cmd

Documentation

Index

• Constants
• func NewWhoCanCommand(streams clioptions.IOStreams) (*cobra.Command, error)
• type AccessChecker
  • func NewAccessChecker(client clientauthz.SelfSubjectAccessReviewInterface) AccessChecker
• type Action
  • func ActionFrom(clientConfig clientcmd.ClientConfig, flags *pflag.FlagSet, args []string) (action Action, err error)
  • func (w Action) String() string
• type NamespaceValidator
  • func NewNamespaceValidator(client clientcore.NamespaceInterface) NamespaceValidator
• type PolicyRuleMatcher
  • func NewPolicyRuleMatcher() PolicyRuleMatcher
• type Printer
  • func NewPrinter(out io.Writer, wide bool) *Printer
  • func (p *Printer) ExportData(action Action, roleBindings []rbac.RoleBinding, ...)
  • func (p *Printer) PrintChecks(action Action, roleBindings []rbac.RoleBinding, ...)
  • func (p *Printer) PrintWarnings(warnings []string)
• type ResourceResolver
  • func NewResourceResolver(client discovery.DiscoveryInterface, mapper meta.RESTMapper) ResourceResolver
• type WhoCan
  • func NewWhoCan(restConfig *rest.Config, mapper apimeta.RESTMapper) (*WhoCan, error)
  • func (w *WhoCan) Check(action Action) (roleBindings []rbac.RoleBinding, clusterRoleBindings []rbac.ClusterRoleBinding, ...)
  • func (w *WhoCan) CheckAPIAccess(action Action) ([]string, error)

Constants

const (
	// RoleKind is the RoleRef's Kind referencing a Role.
	RoleKind = "Role"
	// ClusterRoleKind is the RoleRef's Kind referencing a ClusterRole.
	ClusterRoleKind = "ClusterRole"
)

Functions

func NewWhoCanCommand

func NewWhoCanCommand(streams clioptions.IOStreams) (*cobra.Command, error)

NewWhoCanCommand constructs the WhoCan command with the specified IOStreams.

Types

type AccessChecker

type AccessChecker interface {
	IsAllowedTo(verb, resource, namespace string) (bool, error)
}

AccessChecker wraps the IsAllowedTo method.

IsAllowedTo checks whether the current user is allowed to perform the given action in the specified namespace. Specifying "" as namespace performs check in all namespaces.

func NewAccessChecker

func NewAccessChecker(client clientauthz.SelfSubjectAccessReviewInterface) AccessChecker

NewAccessChecker constructs the default AccessChecker.

type Action

type Action struct {
	Verb         string
	Resource     string
	ResourceName string
	SubResource  string

	NonResourceURL string

	Namespace     string
	AllNamespaces bool
}

Action represents an action a subject can be given permission to.

func ActionFrom

func ActionFrom(clientConfig clientcmd.ClientConfig, flags *pflag.FlagSet, args []string) (action Action, err error)

ActionFrom sets all information required to check who can perform the specified action.

func (Action) String

func (w Action) String() string

type NamespaceValidator

type NamespaceValidator interface {
	Validate(name string) error
}

NamespaceValidator wraps the Validate method.

Validate checks whether the given namespace exists or not. Returns nil if it exists, an error otherwise.

func NewNamespaceValidator

func NewNamespaceValidator(client clientcore.NamespaceInterface) NamespaceValidator

NewNamespaceValidator constructs the default NamespaceValidator.

type PolicyRuleMatcher

type PolicyRuleMatcher interface {
	MatchesRole(role rbac.Role, action resolvedAction) bool
	MatchesClusterRole(role rbac.ClusterRole, action resolvedAction) bool
}

PolicyRuleMatcher wraps the Matches* methods.

MatchesRole returns `true` if any PolicyRule defined by the given Role matches the specified Action, `false` otherwise.

MatchesClusterRole returns `true` if any PolicyRule defined by the given ClusterRole matches the specified Action, `false` otherwise.

func NewPolicyRuleMatcher

func NewPolicyRuleMatcher() PolicyRuleMatcher

NewPolicyRuleMatcher constructs the default PolicyRuleMatcher.

type Printer

type Printer struct {
	// contains filtered or unexported fields
}

Printer formats and prints check results and warnings.

func NewPrinter

func NewPrinter(out io.Writer, wide bool) *Printer

NewPrinter constructs a new Printer with the specified output io.Writer and output format.

func (*Printer) ExportData

func (p *Printer) ExportData(action Action, roleBindings []rbac.RoleBinding, clusterRoleBindings []rbac.ClusterRoleBinding)

ExportData exports data to a file.

func (*Printer) PrintChecks

func (p *Printer) PrintChecks(action Action, roleBindings []rbac.RoleBinding, clusterRoleBindings []rbac.ClusterRoleBinding)

func (*Printer) PrintWarnings

func (p *Printer) PrintWarnings(warnings []string)

PrintWarnings prints warnings, if any, returned by CheckAPIAccess.

type ResourceResolver

type ResourceResolver interface {
	Resolve(verb, resource, subResource string) (schema.GroupResource, error)
}

ResourceResolver wraps the Resolve method.

Resolve attempts to resolve a GroupResource by `resource` and `subResource`. It also validates that the specified `verb` is supported by the resolved resource.

func NewResourceResolver

func NewResourceResolver(client discovery.DiscoveryInterface, mapper meta.RESTMapper) ResourceResolver

NewResourceResolver constructs the default ResourceResolver.

type WhoCan

type WhoCan struct {
	// contains filtered or unexported fields
}

func NewWhoCan

func NewWhoCan(restConfig *rest.Config, mapper apimeta.RESTMapper) (*WhoCan, error)

NewWhoCan constructs a new WhoCan checker with the specified rest.Config and RESTMapper.

func (*WhoCan) Check

func (w *WhoCan) Check(action Action) (roleBindings []rbac.RoleBinding, clusterRoleBindings []rbac.ClusterRoleBinding, err error)

Check checks who can perform the action specified by WhoCanOptions and returns the role bindings that allows the action to be performed.

func (*WhoCan) CheckAPIAccess

func (w *WhoCan) CheckAPIAccess(action Action) ([]string, error)

CheckAPIAccess checks whether the subject in the current context has enough privileges to query Kubernetes API server to perform Check.