authorization

package
v3.7.0-0.124.0+incompa... Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 5, 2017 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Overview

+groupName=authorization.openshift.io Package api is the internal version of the API.

Index

Constants

View Source
const (
	LegacyGroupName = ""
	GroupName       = "authorization.openshift.io"
)
View Source
const (
	DockerBuildResource          = "builds/docker"
	OptimizedDockerBuildResource = "builds/optimizeddocker"
	SourceBuildResource          = "builds/source"
	CustomBuildResource          = "builds/custom"
	JenkinsPipelineBuildResource = "builds/jenkinspipeline"

	// these are valid under the "nodes" resource
	NodeMetricsSubresource = "metrics"
	NodeStatsSubresource   = "stats"
	NodeSpecSubresource    = "spec"
	NodeLogSubresource     = "log"

	RestrictedEndpointsResource = "endpoints/restricted"
)

Synthetic authorization endpoints

View Source
const (
	// PolicyName is the name of Policy
	PolicyName     = "default"
	APIGroupAll    = "*"
	ResourceAll    = "*"
	VerbAll        = "*"
	NonResourceAll = "*"

	ScopesKey           = "scopes.authorization.openshift.io"
	ScopesAllNamespaces = "*"

	UserKind           = "User"
	GroupKind          = "Group"
	ServiceAccountKind = "ServiceAccount"
	SystemUserKind     = "SystemUser"
	SystemGroupKind    = "SystemGroup"

	UserResource           = "users"
	GroupResource          = "groups"
	ServiceAccountResource = "serviceaccounts"
	SystemUserResource     = "systemusers"
	SystemGroupResource    = "systemgroups"
)

Variables

View Source
var (
	SchemeGroupVersion       = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
	LegacySchemeGroupVersion = schema.GroupVersion{Group: LegacyGroupName, Version: runtime.APIVersionInternal}

	LegacySchemeBuilder    = runtime.NewSchemeBuilder(addLegacyKnownTypes)
	AddToSchemeInCoreGroup = LegacySchemeBuilder.AddToScheme

	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addConversionFuncs)
	AddToScheme   = SchemeBuilder.AddToScheme
)
View Source
var ClusterPolicyBindingName = GetPolicyBindingName("")
View Source
var DiscoveryRule = PolicyRule{
	Verbs: sets.NewString("get"),
	NonResourceURLs: sets.NewString(

		"/version", "/version/*",

		"/api", "/api/*",
		"/apis", "/apis/*",
		"/oapi", "/oapi/*",
		"/swaggerapi", "/swaggerapi/*", "/swagger.json",
		"/osapi", "/osapi/",
		"/.well-known", "/.well-known/*",

		"/",
	),
}

DiscoveryRule is a rule that allows a client to discover the API resources available on this server

View Source
var RbacDiscoveryRule = rbac.PolicyRule{
	Verbs:           DiscoveryRule.Verbs.List(),
	NonResourceURLs: DiscoveryRule.NonResourceURLs.List(),
}

The Kubernetes Rbac version TODO make this the authoritative rule

Functions

func BuildSubjects

func BuildSubjects(users, groups []string, userNameValidator, groupNameValidator validation.ValidateNameFunc) []kapi.ObjectReference

func Convert_authorization_ClusterRoleBinding_To_rbac_ClusterRoleBinding

func Convert_authorization_ClusterRoleBinding_To_rbac_ClusterRoleBinding(in *ClusterRoleBinding, out *rbac.ClusterRoleBinding, _ conversion.Scope) error

func Convert_authorization_ClusterRole_To_rbac_ClusterRole

func Convert_authorization_ClusterRole_To_rbac_ClusterRole(in *ClusterRole, out *rbac.ClusterRole, _ conversion.Scope) error

func Convert_authorization_RoleBinding_To_rbac_RoleBinding

func Convert_authorization_RoleBinding_To_rbac_RoleBinding(in *RoleBinding, out *rbac.RoleBinding, _ conversion.Scope) error

func Convert_authorization_Role_To_rbac_Role

func Convert_authorization_Role_To_rbac_Role(in *Role, out *rbac.Role, _ conversion.Scope) error

func Convert_rbac_ClusterRoleBinding_To_authorization_ClusterRoleBinding

func Convert_rbac_ClusterRoleBinding_To_authorization_ClusterRoleBinding(in *rbac.ClusterRoleBinding, out *ClusterRoleBinding, _ conversion.Scope) error

func Convert_rbac_ClusterRole_To_authorization_ClusterRole

func Convert_rbac_ClusterRole_To_authorization_ClusterRole(in *rbac.ClusterRole, out *ClusterRole, _ conversion.Scope) error

func Convert_rbac_RoleBinding_To_authorization_RoleBinding

func Convert_rbac_RoleBinding_To_authorization_RoleBinding(in *rbac.RoleBinding, out *RoleBinding, _ conversion.Scope) error

func Convert_rbac_Role_To_authorization_Role

func Convert_rbac_Role_To_authorization_Role(in *rbac.Role, out *Role, _ conversion.Scope) error

func DeepCopy_authorization_Action

func DeepCopy_authorization_Action(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_Action is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterPolicy

func DeepCopy_authorization_ClusterPolicy(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterPolicy is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterPolicyBinding

func DeepCopy_authorization_ClusterPolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterPolicyBinding is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterPolicyBindingList

func DeepCopy_authorization_ClusterPolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterPolicyBindingList is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterPolicyList

func DeepCopy_authorization_ClusterPolicyList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterPolicyList is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterRole

func DeepCopy_authorization_ClusterRole(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterRole is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterRoleBinding

func DeepCopy_authorization_ClusterRoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterRoleBinding is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterRoleBindingList

func DeepCopy_authorization_ClusterRoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterRoleBindingList is an autogenerated deepcopy function.

func DeepCopy_authorization_ClusterRoleList

func DeepCopy_authorization_ClusterRoleList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ClusterRoleList is an autogenerated deepcopy function.

func DeepCopy_authorization_GroupRestriction

func DeepCopy_authorization_GroupRestriction(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_GroupRestriction is an autogenerated deepcopy function.

func DeepCopy_authorization_IsPersonalSubjectAccessReview

func DeepCopy_authorization_IsPersonalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_IsPersonalSubjectAccessReview is an autogenerated deepcopy function.

func DeepCopy_authorization_LocalResourceAccessReview

func DeepCopy_authorization_LocalResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_LocalResourceAccessReview is an autogenerated deepcopy function.

func DeepCopy_authorization_LocalSubjectAccessReview

func DeepCopy_authorization_LocalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_LocalSubjectAccessReview is an autogenerated deepcopy function.

func DeepCopy_authorization_Policy

func DeepCopy_authorization_Policy(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_Policy is an autogenerated deepcopy function.

func DeepCopy_authorization_PolicyBinding

func DeepCopy_authorization_PolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_PolicyBinding is an autogenerated deepcopy function.

func DeepCopy_authorization_PolicyBindingList

func DeepCopy_authorization_PolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_PolicyBindingList is an autogenerated deepcopy function.

func DeepCopy_authorization_PolicyList

func DeepCopy_authorization_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_PolicyList is an autogenerated deepcopy function.

func DeepCopy_authorization_PolicyRule

func DeepCopy_authorization_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_PolicyRule is an autogenerated deepcopy function.

func DeepCopy_authorization_PolicyRuleBuilder

func DeepCopy_authorization_PolicyRuleBuilder(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_PolicyRuleBuilder is an autogenerated deepcopy function.

func DeepCopy_authorization_ResourceAccessReview

func DeepCopy_authorization_ResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ResourceAccessReview is an autogenerated deepcopy function.

func DeepCopy_authorization_ResourceAccessReviewResponse

func DeepCopy_authorization_ResourceAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ResourceAccessReviewResponse is an autogenerated deepcopy function.

func DeepCopy_authorization_Role

func DeepCopy_authorization_Role(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_Role is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleBinding

func DeepCopy_authorization_RoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleBinding is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleBindingList

func DeepCopy_authorization_RoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleBindingList is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleBindingRestriction

func DeepCopy_authorization_RoleBindingRestriction(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleBindingRestriction is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleBindingRestrictionList

func DeepCopy_authorization_RoleBindingRestrictionList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleBindingRestrictionList is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleBindingRestrictionSpec

func DeepCopy_authorization_RoleBindingRestrictionSpec(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleBindingRestrictionSpec is an autogenerated deepcopy function.

func DeepCopy_authorization_RoleList

func DeepCopy_authorization_RoleList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_RoleList is an autogenerated deepcopy function.

func DeepCopy_authorization_SelfSubjectRulesReview

func DeepCopy_authorization_SelfSubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SelfSubjectRulesReview is an autogenerated deepcopy function.

func DeepCopy_authorization_SelfSubjectRulesReviewSpec

func DeepCopy_authorization_SelfSubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SelfSubjectRulesReviewSpec is an autogenerated deepcopy function.

func DeepCopy_authorization_ServiceAccountReference

func DeepCopy_authorization_ServiceAccountReference(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ServiceAccountReference is an autogenerated deepcopy function.

func DeepCopy_authorization_ServiceAccountRestriction

func DeepCopy_authorization_ServiceAccountRestriction(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_ServiceAccountRestriction is an autogenerated deepcopy function.

func DeepCopy_authorization_SubjectAccessReview

func DeepCopy_authorization_SubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SubjectAccessReview is an autogenerated deepcopy function.

func DeepCopy_authorization_SubjectAccessReviewResponse

func DeepCopy_authorization_SubjectAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SubjectAccessReviewResponse is an autogenerated deepcopy function.

func DeepCopy_authorization_SubjectRulesReview

func DeepCopy_authorization_SubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SubjectRulesReview is an autogenerated deepcopy function.

func DeepCopy_authorization_SubjectRulesReviewSpec

func DeepCopy_authorization_SubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SubjectRulesReviewSpec is an autogenerated deepcopy function.

func DeepCopy_authorization_SubjectRulesReviewStatus

func DeepCopy_authorization_SubjectRulesReviewStatus(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_SubjectRulesReviewStatus is an autogenerated deepcopy function.

func DeepCopy_authorization_UserRestriction

func DeepCopy_authorization_UserRestriction(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_authorization_UserRestriction is an autogenerated deepcopy function.

func GetPolicyBindingName

func GetPolicyBindingName(policyRefNamespace string) string

func IsKindOrLegacy

func IsKindOrLegacy(kind string, gk schema.GroupKind) bool

IsKindOrLegacy checks if the provided GroupKind matches with the given kind by looking up the API group and also the legacy API.

func IsResourceOrLegacy

func IsResourceOrLegacy(resource string, gr schema.GroupResource) bool

IsResourceOrLegacy checks if the provided GroupResources matches with the given resource by looking up the API group and also the legacy API.

func Kind

func Kind(kind string) schema.GroupKind

Kind takes an unqualified kind and returns back a Group qualified GroupKind

func LegacyKind

func LegacyKind(kind string) schema.GroupKind

LegacyKind takes an unqualified kind and returns back a Group qualified GroupKind

func LegacyResource

func LegacyResource(resource string) schema.GroupResource

LegacyResource takes an unqualified resource and returns back a Group qualified GroupResource using legacy API

func PolicyBindingToSelectableFields

func PolicyBindingToSelectableFields(policyBinding *PolicyBinding) fields.Set

PolicyBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func RegisterDeepCopies

func RegisterDeepCopies(scheme *runtime.Scheme) error

RegisterDeepCopies adds deep-copy functions to the given scheme. Public to allow building arbitrary schemes.

func Resource

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns back a Group qualified GroupResource

func StringSubjectsFor

func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)

StringSubjectsFor returns users and groups for comparison against user.Info. currentNamespace is used to to create usernames for service accounts where namespace=="".

func SubjectsContainAnyGroup

func SubjectsContainAnyGroup(subjects []kapi.ObjectReference, groups []string) bool

SubjectsContainAnyGroup returns true if the provided subjects any of the named groups.

func SubjectsContainUser

func SubjectsContainUser(subjects []kapi.ObjectReference, currentNamespace string, user string) bool

SubjectsContainUser returns true if the provided subjects contain the named user. currentNamespace is used to identify service accounts that are defined in a relative fashion.

func SubjectsStrings

func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)

SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes. currentNamespace is used to hide the subject.Namespace for ServiceAccounts in the currentNamespace

func ToClusterPolicyRef

func ToClusterPolicyRef(in kapi.ObjectReference) kapi.ObjectReference

func ToClusterRoleBindingMap

func ToClusterRoleBindingMap(in map[string]*RoleBinding) map[string]*ClusterRoleBinding

func ToClusterRoleMap

func ToClusterRoleMap(in map[string]*Role) map[string]*ClusterRole

func ToClusterRoleRef

func ToClusterRoleRef(in kapi.ObjectReference) kapi.ObjectReference

func ToRoleBindingMap

func ToRoleBindingMap(in map[string]*ClusterRoleBinding) map[string]*RoleBinding

func ToRoleMap

func ToRoleMap(in map[string]*ClusterRole) map[string]*Role

Types

type Action

type Action struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	Namespace string
	// Verb is one of: get, list, watch, create, update, delete
	Verb string
	// Group is the API group of the resource
	Group string
	// Version is the API version of the resource
	Version string
	// Resource is one of the existing resource types
	Resource string
	// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
	ResourceName string
	// Path is the path of a non resource URL
	Path string
	// IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)
	IsNonResourceURL bool
	// Content is the actual content of the request for create and update
	Content kruntime.Object
}

Action describes a request to be authorized

type ClusterPolicy

type ClusterPolicy struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted
	LastModified metav1.Time

	// Roles holds all the ClusterRoles held by this ClusterPolicy, mapped by Role.Name
	Roles ClusterRolesByName
}

ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.

func ToClusterPolicy

func ToClusterPolicy(in *Policy) *ClusterPolicy

type ClusterPolicyBinding

type ClusterPolicyBinding struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted
	LastModified metav1.Time

	// ClusterPolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this ClusterPolicyBinding, mapped by RoleBinding.Name
	RoleBindings ClusterRoleBindingsByName
}

ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace

func ToClusterPolicyBinding

func ToClusterPolicyBinding(in *PolicyBinding) *ClusterPolicyBinding

type ClusterPolicyBindingList

type ClusterPolicyBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterPolicyBindings
	Items []ClusterPolicyBinding
}

ClusterPolicyBindingList is a collection of ClusterPolicyBindings

func ToClusterPolicyBindingList

func ToClusterPolicyBindingList(in *PolicyBindingList) *ClusterPolicyBindingList

type ClusterPolicyList

type ClusterPolicyList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterPolicies
	Items []ClusterPolicy
}

ClusterPolicyList is a collection of ClusterPolicies

func ToClusterPolicyList

func ToClusterPolicyList(in *PolicyList) *ClusterPolicyList

type ClusterRole

type ClusterRole struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Rules holds all the PolicyRules for this ClusterRole
	Rules []PolicyRule
}

ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.

func ToClusterRole

func ToClusterRole(in *Role) *ClusterRole

type ClusterRoleBinding

type ClusterRoleBinding struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func ToClusterRoleBinding

func ToClusterRoleBinding(in *RoleBinding) *ClusterRoleBinding

type ClusterRoleBindingList

type ClusterRoleBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterRoleBindings
	Items []ClusterRoleBinding
}

ClusterRoleBindingList is a collection of ClusterRoleBindings

func ToClusterRoleBindingList

func ToClusterRoleBindingList(in *RoleBindingList) *ClusterRoleBindingList

type ClusterRoleBindingsByName

type ClusterRoleBindingsByName map[string]*ClusterRoleBinding

type ClusterRoleList

type ClusterRoleList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterRoles
	Items []ClusterRole
}

ClusterRoleList is a collection of ClusterRoles

func ToClusterRoleList

func ToClusterRoleList(in *RoleList) *ClusterRoleList

type ClusterRolesByName

type ClusterRolesByName map[string]*ClusterRole

type GroupRestriction

type GroupRestriction struct {
	// Groups specifies a list of literal group names.
	Groups []string

	// Selectors specifies a list of label selectors over group labels.
	Selectors []metav1.LabelSelector
}

GroupRestriction matches a group either by a string match on the group name or a label selector applied to group labels.

type IsPersonalSubjectAccessReview

type IsPersonalSubjectAccessReview struct {
	metav1.TypeMeta
}

IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed

type LocalResourceAccessReview

type LocalResourceAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
}

LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace

type LocalSubjectAccessReview

type LocalSubjectAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested.  The Namespace element is FORCED to the current namespace.
	Action
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	// +k8s:conversion-gen=false
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace

type Policy

type Policy struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	// LastModified is the last time that any part of the Policy was created, updated, or deleted
	LastModified metav1.Time

	// Roles holds all the Roles held by this Policy, mapped by Role.Name
	Roles RolesByName
}

Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.

func ToPolicy

func ToPolicy(in *ClusterPolicy) *Policy

type PolicyBinding

type PolicyBinding struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted
	LastModified metav1.Time

	// PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name
	RoleBindings RoleBindingsByName
}

PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace

func ToPolicyBinding

func ToPolicyBinding(in *ClusterPolicyBinding) *PolicyBinding

type PolicyBindingList

type PolicyBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of policyBindings
	Items []PolicyBinding
}

PolicyBindingList is a collection of PolicyBindings

type PolicyBindingSorter

type PolicyBindingSorter []PolicyBinding

func (PolicyBindingSorter) Len

func (s PolicyBindingSorter) Len() int

func (PolicyBindingSorter) Less

func (s PolicyBindingSorter) Less(i, j int) bool

func (PolicyBindingSorter) Swap

func (s PolicyBindingSorter) Swap(i, j int)

type PolicyList

type PolicyList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of policies
	Items []Policy
}

PolicyList is a collection of Policies

func ToPolicyList

func ToPolicyList(in *ClusterPolicyList) *PolicyList

type PolicyRule

type PolicyRule struct {
	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule.  VerbAll represents all kinds.
	Verbs sets.String
	// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
	// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
	AttributeRestrictions kruntime.Object
	// APIGroups is the name of the APIGroup that contains the resources.  If this field is empty, then both kubernetes and origin API groups are assumed.
	// That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request
	// will be allowed
	APIGroups []string
	// Resources is a list of resources this rule applies to.  ResourceAll represents all resources.
	Resources sets.String
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames sets.String
	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
	// If an action is not a resource API request, then the URL is split on '/' and is checked against the NonResourceURLs to look for a match.
	NonResourceURLs sets.String
}

PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

func Convert_rbac_PolicyRules_To_authorization_PolicyRules

func Convert_rbac_PolicyRules_To_authorization_PolicyRules(in []rbac.PolicyRule) []PolicyRule

func (PolicyRule) CompactString

func (r PolicyRule) CompactString() string

CompactString exposes a compact string representation for use in escalation error messages

func (PolicyRule) String

func (r PolicyRule) String() string

type PolicyRuleBuilder

type PolicyRuleBuilder struct {
	PolicyRule PolicyRule
}

+gencopy=false PolicyRuleBuilder let's us attach methods. A no-no for API types

func NewRule

func NewRule(verbs ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Groups

func (r *PolicyRuleBuilder) Groups(groups ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Names

func (r *PolicyRuleBuilder) Names(names ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Resources

func (r *PolicyRuleBuilder) Resources(resources ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Rule

func (r *PolicyRuleBuilder) Rule() (PolicyRule, error)

func (*PolicyRuleBuilder) RuleOrDie

func (r *PolicyRuleBuilder) RuleOrDie() PolicyRule

type ResourceAccessReview

type ResourceAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
}

ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec

type ResourceAccessReviewResponse

type ResourceAccessReviewResponse struct {
	metav1.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Users is the list of users who can perform the action
	// +k8s:conversion-gen=false
	Users sets.String
	// Groups is the list of groups who can perform the action
	// +k8s:conversion-gen=false
	Groups sets.String

	// EvaluationError is an indication that some error occurred during resolution, but partial results can still be returned.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.  This is
	// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
	EvaluationError string
}

ResourceAccessReviewResponse describes who can perform the action

type Role

type Role struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Rules holds all the PolicyRules for this Role
	Rules []PolicyRule
}

Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.

func ToRole

func ToRole(in *ClusterRole) *Role

type RoleBinding

type RoleBinding struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the RoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func ToRoleBinding

func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding

type RoleBindingList

type RoleBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of roleBindings
	Items []RoleBinding
}

RoleBindingList is a collection of RoleBindings

func ToRoleBindingList

func ToRoleBindingList(in *ClusterRoleBindingList) *RoleBindingList

type RoleBindingRestriction

type RoleBindingRestriction struct {
	metav1.TypeMeta

	// Standard object's metadata.
	metav1.ObjectMeta

	// Spec defines the matcher.
	Spec RoleBindingRestrictionSpec
}

RoleBindingRestriction is an object that can be matched against a subject (user, group, or service account) to determine whether rolebindings on that subject are allowed in the namespace to which the RoleBindingRestriction belongs. If any one of those RoleBindingRestriction objects matches a subject, rolebindings on that subject in the namespace are allowed.

type RoleBindingRestrictionList

type RoleBindingRestrictionList struct {
	metav1.TypeMeta

	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of RoleBindingRestriction objects.
	Items []RoleBindingRestriction
}

RoleBindingRestrictionList is a collection of RoleBindingRestriction objects.

type RoleBindingRestrictionSpec

type RoleBindingRestrictionSpec struct {
	// UserRestriction matches against user subjects.
	UserRestriction *UserRestriction

	// GroupRestriction matches against group subjects.
	GroupRestriction *GroupRestriction

	// ServiceAccountRestriction matches against service-account subjects.
	ServiceAccountRestriction *ServiceAccountRestriction
}

RoleBindingRestrictionSpec defines a rolebinding restriction. Exactly one field must be non-nil.

type RoleBindingSorter

type RoleBindingSorter []RoleBinding

func (RoleBindingSorter) Len

func (s RoleBindingSorter) Len() int

func (RoleBindingSorter) Less

func (s RoleBindingSorter) Less(i, j int) bool

func (RoleBindingSorter) Swap

func (s RoleBindingSorter) Swap(i, j int)

type RoleBindingsByName

type RoleBindingsByName map[string]*RoleBinding

type RoleList

type RoleList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of roles
	Items []Role
}

RoleList is a collection of Roles

func ToRoleList

func ToRoleList(in *ClusterRoleList) *RoleList

type RolesByName

type RolesByName map[string]*Role

type SelfSubjectRulesReview

type SelfSubjectRulesReview struct {
	metav1.TypeMeta

	// Spec adds information about how to conduct the check
	Spec SelfSubjectRulesReviewSpec

	// Status is completed by the server to tell which permissions you have
	Status SubjectRulesReviewStatus
}

SelfSubjectRulesReview is a resource you can create to determine which actions you can perform in a namespace

type SelfSubjectRulesReviewSpec

type SelfSubjectRulesReviewSpec struct {
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SubjectRulesReview, means "use the scopes on this request".
	// Nil for a regular SubjectRulesReview, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

SelfSubjectRulesReviewSpec adds information about how to conduct the check

type ServiceAccountReference

type ServiceAccountReference struct {
	// Name is the name of the service account.
	Name string

	// Namespace is the namespace of the service account.  Service accounts from
	// inside the whitelisted namespaces are allowed to be bound to roles.  If
	// Namespace is empty, then the namespace of the RoleBindingRestriction in
	// which the ServiceAccountReference is embedded is used.
	Namespace string
}

ServiceAccountReference specifies a service account and namespace by their names.

type ServiceAccountRestriction

type ServiceAccountRestriction struct {
	// ServiceAccounts specifies a list of literal service-account names.
	ServiceAccounts []ServiceAccountReference

	// Namespaces specifies a list of literal namespace names.  ServiceAccounts
	// from inside the whitelisted namespaces are allowed to be bound to roles.
	Namespaces []string
}

ServiceAccountRestriction matches a service account by a string match on either the service-account name or the name of the service account's namespace.

type SortableRuleSlice

type SortableRuleSlice []PolicyRule

func (SortableRuleSlice) Len

func (s SortableRuleSlice) Len() int

func (SortableRuleSlice) Less

func (s SortableRuleSlice) Less(i, j int) bool

func (SortableRuleSlice) Swap

func (s SortableRuleSlice) Swap(i, j int)

type SubjectAccessReview

type SubjectAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	// +k8s:conversion-gen=false
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

SubjectAccessReview is an object for requesting information about whether a user or group can perform an action

func AddUserToSAR

func AddUserToSAR(user user.Info, sar *SubjectAccessReview) *SubjectAccessReview

type SubjectAccessReviewResponse

type SubjectAccessReviewResponse struct {
	metav1.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Allowed is required.  True if the action would be allowed, false otherwise.
	Allowed bool
	// Reason is optional.  It indicates why a request was allowed or denied.
	Reason string
	// EvaluationError is an indication that some error occurred during the authorization check.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.  This is
	// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
	EvaluationError string
}

SubjectAccessReviewResponse describes whether or not a user or group can perform an action

type SubjectRulesReview

type SubjectRulesReview struct {
	metav1.TypeMeta

	// Spec adds information about how to conduct the check
	Spec SubjectRulesReviewSpec

	// Status is completed by the server to tell which permissions you have
	Status SubjectRulesReviewStatus
}

SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace

type SubjectRulesReviewSpec

type SubjectRulesReviewSpec struct {
	// User is optional.  At least one of User and Groups must be specified.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.  At least one of User and Groups must be specified.
	Groups []string
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	Scopes []string
}

SubjectRulesReviewSpec adds information about how to conduct the check

type SubjectRulesReviewStatus

type SubjectRulesReviewStatus struct {
	// Rules is the list of rules (no particular sort) that are allowed for the subject
	Rules []PolicyRule
	// EvaluationError can appear in combination with Rules.  It means some error happened during evaluation
	// that may have prevented additional rules from being populated.
	EvaluationError string
}

SubjectRulesReviewStatus is contains the result of a rules check

type UserRestriction

type UserRestriction struct {
	// Users specifies a list of literal user names.
	Users []string

	// Groups is a list of groups used to match against an individual user's
	// groups. If the user is a member of one of the whitelisted groups, the user
	// is allowed to be bound to a role.
	Groups []string

	// Selectors specifies a list of label selectors over user labels.
	Selectors []metav1.LabelSelector
}

UserRestriction matches a user either by a string match on the user name, a string match on the name of a group to which the user belongs, or a label selector applied to the user labels.

Directories

Path Synopsis
+groupName=authorization.openshift.io Package v1 is the v1 version of the API.
+groupName=authorization.openshift.io Package v1 is the v1 version of the API.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL