auth

Documentation

Index

• type CanIOptions
  • func NewCanI(discovery Discovery, ...) CanIOptions
• type Discovery

Types

type CanIOptions

type CanIOptions interface {
	// RunAccessCheck checks if the caller can perform the operation
	// - operation is a combination of namespace, kind, verb
	// - can only evaluate a single verb
	// - group version resource is determined from the kind using the discovery client REST mapper
	// - If disallowed, the reason and evaluationError is available in the logs
	// - each can generates a SubjectAccessReview resource and response is evaluated for permissions
	RunAccessCheck(context.Context) (bool, string, error)
}

CanIOptions provides utility to check if user has authorization for the given operation

func NewCanI

func NewCanI(discovery Discovery, sarClient authorizationv1client.SubjectAccessReviewInterface, gvk, namespace, verb, subresource string, user string) CanIOptions

NewCanI returns a new instance of operation access controller evaluator

type Discovery

type Discovery interface {
	GetGVRFromGVK(schema.GroupVersionKind) (schema.GroupVersionResource, error)
}

Discovery provides interface to mange Kind and GVR mapping