func (rv *SelfSubjectAccessReviewValidator) ValidatePermissions(ctx context.Context, resourceAttrib *authv1.ResourceAttributes) error
• type SelfSubjectRulesReviewValidator
  • func NewSelfSubjectRulesReviewValidator(ssrrClient authv1client.SelfSubjectRulesReviewInterface) *SelfSubjectRulesReviewValidator
  • func (rv *SelfSubjectRulesReviewValidator) ValidatePermissions(ctx context.Context, resourceAttrib *authv1.ResourceAttributes) error
• type Validator

Constants

const (
	PermissionValidatorTypeSelfSubjectAccessReview = "SelfSubjectAccessReview"
	PermissionValidatorTypeSelfSubjectRulesReview  = "SelfSubjectRulesReview"
)

Functions

func NewPreflight

func NewPreflight(depsFactory cmdcore.DepsFactory, enabled bool) preflight.Check

func RulesForBinding

func RulesForBinding(ctx context.Context, rbacClient rbacv1client.RbacV1Interface, res ctlres.Resource) ([]rbacv1.PolicyRule, error)

RulesForBinding will return a slice of rbacv1.PolicyRule objects that are representative of the (Cluster)Role rules that a (Cluster)RoleBinding references. It returns an error if one occurs during the process of fetching this information or if it is unable to determine the kind of binding this is

func RulesForClusterRoleBinding

func RulesForClusterRoleBinding(ctx context.Context, crGetter rbacv1client.ClusterRolesGetter, crb *rbacv1.ClusterRoleBinding) ([]rbacv1.PolicyRule, error)

RulesForClusterRoleBinding will return a slice of rbacv1.PolicyRule objects that are representative of the ClusterRole rules that a ClusterRoleBinding references. It returns an error if one occurs during the process of fetching this information.

func RulesForRole

func RulesForRole(res ctlres.Resource) ([]rbacv1.PolicyRule, error)

RulesForRole will return a slice of rbacv1.PolicyRule objects that are representative of a provided (Cluster)Role's rules. It returns an error if one occurs during the process of fetching this information or if it is unable to determine the kind of binding this is

func RulesForRoleBinding

func RulesForRoleBinding(ctx context.Context, rbacClient rbacv1client.RbacV1Interface, rb *rbacv1.RoleBinding) ([]rbacv1.PolicyRule, error)

RulesForRoleBinding will return a slice of rbacv1.PolicyRule objects that are representative of the (Cluster)Role rules that a RoleBinding references. It returns an error if one occurs during the process of fetching this information.

Types

type BasicValidator

type BasicValidator struct {
	// contains filtered or unexported fields
}

BasicValidator is a basic validator useful for validating basic CRUD permissions for resources. It has no knowledge of how to handle permission evaluation for specific GroupVersionKinds

func NewBasicValidator

func NewBasicValidator(pv PermissionValidator, mapper meta.RESTMapper) *BasicValidator

func (*BasicValidator) Validate

func (bv *BasicValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error

type BindingValidator

type BindingValidator struct {
	// contains filtered or unexported fields
}

BindingValidator is a Validator implementation for validating permissions required to CRUD Kubernetes (Cluster)RoleBinding resources

func NewBindingValidator

func NewBindingValidator(pv PermissionValidator, rbacClient rbacv1client.RbacV1Interface, mapper meta.RESTMapper) *BindingValidator

func (*BindingValidator) Validate

func (bv *BindingValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error

type CompositeValidator

type CompositeValidator struct {
	// contains filtered or unexported fields
}

CompositeValidator implements Validator and is used for composing multiple validators into a single validator that can handle specifying unique validators for different GroupVersionKinds

func NewCompositeValidator

func NewCompositeValidator(defaultValidator Validator, validators map[schema.GroupVersionKind]Validator) *CompositeValidator

func (*CompositeValidator) Validate

func (cv *CompositeValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error

type PermissionValidator

type PermissionValidator interface {
	ValidatePermissions(context.Context, *authv1.ResourceAttributes) error
}

type Preflight

type Preflight struct {
	// contains filtered or unexported fields
}

Preflight is an implementation of preflight.Check to make it easier to add permission validation as a preflight check

func (*Preflight) Enabled

func (p *Preflight) Enabled() bool

func (*Preflight) Run

func (p *Preflight) Run(ctx context.Context, changeGraph *ctldgraph.ChangeGraph) error

func (*Preflight) SetConfig

func (p *Preflight) SetConfig(cfg preflight.CheckConfig) error

func (*Preflight) SetEnabled

func (p *Preflight) SetEnabled(enabled bool)

type PreflightConfig

type PreflightConfig struct {
	PermissionValidatorResource string `json:"permissionValidatorResource"`
}

type RoleValidator

type RoleValidator struct {
	// contains filtered or unexported fields
}

RoleValidator is a Validator implementation for validating permissions required to CRUD Kubernetes (Cluster)Role resources

func NewRoleValidator

func NewRoleValidator(pv PermissionValidator, mapper meta.RESTMapper) *RoleValidator

func (*RoleValidator) Validate

func (rv *RoleValidator) Validate(ctx context.Context, res ctlres.Resource, verb string) error

type SelfSubjectAccessReviewValidator

type SelfSubjectAccessReviewValidator struct {
	// contains filtered or unexported fields
}

SelfSubjectAccessReviewValidator is for validating permissions via SelfSubjectAccessReview

func NewSelfSubjectAccessReviewValidator

func NewSelfSubjectAccessReviewValidator(ssarClient authv1client.SelfSubjectAccessReviewInterface) *SelfSubjectAccessReviewValidator

func (*SelfSubjectAccessReviewValidator) ValidatePermissions

func (rv *SelfSubjectAccessReviewValidator) ValidatePermissions(ctx context.Context, resourceAttrib *authv1.ResourceAttributes) error

ValidatePermissons will validate permissions for a ResourceAttributes object using SelfSubjectAccessReview. An error is returned if there are any issues creating a SelfSubjectAccessReview (i.e can't determine permissions) or if the SelfSubjectAccessReview is evaluated and the caller does not have the permission to perform the actions identified in the provided ResourceAttributes.

type SelfSubjectRulesReviewValidator

type SelfSubjectRulesReviewValidator struct {
	// contains filtered or unexported fields
}

SelfSubjectRulesReviewValidator is for validating permissions via SelfSubjectRulesReview

func NewSelfSubjectRulesReviewValidator

func NewSelfSubjectRulesReviewValidator(ssrrClient authv1client.SelfSubjectRulesReviewInterface) *SelfSubjectRulesReviewValidator

func (*SelfSubjectRulesReviewValidator) ValidatePermissions

func (rv *SelfSubjectRulesReviewValidator) ValidatePermissions(ctx context.Context, resourceAttrib *authv1.ResourceAttributes) error

ValidatePermissons will validate permissions for a ResourceAttributes object using SelfSubjectRulesReview. An error is returned if there are any issues creating a SelfSubjectRulesReview (i.e can't determine permissions) or if the SelfSubjectRulesReview is evaluated and the caller does not have the permission to perform the actions identified in the provided ResourceAttributes.

type Validator

type Validator interface {
	Validate(context.Context, ctlres.Resource, string) error
}