authorization

package
v4.0.0-0.15.0+incompat... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 7, 2018 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

+groupName=authorization.openshift.io Package api is the internal version of the API.

Index

Constants

View Source 
const (
	// PolicyName is the name of Policy
	PolicyName     = "default"
	APIGroupAll    = "*"
	ResourceAll    = "*"
	VerbAll        = "*"
	NonResourceAll = "*"

	ScopesKey           = "scopes.authorization.openshift.io"
	ScopesAllNamespaces = "*"

	UserKind           = "User"
	GroupKind          = "Group"
	ServiceAccountKind = "ServiceAccount"
	SystemUserKind     = "SystemUser"
	SystemGroupKind    = "SystemGroup"

	UserResource           = "users"
	GroupResource          = "groups"
	ServiceAccountResource = "serviceaccounts"
	SystemUserResource     = "systemusers"
	SystemGroupResource    = "systemgroups"
)
View Source 
const (
	GroupName = "authorization.openshift.io"
)

Variables

View Source 
var (
	Install = schemeBuilder.AddToScheme

	// DEPRECATED kept for generated code
	SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
	// DEPRECATED kept for generated code
	AddToScheme = schemeBuilder.AddToScheme
)
View Source 
var DiscoveryRule = rbacv1.PolicyRule{
	Verbs: []string{"get"},
	NonResourceURLs: []string{

		"/version", "/version/*",

		"/api", "/api/*",
		"/apis", "/apis/*",
		"/oapi", "/oapi/*",
		"/openapi/v2",
		"/swaggerapi", "/swaggerapi/*", "/swagger.json", "/swagger-2.0.0.pb-v1",
		"/osapi", "/osapi/",
		"/.well-known", "/.well-known/*",

		"/",
	},
}

DiscoveryRule is a rule that allows a client to discover the API resources available on this server

Functions

func BuildSubjects 

func BuildSubjects(users, groups []string) []kapi.ObjectReference

func Resource 

func Resource(resource string) schema.GroupResource

Resource kept for generated code DEPRECATED

func StringSubjectsFor 

func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)

StringSubjectsFor returns users and groups for comparison against user.Info. currentNamespace is used to to create usernames for service accounts where namespace=="".

func SubjectsStrings 

func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)

SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes. currentNamespace is used to hide the subject.Namespace for ServiceAccounts in the currentNamespace

func ToRoleRef 

func ToRoleRef(in kapi.ObjectReference) kapi.ObjectReference

Types

type Action 

type Action struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	Namespace string
	// Verb is one of: get, list, watch, create, update, delete
	Verb string
	// Group is the API group of the resource
	Group string
	// Version is the API version of the resource
	Version string
	// Resource is one of the existing resource types
	Resource string
	// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
	ResourceName string
	// Path is the path of a non resource URL
	Path string
	// IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)
	IsNonResourceURL bool
	// Content is the actual content of the request for create and update
	Content kruntime.Object
}

Action describes a request to be authorized

func (*Action) DeepCopy 

func (in *Action) DeepCopy() *Action

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Action.

func (*Action) DeepCopyInto 

func (in *Action) DeepCopyInto(out *Action)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ClusterRole 

type ClusterRole struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Rules holds all the PolicyRules for this ClusterRole
	Rules []PolicyRule

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.
	AggregationRule *rbacapi.AggregationRule
}

ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.

func (*ClusterRole) DeepCopy 

func (in *ClusterRole) DeepCopy() *ClusterRole

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRole.

func (*ClusterRole) DeepCopyInto 

func (in *ClusterRole) DeepCopyInto(out *ClusterRole)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterRole) DeepCopyObject 

func (in *ClusterRole) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterRoleBinding 

type ClusterRoleBinding struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func (*ClusterRoleBinding) DeepCopy 

func (in *ClusterRoleBinding) DeepCopy() *ClusterRoleBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRoleBinding.

func (*ClusterRoleBinding) DeepCopyInto 

func (in *ClusterRoleBinding) DeepCopyInto(out *ClusterRoleBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterRoleBinding) DeepCopyObject 

func (in *ClusterRoleBinding) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterRoleBindingList 

type ClusterRoleBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterRoleBindings
	Items []ClusterRoleBinding
}

ClusterRoleBindingList is a collection of ClusterRoleBindings

func (*ClusterRoleBindingList) DeepCopy 

func (in *ClusterRoleBindingList) DeepCopy() *ClusterRoleBindingList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRoleBindingList.

func (*ClusterRoleBindingList) DeepCopyInto 

func (in *ClusterRoleBindingList) DeepCopyInto(out *ClusterRoleBindingList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterRoleBindingList) DeepCopyObject 

func (in *ClusterRoleBindingList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterRoleList 

type ClusterRoleList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of ClusterRoles
	Items []ClusterRole
}

ClusterRoleList is a collection of ClusterRoles

func (*ClusterRoleList) DeepCopy 

func (in *ClusterRoleList) DeepCopy() *ClusterRoleList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRoleList.

func (*ClusterRoleList) DeepCopyInto 

func (in *ClusterRoleList) DeepCopyInto(out *ClusterRoleList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterRoleList) DeepCopyObject 

func (in *ClusterRoleList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type GroupRestriction 

type GroupRestriction struct {
	// Groups specifies a list of literal group names.
	Groups []string

	// Selectors specifies a list of label selectors over group labels.
	Selectors []metav1.LabelSelector
}

GroupRestriction matches a group either by a string match on the group name or a label selector applied to group labels.

func (*GroupRestriction) DeepCopy 

func (in *GroupRestriction) DeepCopy() *GroupRestriction

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupRestriction.

func (*GroupRestriction) DeepCopyInto 

func (in *GroupRestriction) DeepCopyInto(out *GroupRestriction)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IsPersonalSubjectAccessReview 

type IsPersonalSubjectAccessReview struct {
	metav1.TypeMeta
}

IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed

func (*IsPersonalSubjectAccessReview) DeepCopy 

func (in *IsPersonalSubjectAccessReview) DeepCopy() *IsPersonalSubjectAccessReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IsPersonalSubjectAccessReview.

func (*IsPersonalSubjectAccessReview) DeepCopyInto 

func (in *IsPersonalSubjectAccessReview) DeepCopyInto(out *IsPersonalSubjectAccessReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IsPersonalSubjectAccessReview) DeepCopyObject 

func (in *IsPersonalSubjectAccessReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type LocalResourceAccessReview 

type LocalResourceAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
}

LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace

func (*LocalResourceAccessReview) DeepCopy 

func (in *LocalResourceAccessReview) DeepCopy() *LocalResourceAccessReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalResourceAccessReview.

func (*LocalResourceAccessReview) DeepCopyInto 

func (in *LocalResourceAccessReview) DeepCopyInto(out *LocalResourceAccessReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*LocalResourceAccessReview) DeepCopyObject 

func (in *LocalResourceAccessReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type LocalSubjectAccessReview 

type LocalSubjectAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested.  The Namespace element is FORCED to the current namespace.
	Action
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	// +k8s:conversion-gen=false
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace

func (*LocalSubjectAccessReview) DeepCopy 

func (in *LocalSubjectAccessReview) DeepCopy() *LocalSubjectAccessReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalSubjectAccessReview.

func (*LocalSubjectAccessReview) DeepCopyInto 

func (in *LocalSubjectAccessReview) DeepCopyInto(out *LocalSubjectAccessReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*LocalSubjectAccessReview) DeepCopyObject 

func (in *LocalSubjectAccessReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type PolicyRule 

type PolicyRule struct {
	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule.  VerbAll represents all kinds.
	Verbs sets.String
	// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
	// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
	AttributeRestrictions kruntime.Object
	// APIGroups is the name of the APIGroup that contains the resources.  If this field is empty, then both kubernetes and origin API groups are assumed.
	// That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request
	// will be allowed
	APIGroups []string
	// Resources is a list of resources this rule applies to.  ResourceAll represents all resources.
	Resources sets.String
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames sets.String
	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
	// If an action is not a resource API request, then the URL is split on '/' and is checked against the NonResourceURLs to look for a match.
	NonResourceURLs sets.String
}

PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

func (PolicyRule) CompactString 

func (r PolicyRule) CompactString() string

CompactString exposes a compact string representation for use in escalation error messages

func (*PolicyRule) DeepCopy 

func (in *PolicyRule) DeepCopy() *PolicyRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.

func (*PolicyRule) DeepCopyInto 

func (in *PolicyRule) DeepCopyInto(out *PolicyRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (PolicyRule) String 

func (r PolicyRule) String() string

type PolicyRuleBuilder 

type PolicyRuleBuilder struct {
	PolicyRule PolicyRule
}

+gencopy=false PolicyRuleBuilder let's us attach methods. A no-no for API types

func NewRule 

func NewRule(verbs ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) DeepCopy 

func (in *PolicyRuleBuilder) DeepCopy() *PolicyRuleBuilder

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRuleBuilder.

func (*PolicyRuleBuilder) DeepCopyInto 

func (in *PolicyRuleBuilder) DeepCopyInto(out *PolicyRuleBuilder)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PolicyRuleBuilder) Groups 

func (r *PolicyRuleBuilder) Groups(groups ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Names 

func (r *PolicyRuleBuilder) Names(names ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Resources 

func (r *PolicyRuleBuilder) Resources(resources ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Rule 

func (r *PolicyRuleBuilder) Rule() (PolicyRule, error)

func (*PolicyRuleBuilder) RuleOrDie 

func (r *PolicyRuleBuilder) RuleOrDie() PolicyRule

type ResourceAccessReview 

type ResourceAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
}

ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec

func (*ResourceAccessReview) DeepCopy 

func (in *ResourceAccessReview) DeepCopy() *ResourceAccessReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceAccessReview.

func (*ResourceAccessReview) DeepCopyInto 

func (in *ResourceAccessReview) DeepCopyInto(out *ResourceAccessReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ResourceAccessReview) DeepCopyObject 

func (in *ResourceAccessReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ResourceAccessReviewResponse 

type ResourceAccessReviewResponse struct {
	metav1.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Users is the list of users who can perform the action
	// +k8s:conversion-gen=false
	Users sets.String
	// Groups is the list of groups who can perform the action
	// +k8s:conversion-gen=false
	Groups sets.String

	// EvaluationError is an indication that some error occurred during resolution, but partial results can still be returned.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.  This is
	// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
	EvaluationError string
}

ResourceAccessReviewResponse describes who can perform the action

func (*ResourceAccessReviewResponse) DeepCopy 

func (in *ResourceAccessReviewResponse) DeepCopy() *ResourceAccessReviewResponse

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceAccessReviewResponse.

func (*ResourceAccessReviewResponse) DeepCopyInto 

func (in *ResourceAccessReviewResponse) DeepCopyInto(out *ResourceAccessReviewResponse)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ResourceAccessReviewResponse) DeepCopyObject 

func (in *ResourceAccessReviewResponse) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type Role 

type Role struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ObjectMeta

	// Rules holds all the PolicyRules for this Role
	Rules []PolicyRule
}

Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.

func ToRole 

func ToRole(in *ClusterRole) *Role

func (*Role) DeepCopy 

func (in *Role) DeepCopy() *Role

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Role.

func (*Role) DeepCopyInto 

func (in *Role) DeepCopyInto(out *Role)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Role) DeepCopyObject 

func (in *Role) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RoleBinding 

type RoleBinding struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the RoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func ToRoleBinding 

func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding

func (*RoleBinding) DeepCopy 

func (in *RoleBinding) DeepCopy() *RoleBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBinding.

func (*RoleBinding) DeepCopyInto 

func (in *RoleBinding) DeepCopyInto(out *RoleBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RoleBinding) DeepCopyObject 

func (in *RoleBinding) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RoleBindingList 

type RoleBindingList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of roleBindings
	Items []RoleBinding
}

RoleBindingList is a collection of RoleBindings

func ToRoleBindingList 

func ToRoleBindingList(in *ClusterRoleBindingList) *RoleBindingList

func (*RoleBindingList) DeepCopy 

func (in *RoleBindingList) DeepCopy() *RoleBindingList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingList.

func (*RoleBindingList) DeepCopyInto 

func (in *RoleBindingList) DeepCopyInto(out *RoleBindingList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RoleBindingList) DeepCopyObject 

func (in *RoleBindingList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RoleBindingRestriction 

type RoleBindingRestriction struct {
	metav1.TypeMeta

	// Standard object's metadata.
	metav1.ObjectMeta

	// Spec defines the matcher.
	Spec RoleBindingRestrictionSpec
}

RoleBindingRestriction is an object that can be matched against a subject (user, group, or service account) to determine whether rolebindings on that subject are allowed in the namespace to which the RoleBindingRestriction belongs. If any one of those RoleBindingRestriction objects matches a subject, rolebindings on that subject in the namespace are allowed.

func (*RoleBindingRestriction) DeepCopy 

func (in *RoleBindingRestriction) DeepCopy() *RoleBindingRestriction

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingRestriction.

func (*RoleBindingRestriction) DeepCopyInto 

func (in *RoleBindingRestriction) DeepCopyInto(out *RoleBindingRestriction)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RoleBindingRestriction) DeepCopyObject 

func (in *RoleBindingRestriction) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RoleBindingRestrictionList 

type RoleBindingRestrictionList struct {
	metav1.TypeMeta

	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of RoleBindingRestriction objects.
	Items []RoleBindingRestriction
}

RoleBindingRestrictionList is a collection of RoleBindingRestriction objects.

func (*RoleBindingRestrictionList) DeepCopy 

func (in *RoleBindingRestrictionList) DeepCopy() *RoleBindingRestrictionList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingRestrictionList.

func (*RoleBindingRestrictionList) DeepCopyInto 

func (in *RoleBindingRestrictionList) DeepCopyInto(out *RoleBindingRestrictionList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RoleBindingRestrictionList) DeepCopyObject 

func (in *RoleBindingRestrictionList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RoleBindingRestrictionSpec 

type RoleBindingRestrictionSpec struct {
	// UserRestriction matches against user subjects.
	UserRestriction *UserRestriction

	// GroupRestriction matches against group subjects.
	GroupRestriction *GroupRestriction

	// ServiceAccountRestriction matches against service-account subjects.
	ServiceAccountRestriction *ServiceAccountRestriction
}

RoleBindingRestrictionSpec defines a rolebinding restriction. Exactly one field must be non-nil.

func (*RoleBindingRestrictionSpec) DeepCopy 

func (in *RoleBindingRestrictionSpec) DeepCopy() *RoleBindingRestrictionSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingRestrictionSpec.

func (*RoleBindingRestrictionSpec) DeepCopyInto 

func (in *RoleBindingRestrictionSpec) DeepCopyInto(out *RoleBindingRestrictionSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type RoleList 

type RoleList struct {
	metav1.TypeMeta
	// Standard object's metadata.
	metav1.ListMeta

	// Items is a list of roles
	Items []Role
}

RoleList is a collection of Roles

func ToRoleList 

func ToRoleList(in *ClusterRoleList) *RoleList

func (*RoleList) DeepCopy 

func (in *RoleList) DeepCopy() *RoleList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleList.

func (*RoleList) DeepCopyInto 

func (in *RoleList) DeepCopyInto(out *RoleList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RoleList) DeepCopyObject 

func (in *RoleList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SelfSubjectRulesReview 

type SelfSubjectRulesReview struct {
	metav1.TypeMeta

	// Spec adds information about how to conduct the check
	Spec SelfSubjectRulesReviewSpec

	// Status is completed by the server to tell which permissions you have
	Status SubjectRulesReviewStatus
}

SelfSubjectRulesReview is a resource you can create to determine which actions you can perform in a namespace

func (*SelfSubjectRulesReview) DeepCopy 

func (in *SelfSubjectRulesReview) DeepCopy() *SelfSubjectRulesReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelfSubjectRulesReview.

func (*SelfSubjectRulesReview) DeepCopyInto 

func (in *SelfSubjectRulesReview) DeepCopyInto(out *SelfSubjectRulesReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SelfSubjectRulesReview) DeepCopyObject 

func (in *SelfSubjectRulesReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SelfSubjectRulesReviewSpec 

type SelfSubjectRulesReviewSpec struct {
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SubjectRulesReview, means "use the scopes on this request".
	// Nil for a regular SubjectRulesReview, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

SelfSubjectRulesReviewSpec adds information about how to conduct the check

func (*SelfSubjectRulesReviewSpec) DeepCopy 

func (in *SelfSubjectRulesReviewSpec) DeepCopy() *SelfSubjectRulesReviewSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelfSubjectRulesReviewSpec.

func (*SelfSubjectRulesReviewSpec) DeepCopyInto 

func (in *SelfSubjectRulesReviewSpec) DeepCopyInto(out *SelfSubjectRulesReviewSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceAccountReference 

type ServiceAccountReference struct {
	// Name is the name of the service account.
	Name string

	// Namespace is the namespace of the service account.  Service accounts from
	// inside the whitelisted namespaces are allowed to be bound to roles.  If
	// Namespace is empty, then the namespace of the RoleBindingRestriction in
	// which the ServiceAccountReference is embedded is used.
	Namespace string
}

ServiceAccountReference specifies a service account and namespace by their names.

func (*ServiceAccountReference) DeepCopy 

func (in *ServiceAccountReference) DeepCopy() *ServiceAccountReference

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountReference.

func (*ServiceAccountReference) DeepCopyInto 

func (in *ServiceAccountReference) DeepCopyInto(out *ServiceAccountReference)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ServiceAccountRestriction 

type ServiceAccountRestriction struct {
	// ServiceAccounts specifies a list of literal service-account names.
	ServiceAccounts []ServiceAccountReference

	// Namespaces specifies a list of literal namespace names.  ServiceAccounts
	// from inside the whitelisted namespaces are allowed to be bound to roles.
	Namespaces []string
}

ServiceAccountRestriction matches a service account by a string match on either the service-account name or the name of the service account's namespace.

func (*ServiceAccountRestriction) DeepCopy 

func (in *ServiceAccountRestriction) DeepCopy() *ServiceAccountRestriction

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountRestriction.

func (*ServiceAccountRestriction) DeepCopyInto 

func (in *ServiceAccountRestriction) DeepCopyInto(out *ServiceAccountRestriction)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SortableRuleSlice 

type SortableRuleSlice []PolicyRule

func (SortableRuleSlice) DeepCopy 

func (in SortableRuleSlice) DeepCopy() SortableRuleSlice

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SortableRuleSlice.

func (SortableRuleSlice) DeepCopyInto 

func (in SortableRuleSlice) DeepCopyInto(out *SortableRuleSlice)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (SortableRuleSlice) Len 

func (s SortableRuleSlice) Len() int

func (SortableRuleSlice) Less 

func (s SortableRuleSlice) Less(i, j int) bool

func (SortableRuleSlice) Swap 

func (s SortableRuleSlice) Swap(i, j int)

type SubjectAccessReview 

type SubjectAccessReview struct {
	metav1.TypeMeta

	// Action describes the action being tested
	Action
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	// +k8s:conversion-gen=false
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	// +k8s:conversion-gen=false
	Scopes []string
}

SubjectAccessReview is an object for requesting information about whether a user or group can perform an action

func (*SubjectAccessReview) DeepCopy 

func (in *SubjectAccessReview) DeepCopy() *SubjectAccessReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectAccessReview.

func (*SubjectAccessReview) DeepCopyInto 

func (in *SubjectAccessReview) DeepCopyInto(out *SubjectAccessReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SubjectAccessReview) DeepCopyObject 

func (in *SubjectAccessReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SubjectAccessReviewResponse 

type SubjectAccessReviewResponse struct {
	metav1.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Allowed is required.  True if the action would be allowed, false otherwise.
	Allowed bool
	// Reason is optional.  It indicates why a request was allowed or denied.
	Reason string
	// EvaluationError is an indication that some error occurred during the authorization check.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.  This is
	// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
	EvaluationError string
}

SubjectAccessReviewResponse describes whether or not a user or group can perform an action

func (*SubjectAccessReviewResponse) DeepCopy 

func (in *SubjectAccessReviewResponse) DeepCopy() *SubjectAccessReviewResponse

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectAccessReviewResponse.

func (*SubjectAccessReviewResponse) DeepCopyInto 

func (in *SubjectAccessReviewResponse) DeepCopyInto(out *SubjectAccessReviewResponse)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SubjectAccessReviewResponse) DeepCopyObject 

func (in *SubjectAccessReviewResponse) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SubjectRulesReview 

type SubjectRulesReview struct {
	metav1.TypeMeta

	// Spec adds information about how to conduct the check
	Spec SubjectRulesReviewSpec

	// Status is completed by the server to tell which permissions you have
	Status SubjectRulesReviewStatus
}

SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace

func (*SubjectRulesReview) DeepCopy 

func (in *SubjectRulesReview) DeepCopy() *SubjectRulesReview

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectRulesReview.

func (*SubjectRulesReview) DeepCopyInto 

func (in *SubjectRulesReview) DeepCopyInto(out *SubjectRulesReview)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*SubjectRulesReview) DeepCopyObject 

func (in *SubjectRulesReview) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type SubjectRulesReviewSpec 

type SubjectRulesReviewSpec struct {
	// User is optional.  At least one of User and Groups must be specified.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.  At least one of User and Groups must be specified.
	Groups []string
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	Scopes []string
}

SubjectRulesReviewSpec adds information about how to conduct the check

func (*SubjectRulesReviewSpec) DeepCopy 

func (in *SubjectRulesReviewSpec) DeepCopy() *SubjectRulesReviewSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectRulesReviewSpec.

func (*SubjectRulesReviewSpec) DeepCopyInto 

func (in *SubjectRulesReviewSpec) DeepCopyInto(out *SubjectRulesReviewSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SubjectRulesReviewStatus 

type SubjectRulesReviewStatus struct {
	// Rules is the list of rules (no particular sort) that are allowed for the subject
	Rules []PolicyRule
	// EvaluationError can appear in combination with Rules.  It means some error happened during evaluation
	// that may have prevented additional rules from being populated.
	EvaluationError string
}

SubjectRulesReviewStatus is contains the result of a rules check

func (*SubjectRulesReviewStatus) DeepCopy 

func (in *SubjectRulesReviewStatus) DeepCopy() *SubjectRulesReviewStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectRulesReviewStatus.

func (*SubjectRulesReviewStatus) DeepCopyInto 

func (in *SubjectRulesReviewStatus) DeepCopyInto(out *SubjectRulesReviewStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type UserRestriction 

type UserRestriction struct {
	// Users specifies a list of literal user names.
	Users []string

	// Groups is a list of groups used to match against an individual user's
	// groups. If the user is a member of one of the whitelisted groups, the user
	// is allowed to be bound to a role.
	Groups []string

	// Selectors specifies a list of label selectors over user labels.
	Selectors []metav1.LabelSelector
}

UserRestriction matches a user either by a string match on the user name, a string match on the name of a group to which the user belongs, or a label selector applied to the user labels.

func (*UserRestriction) DeepCopy 

func (in *UserRestriction) DeepCopy() *UserRestriction

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserRestriction.

func (*UserRestriction) DeepCopyInto 

func (in *UserRestriction) DeepCopyInto(out *UserRestriction)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Directories

Path Synopsis
internal
serviceaccount
serviceaccount is copied from k8s.io/kubernetes/pkg/serviceaccount to avoid an API dependency on k8s.io/kubernetes outside of the api types we rely upon.
 serviceaccount is copied from k8s.io/kubernetes/pkg/serviceaccount to avoid an API dependency on k8s.io/kubernetes outside of the api types we rely upon.
+groupName=authorization.openshift.io Package v1 is the v1 version of the API.
 +groupName=authorization.openshift.io Package v1 is the v1 version of the API.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.