authorization

Documentation

Index

• Variables
• func MutateAuthorization(proxyClusterScoped bool, proxyTenants []*tenant.ProxyTenant, ...) error
• func NamespacedResourceKey(group, resource string) string

Variables

var Paths = []string{
	"/apis/authorization.k8s.io/v1/selfsubjectaccessreviews",
	"/apis/authorization.k8s.io/v1/selfsubjectrulesreviews",
}

Functions

func MutateAuthorization

func MutateAuthorization(proxyClusterScoped bool, proxyTenants []*tenant.ProxyTenant, namespacedResources sets.Set[string], obj *runtime.Object, gvk schema.GroupVersionKind) error

MutateAuthorization augments the API server's answer to self review requests (SelfSubjectAccessReview / SelfSubjectRulesReview) with the capabilities capsule-proxy adds on top of native RBAC, so that clients such as `kubectl auth can-i` reflect what actually works through the proxy.

func NamespacedResourceKey

func NamespacedResourceKey(group, resource string) string

NamespacedResourceKey builds the lookup key identifying a namespaced resource that capsule-proxy proxies. It matches the (group, plural resource) pair carried by SelfSubjectAccessReview resource attributes.