api

package
v1.0.6 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 13, 2015 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source
const (
	DockerBuildResource = "builds/docker"
	SourceBuildResource = "builds/source"
	CustomBuildResource = "builds/custom"
)

Synthetic authorization endpoints

View Source
const (
	// PolicyName is the name of Policy
	PolicyName     = "default"
	ResourceAll    = "*"
	VerbAll        = "*"
	NonResourceAll = "*"

	UserKind           = "User"
	GroupKind          = "Group"
	ServiceAccountKind = "ServiceAccount"
	SystemUserKind     = "SystemUser"
	SystemGroupKind    = "SystemGroup"
)
View Source
const (
	// ResourceGroupPrefix is the prefix for indicating that a resource entry is actually a group of resources.  The groups are defined in code and indicate resources that are commonly permissioned together
	ResourceGroupPrefix = "resourcegroup"
	BuildGroupName      = ResourceGroupPrefix + ":builds"
	DeploymentGroupName = ResourceGroupPrefix + ":deployments"
	ImageGroupName      = ResourceGroupPrefix + ":images"
	OAuthGroupName      = ResourceGroupPrefix + ":oauth"
	UserGroupName       = ResourceGroupPrefix + ":users"
	TemplateGroupName   = ResourceGroupPrefix + ":templates"
	SDNGroupName        = ResourceGroupPrefix + ":sdn"
	// PolicyOwnerGroupName includes the physical resources behind the PermissionGrantingGroupName.  Unless these physical objects are created first, users with privileges to PermissionGrantingGroupName will
	// only be able to bind to global roles
	PolicyOwnerGroupName = ResourceGroupPrefix + ":policy"
	// PermissionGrantingGroupName includes resources that are necessary to maintain authorization roles and bindings.  By itself, this group is insufficient to create anything except for bindings
	// to master roles.  If a local Policy already exists, then privileges to this group will allow for modification of local roles.
	PermissionGrantingGroupName = ResourceGroupPrefix + ":granter"
	// OpenshiftExposedGroupName includes resources that are commonly viewed and modified by end users of the system.  It does not include any sensitive resources that control authentication or authorization
	OpenshiftExposedGroupName = ResourceGroupPrefix + ":exposedopenshift"
	OpenshiftAllGroupName     = ResourceGroupPrefix + ":allopenshift"
	OpenshiftStatusGroupName  = ResourceGroupPrefix + ":allopenshift-status"

	QuotaGroupName = ResourceGroupPrefix + ":quota"
	// KubeInternalsGroupName includes those resources that should reasonably be viewable to end users, but that most users should probably not modify.  Kubernetes herself will maintain these resources
	KubeInternalsGroupName = ResourceGroupPrefix + ":privatekube"
	// KubeExposedGroupName includes resources that are commonly viewed and modified by end users of the system.
	KubeExposedGroupName = ResourceGroupPrefix + ":exposedkube"
	KubeAllGroupName     = ResourceGroupPrefix + ":allkube"
	KubeStatusGroupName  = ResourceGroupPrefix + ":allkube-status"

	// NonEscalatingResourcesGroupName contains all resources that can be viewed without exposing the risk of using view rights to locate a secret to escalate privileges.  For example, view
	// rights on secrets could be used locate a secret that happened to be  serviceaccount token that has more privileges
	NonEscalatingResourcesGroupName         = ResourceGroupPrefix + ":non-escalating"
	KubeNonEscalatingViewableGroupName      = ResourceGroupPrefix + ":kube-non-escalating"
	OpenshiftNonEscalatingViewableGroupName = ResourceGroupPrefix + ":openshift-non-escalating"

	// EscalatingResourcesGroupName contains all resources that can be used to escalate privileges when simply viewed
	EscalatingResourcesGroupName         = ResourceGroupPrefix + ":escalating"
	KubeEscalatingViewableGroupName      = ResourceGroupPrefix + ":kube-escalating"
	OpenshiftEscalatingViewableGroupName = ResourceGroupPrefix + ":openshift-escalating"
)

Variables

View Source
var ClusterPolicyBindingName = GetPolicyBindingName("")
View Source
var (
	GroupsToResources = map[string][]string{
		BuildGroupName:       {"builds", "buildconfigs", "buildlogs", "buildconfigs/instantiate", "builds/log", "builds/clone", "buildconfigs/webhooks"},
		ImageGroupName:       {"imagestreams", "imagestreammappings", "imagestreamtags", "imagestreamimages"},
		DeploymentGroupName:  {"deployments", "deploymentconfigs", "generatedeploymentconfigs", "deploymentconfigrollbacks"},
		SDNGroupName:         {"clusternetworks", "hostsubnets", "netnamespaces"},
		TemplateGroupName:    {"templates", "templateconfigs", "processedtemplates"},
		UserGroupName:        {"identities", "users", "useridentitymappings", "groups"},
		OAuthGroupName:       {"oauthauthorizetokens", "oauthaccesstokens", "oauthclients", "oauthclientauthorizations"},
		PolicyOwnerGroupName: {"policies", "policybindings"},

		PermissionGrantingGroupName: {"roles", "rolebindings", "resourceaccessreviews", "subjectaccessreviews", "localresourceaccessreviews", "localsubjectaccessreviews"},
		OpenshiftExposedGroupName:   {BuildGroupName, ImageGroupName, DeploymentGroupName, TemplateGroupName, "routes"},
		OpenshiftAllGroupName: {OpenshiftExposedGroupName, UserGroupName, OAuthGroupName, PolicyOwnerGroupName, SDNGroupName, PermissionGrantingGroupName, OpenshiftStatusGroupName, "projects",
			"clusterroles", "clusterrolebindings", "clusterpolicies", "clusterpolicybindings", "images", "projectrequests"},
		OpenshiftStatusGroupName: {"imagestreams/status", "routes/status"},

		QuotaGroupName:         {"limitranges", "resourcequotas", "resourcequotausages"},
		KubeInternalsGroupName: {"minions", "nodes", "bindings", "events", "namespaces"},
		KubeExposedGroupName:   {"pods", "replicationcontrollers", "serviceaccounts", "services", "endpoints", "persistentvolumeclaims", "pods/log"},
		KubeAllGroupName:       {KubeInternalsGroupName, KubeExposedGroupName, QuotaGroupName},
		KubeStatusGroupName:    {"pods/status", "resourcequotas/status", "namespaces/status"},

		OpenshiftEscalatingViewableGroupName: {"oauthauthorizetokens", "oauthaccesstokens"},
		KubeEscalatingViewableGroupName:      {"secrets"},
		EscalatingResourcesGroupName:         {OpenshiftEscalatingViewableGroupName, KubeEscalatingViewableGroupName},

		NonEscalatingResourcesGroupName: {OpenshiftNonEscalatingViewableGroupName, KubeNonEscalatingViewableGroupName},
	}
)

Functions

func BuildSubjects added in v1.0.5

func BuildSubjects(users, groups []string, userNameValidator, groupNameValidator validation.ValidateNameFunc) []kapi.ObjectReference

func ExpandResources

func ExpandResources(rawResources kutil.StringSet) kutil.StringSet

func GetPolicyBindingName

func GetPolicyBindingName(policyRefNamespace string) string

func StringSubjectsFor added in v1.0.5

func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)

StringSubjectsFor returns users and groups for comparison against user.Info. currentNamespace is used to to create usernames for service accounts where namespace=="".

func SubjectsStrings added in v1.0.5

func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)

SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes. currentNamespace is used to hide the subject.Namespace for ServiceAccounts in the currentNamespace

func ToClusterPolicyRef

func ToClusterPolicyRef(in kapi.ObjectReference) kapi.ObjectReference

func ToClusterRoleBindingMap

func ToClusterRoleBindingMap(in map[string]*RoleBinding) map[string]*ClusterRoleBinding

func ToClusterRoleMap

func ToClusterRoleMap(in map[string]*Role) map[string]*ClusterRole

func ToClusterRoleRef

func ToClusterRoleRef(in kapi.ObjectReference) kapi.ObjectReference

func ToRoleBindingMap

func ToRoleBindingMap(in map[string]*ClusterRoleBinding) map[string]*RoleBinding

func ToRoleMap

func ToRoleMap(in map[string]*ClusterRole) map[string]*Role

Types

type AuthorizationAttributes added in v1.0.5

type AuthorizationAttributes struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	Namespace string
	// Verb is one of: get, list, watch, create, update, delete
	Verb string
	// Resource is one of the existing resource types
	Resource string
	// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
	ResourceName string
	// Content is the actual content of the request for create and update
	Content kruntime.EmbeddedObject
}

type ClusterPolicy

type ClusterPolicy struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted
	LastModified util.Time

	// Roles holds all the ClusterRoles held by this ClusterPolicy, mapped by Role.Name
	Roles map[string]*ClusterRole
}

ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.

func ToClusterPolicy

func ToClusterPolicy(in *Policy) *ClusterPolicy

func (*ClusterPolicy) IsAnAPIObject

func (*ClusterPolicy) IsAnAPIObject()

type ClusterPolicyBinding

type ClusterPolicyBinding struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted
	LastModified util.Time

	// ClusterPolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this ClusterPolicyBinding, mapped by RoleBinding.Name
	RoleBindings map[string]*ClusterRoleBinding
}

ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace

func ToClusterPolicyBinding

func ToClusterPolicyBinding(in *PolicyBinding) *ClusterPolicyBinding

func (*ClusterPolicyBinding) IsAnAPIObject

func (*ClusterPolicyBinding) IsAnAPIObject()

type ClusterPolicyBindingList

type ClusterPolicyBindingList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of ClusterPolicyBindings
	Items []ClusterPolicyBinding
}

ClusterPolicyBindingList is a collection of ClusterPolicyBindings

func ToClusterPolicyBindingList

func ToClusterPolicyBindingList(in *PolicyBindingList) *ClusterPolicyBindingList

func (*ClusterPolicyBindingList) IsAnAPIObject

func (*ClusterPolicyBindingList) IsAnAPIObject()

type ClusterPolicyList

type ClusterPolicyList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of ClusterPolicies
	Items []ClusterPolicy
}

ClusterPolicyList is a collection of ClusterPolicies

func ToClusterPolicyList

func ToClusterPolicyList(in *PolicyList) *ClusterPolicyList

func (*ClusterPolicyList) IsAnAPIObject

func (*ClusterPolicyList) IsAnAPIObject()

type ClusterRole

type ClusterRole struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// Rules holds all the PolicyRules for this ClusterRole
	Rules []PolicyRule
}

ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.

func ToClusterRole

func ToClusterRole(in *Role) *ClusterRole

func (*ClusterRole) IsAnAPIObject

func (*ClusterRole) IsAnAPIObject()

type ClusterRoleBinding

type ClusterRoleBinding struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func ToClusterRoleBinding

func ToClusterRoleBinding(in *RoleBinding) *ClusterRoleBinding

func (*ClusterRoleBinding) IsAnAPIObject

func (*ClusterRoleBinding) IsAnAPIObject()

type ClusterRoleBindingList

type ClusterRoleBindingList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of ClusterRoleBindings
	Items []ClusterRoleBinding
}

ClusterRoleBindingList is a collection of ClusterRoleBindings

func ToClusterRoleBindingList

func ToClusterRoleBindingList(in *RoleBindingList) *ClusterRoleBindingList

func (*ClusterRoleBindingList) IsAnAPIObject

func (*ClusterRoleBindingList) IsAnAPIObject()

type ClusterRoleList

type ClusterRoleList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of ClusterRoles
	Items []ClusterRole
}

ClusterRoleList is a collection of ClusterRoles

func ToClusterRoleList

func ToClusterRoleList(in *RoleList) *ClusterRoleList

func (*ClusterRoleList) IsAnAPIObject

func (*ClusterRoleList) IsAnAPIObject()

type IsPersonalSubjectAccessReview

type IsPersonalSubjectAccessReview struct {
	kapi.TypeMeta
}

IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed

func (*IsPersonalSubjectAccessReview) IsAnAPIObject

func (*IsPersonalSubjectAccessReview) IsAnAPIObject()

type LocalResourceAccessReview added in v1.0.5

type LocalResourceAccessReview struct {
	kapi.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
}

LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace

func (*LocalResourceAccessReview) IsAnAPIObject added in v1.0.5

func (*LocalResourceAccessReview) IsAnAPIObject()

type LocalSubjectAccessReview added in v1.0.5

type LocalSubjectAccessReview struct {
	kapi.TypeMeta

	// Action describes the action being tested.  The Namespace element is FORCED to the current namespace.
	Action AuthorizationAttributes
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	Groups util.StringSet
}

LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace

func (*LocalSubjectAccessReview) IsAnAPIObject added in v1.0.5

func (*LocalSubjectAccessReview) IsAnAPIObject()

type Policy

type Policy struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// LastModified is the last time that any part of the Policy was created, updated, or deleted
	LastModified util.Time

	// Roles holds all the Roles held by this Policy, mapped by Role.Name
	Roles map[string]*Role
}

Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.

func ToPolicy

func ToPolicy(in *ClusterPolicy) *Policy

func (*Policy) IsAnAPIObject

func (*Policy) IsAnAPIObject()

type PolicyBinding

type PolicyBinding struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted
	LastModified util.Time

	// PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name
	RoleBindings map[string]*RoleBinding
}

PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace

func ToPolicyBinding

func ToPolicyBinding(in *ClusterPolicyBinding) *PolicyBinding

func (*PolicyBinding) IsAnAPIObject

func (*PolicyBinding) IsAnAPIObject()

type PolicyBindingList

type PolicyBindingList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of policyBindings
	Items []PolicyBinding
}

PolicyBindingList is a collection of PolicyBindings

func (*PolicyBindingList) IsAnAPIObject

func (*PolicyBindingList) IsAnAPIObject()

type PolicyBindingSorter

type PolicyBindingSorter []PolicyBinding

func (PolicyBindingSorter) Len

func (s PolicyBindingSorter) Len() int

func (PolicyBindingSorter) Less

func (s PolicyBindingSorter) Less(i, j int) bool

func (PolicyBindingSorter) Swap

func (s PolicyBindingSorter) Swap(i, j int)

type PolicyList

type PolicyList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of policies
	Items []Policy
}

PolicyList is a collection of Policies

func ToPolicyList

func ToPolicyList(in *ClusterPolicyList) *PolicyList

func (*PolicyList) IsAnAPIObject

func (*PolicyList) IsAnAPIObject()

type PolicyRule

type PolicyRule struct {
	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule.  VerbAll represents all kinds.
	Verbs util.StringSet
	// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
	// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
	AttributeRestrictions kruntime.EmbeddedObject
	// Resources is a list of resources this rule applies to.  ResourceAll represents all resources.
	Resources util.StringSet
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames util.StringSet
	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
	// If an action is not a resource API request, then the URL is split on '/' and is checked against the NonResourceURLs to look for a match.
	NonResourceURLs util.StringSet
}

PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

func (PolicyRule) String

func (r PolicyRule) String() string

type ResourceAccessReview

type ResourceAccessReview struct {
	kapi.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
}

ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec

func (*ResourceAccessReview) IsAnAPIObject

func (*ResourceAccessReview) IsAnAPIObject()

type ResourceAccessReviewResponse

type ResourceAccessReviewResponse struct {
	kapi.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Users is the list of users who can perform the action
	Users util.StringSet
	// Groups is the list of groups who can perform the action
	Groups util.StringSet
}

ResourceAccessReviewResponse describes who can perform the action

func (*ResourceAccessReviewResponse) IsAnAPIObject

func (*ResourceAccessReviewResponse) IsAnAPIObject()

type Role

type Role struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// Rules holds all the PolicyRules for this Role
	Rules []PolicyRule
}

Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.

func ToRole

func ToRole(in *ClusterRole) *Role

func (*Role) IsAnAPIObject

func (*Role) IsAnAPIObject()

type RoleBinding

type RoleBinding struct {
	kapi.TypeMeta
	kapi.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the RoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func SortRoleBindings

func SortRoleBindings(roleBindingMap map[string]*RoleBinding, reverse bool) []*RoleBinding

func ToRoleBinding

func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding

func (*RoleBinding) IsAnAPIObject

func (*RoleBinding) IsAnAPIObject()

type RoleBindingList

type RoleBindingList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of roleBindings
	Items []RoleBinding
}

RoleBindingList is a collection of RoleBindings

func ToRoleBindingList

func ToRoleBindingList(in *ClusterRoleBindingList) *RoleBindingList

func (*RoleBindingList) IsAnAPIObject

func (*RoleBindingList) IsAnAPIObject()

type RoleBindingSorter

type RoleBindingSorter []*RoleBinding

func (RoleBindingSorter) Len

func (s RoleBindingSorter) Len() int

func (RoleBindingSorter) Less

func (s RoleBindingSorter) Less(i, j int) bool

func (RoleBindingSorter) Swap

func (s RoleBindingSorter) Swap(i, j int)

type RoleList

type RoleList struct {
	kapi.TypeMeta
	kapi.ListMeta

	// Items is a list of roles
	Items []Role
}

RoleList is a collection of Roles

func ToRoleList

func ToRoleList(in *ClusterRoleList) *RoleList

func (*RoleList) IsAnAPIObject

func (*RoleList) IsAnAPIObject()

type SubjectAccessReview

type SubjectAccessReview struct {
	kapi.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	Groups util.StringSet
}

SubjectAccessReview is an object for requesting information about whether a user or group can perform an action

func (*SubjectAccessReview) IsAnAPIObject

func (*SubjectAccessReview) IsAnAPIObject()

type SubjectAccessReviewResponse

type SubjectAccessReviewResponse struct {
	kapi.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Allowed is required.  True if the action would be allowed, false otherwise.
	Allowed bool
	// Reason is optional.  It indicates why a request was allowed or denied.
	Reason string
}

SubjectAccessReviewResponse describes whether or not a user or group can perform an action

func (*SubjectAccessReviewResponse) IsAnAPIObject

func (*SubjectAccessReviewResponse) IsAnAPIObject()

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL