resource

Documentation

Overview

Package subjectaccess provides functions for listing resource access in a Kubernetes cluster.

Index

• Constants
• func NewResourceAccess(ctx context.Context, client authClient.SelfSubjectAccessReviewInterface, ...) *resourceAccess
• type Resource
  • func ResourceList(_ context.Context, logger *zap.Logger, ...) ([]Resource, error)
  • func (r Resource) GroupVersionResource() schema.GroupVersionResource
  • func (r Resource) Key() string
• type ResourceAccess
• type ResourceAccessOption
  • func WithLogger(logger *zap.Logger) ResourceAccessOption
  • func WithMinimumRBAC(verbs metav1.Verbs) ResourceAccessOption

Constants

const (
	Denied int = iota
	Allowed
	Unused
	Error
)

Functions

func NewResourceAccess

func NewResourceAccess(ctx context.Context, client authClient.SelfSubjectAccessReviewInterface, namespace string, resources []Resource, options ...ResourceAccessOption) *resourceAccess

NewResourceAccess provides a ResourceAccess object with an access map popluated from issuing SelfSubjectAccessReview requests for the list of resources and verbs provided.

Types

type Resource

type Resource struct {
	GroupVersionKind schema.GroupVersionKind
	APIResource      metav1.APIResource
}

func ResourceList

func ResourceList(_ context.Context, logger *zap.Logger, client discovery.ServerResourcesInterface, namespaced bool) ([]Resource, error)

ResourceList creates a list of Resource objects using the Discovery client.

func (Resource) GroupVersionResource

func (r Resource) GroupVersionResource() schema.GroupVersionResource

func (Resource) Key

func (r Resource) Key() string

type ResourceAccess

type ResourceAccess interface {
	Update(context.Context, authClient.SelfSubjectAccessReviewInterface, string, Resource, string)
	Allowed(namespace string, resource Resource, verb string) bool
	AllowedAll(namespace string, resource Resource, verbs []string) bool
	AllowedAny(namespace string, resource Resource, verbs []string) bool
	String() string
}

ResourceAccess provides a way to check if a given resource and verb are allowed to be performed by the current Kubernetes client.

type ResourceAccessOption

type ResourceAccessOption func(*resourceAccess)

func WithLogger

func WithLogger(logger *zap.Logger) ResourceAccessOption

func WithMinimumRBAC

func WithMinimumRBAC(verbs metav1.Verbs) ResourceAccessOption