authz

Documentation

Index

• func NewSarAuthorizer(client authorizationclient.AuthorizationV1Interface) (authorizer.Authorizer, error)
• func NewStaticAuthorizer(config []StaticAuthorizationConfig) (*staticAuthorizer, error)
• type Config
• type HTTPHeaderRewriteConfig
• type QueryParameterRewriteConfig
• type ResourceAttributes
• type StaticAuthorizationConfig
  • func (saConfig StaticAuthorizationConfig) Matches(a authorizer.Attributes) bool
• type SubjectAccessReviewRewrites
• type UserConfig

Functions

func NewSarAuthorizer

func NewSarAuthorizer(client authorizationclient.AuthorizationV1Interface) (authorizer.Authorizer, error)

NewSarAuthorizer creates an authorizer compatible with the kubelet's needs

func NewStaticAuthorizer

func NewStaticAuthorizer(config []StaticAuthorizationConfig) (*staticAuthorizer, error)

Types

type Config

type Config struct {
	Rewrites               *SubjectAccessReviewRewrites `json:"rewrites,omitempty"`
	ResourceAttributes     *ResourceAttributes          `json:"resourceAttributes,omitempty"`
	ResourceAttributesFile string                       `json:"-"`
	Static                 []StaticAuthorizationConfig  `json:"static,omitempty"`
}

Config holds configuration enabling request authorization

type HTTPHeaderRewriteConfig

type HTTPHeaderRewriteConfig struct {
	Name string `json:"name,omitempty"`
}

HTTPHeaderRewriteConfig describes which HTTP header is to be used to rewrite a SubjectAccessReview on a given request.

type QueryParameterRewriteConfig

type QueryParameterRewriteConfig struct {
	Name string `json:"name,omitempty"`
}

QueryParameterRewriteConfig describes which HTTP URL query parameter is to be used to rewrite a SubjectAccessReview on a given request.

type ResourceAttributes

type ResourceAttributes struct {
	Namespace   string `json:"namespace,omitempty"`
	APIGroup    string `json:"apiGroup,omitempty"`
	APIVersion  string `json:"apiVersion,omitempty"`
	Resource    string `json:"resource,omitempty"`
	Subresource string `json:"subresource,omitempty"`
	Name        string `json:"name,omitempty"`
}

ResourceAttributes describes attributes available for resource request authorization

type StaticAuthorizationConfig

type StaticAuthorizationConfig struct {
	User            UserConfig
	Verb            string `json:"verb,omitempty"`
	Namespace       string `json:"namespace,omitempty"`
	APIGroup        string `json:"apiGroup,omitempty"`
	Resource        string `json:"resource,omitempty"`
	Subresource     string `json:"subresource,omitempty"`
	Name            string `json:"name,omitempty"`
	ResourceRequest bool   `json:"resourceRequest,omitempty"`
	Path            string `json:"path,omitempty"`
}

StaticAuthorizationConfig describes what is needed to specify a static authorization.

func (StaticAuthorizationConfig) Matches

func (saConfig StaticAuthorizationConfig) Matches(a authorizer.Attributes) bool

type SubjectAccessReviewRewrites

type SubjectAccessReviewRewrites struct {
	ByQueryParameter *QueryParameterRewriteConfig `json:"byQueryParameter,omitempty"`
	ByHTTPHeader     *HTTPHeaderRewriteConfig     `json:"byHttpHeader,omitempty"`
}

SubjectAccessReviewRewrites describes how SubjectAccessReview may be rewritten on a given request.

type UserConfig

type UserConfig struct {
	Name   string   `json:"name,omitempty"`
	Groups []string `json:"groups,omitempty"`
}