authorizer

Documentation

Index

• Constants
• func IsPersonalAccessReview(a Action) (bool, error)
• type Action
• type AuthorizationAttributeBuilder
  • func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver RequestInfoResolver) AuthorizationAttributeBuilder
• type Authorizer
  • func NewAuthorizer(ruleResolver rulevalidation.AuthorizationRuleResolver, ...) Authorizer
• type DefaultAuthorizationAttributes
  • func CoerceToDefaultAuthorizationAttributes(passedAttributes Action) *DefaultAuthorizationAttributes
  • func ToDefaultAuthorizationAttributes(in authorizationapi.Action) DefaultAuthorizationAttributes
  • func (a DefaultAuthorizationAttributes) GetAPIGroup() string
  • func (a DefaultAuthorizationAttributes) GetAPIVersion() string
  • func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}
  • func (a DefaultAuthorizationAttributes) GetResource() string
  • func (a DefaultAuthorizationAttributes) GetResourceName() string
  • func (a DefaultAuthorizationAttributes) GetURL() string
  • func (a DefaultAuthorizationAttributes) GetVerb() string
  • func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool
  • func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)
• type ForbiddenMessageMaker
• type ForbiddenMessageResolver
  • func NewForbiddenMessageResolver(projectRequestForbiddenTemplate string) *ForbiddenMessageResolver
  • func (m *ForbiddenMessageResolver) MakeMessage(ctx MessageContext) (string, error)
• type MessageContext
• type RequestInfoResolver
  • func NewBrowserSafeRequestInfoResolver(contextMapper kapi.RequestContextMapper, authenticatedGroups sets.String, ...) RequestInfoResolver

Constants

const DefaultProjectRequestForbidden = "You may not request a new project via this API."

Functions

func IsPersonalAccessReview

func IsPersonalAccessReview(a Action) (bool, error)

Types

type Action

type Action interface {
	GetVerb() string
	GetAPIVersion() string
	GetAPIGroup() string
	// GetResource returns the resource type.  If IsNonResourceURL() is true, then GetResource() is "".
	GetResource() string
	GetResourceName() string
	// GetRequestAttributes is of type interface{} because different verbs and different Authorizer/AuthorizationAttributeBuilder pairs may have different contract requirements.
	GetRequestAttributes() interface{}
	// IsNonResourceURL returns true if this is not an action performed against the resource API
	IsNonResourceURL() bool
	// GetURL returns the URL path being requested, including the leading '/'
	GetURL() string
}

type AuthorizationAttributeBuilder

type AuthorizationAttributeBuilder interface {
	GetAttributes(request *http.Request) (Action, error)
}

func NewAuthorizationAttributeBuilder

func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver RequestInfoResolver) AuthorizationAttributeBuilder

type Authorizer

type Authorizer interface {
	Authorize(ctx kapi.Context, a Action) (allowed bool, reason string, err error)
	GetAllowedSubjects(ctx kapi.Context, attributes Action) (sets.String, sets.String, error)
}

func NewAuthorizer

func NewAuthorizer(ruleResolver rulevalidation.AuthorizationRuleResolver, forbiddenMessageMaker ForbiddenMessageMaker) Authorizer

type DefaultAuthorizationAttributes

type DefaultAuthorizationAttributes struct {
	Verb              string
	APIVersion        string
	APIGroup          string
	Resource          string
	ResourceName      string
	RequestAttributes interface{}
	NonResourceURL    bool
	URL               string
}

func CoerceToDefaultAuthorizationAttributes

func CoerceToDefaultAuthorizationAttributes(passedAttributes Action) *DefaultAuthorizationAttributes

TODO this may or may not be the behavior we want for managing rules. As a for instance, a verb might be specified that our attributes builder will never satisfy. For now, I think gets us close. Maybe a warning message of some kind?

func ToDefaultAuthorizationAttributes

func ToDefaultAuthorizationAttributes(in authorizationapi.Action) DefaultAuthorizationAttributes

ToDefaultAuthorizationAttributes coerces Action to DefaultAuthorizationAttributes. Namespace is not included because the authorizer takes that information on the context

func (DefaultAuthorizationAttributes) GetAPIGroup

func (a DefaultAuthorizationAttributes) GetAPIGroup() string

func (DefaultAuthorizationAttributes) GetAPIVersion

func (a DefaultAuthorizationAttributes) GetAPIVersion() string

func (DefaultAuthorizationAttributes) GetRequestAttributes

func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}

func (DefaultAuthorizationAttributes) GetResource

func (a DefaultAuthorizationAttributes) GetResource() string

func (DefaultAuthorizationAttributes) GetResourceName

func (a DefaultAuthorizationAttributes) GetResourceName() string

func (DefaultAuthorizationAttributes) GetURL

func (a DefaultAuthorizationAttributes) GetURL() string

func (DefaultAuthorizationAttributes) GetVerb

func (a DefaultAuthorizationAttributes) GetVerb() string

func (DefaultAuthorizationAttributes) IsNonResourceURL

func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool

func (DefaultAuthorizationAttributes) RuleMatches

func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)

type ForbiddenMessageMaker

type ForbiddenMessageMaker interface {
	MakeMessage(ctx MessageContext) (string, error)
}

ForbiddenMessageMaker creates a forbidden message from a MessageContext

type ForbiddenMessageResolver

type ForbiddenMessageResolver struct {
	// contains filtered or unexported fields
}

func NewForbiddenMessageResolver

func NewForbiddenMessageResolver(projectRequestForbiddenTemplate string) *ForbiddenMessageResolver

func (*ForbiddenMessageResolver) MakeMessage

func (m *ForbiddenMessageResolver) MakeMessage(ctx MessageContext) (string, error)

type MessageContext

type MessageContext struct {
	User       user.Info
	Namespace  string
	Attributes Action
}

MessageContext contains sufficient information to create a forbidden message. It is bundled in this one object to make it easy and obvious how to build a golang template

type RequestInfoResolver

type RequestInfoResolver interface {
	GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error)
}

func NewBrowserSafeRequestInfoResolver

func NewBrowserSafeRequestInfoResolver(contextMapper kapi.RequestContextMapper, authenticatedGroups sets.String, infoResolver RequestInfoResolver) RequestInfoResolver