predicate

Documentation

Index

• func Ready(_ context.Context, _ *cmapi.CertificateRequest, ...) ([]policyapi.CertificateRequestPolicy, error)
• func SelectorIssuerRef(_ context.Context, cr *cmapi.CertificateRequest, ...) ([]policyapi.CertificateRequestPolicy, error)
• type Predicate
  • func RBACBound(client client.Client) Predicate
  • func SelectorNamespace(lister client.Reader) Predicate

Functions

func Ready

func Ready(_ context.Context, _ *cmapi.CertificateRequest, policies []policyapi.CertificateRequestPolicy) ([]policyapi.CertificateRequestPolicy, error)

Ready is a Predicate that returns the subset of given policies that have a Ready condition set to True.

func SelectorIssuerRef

func SelectorIssuerRef(_ context.Context, cr *cmapi.CertificateRequest, policies []policyapi.CertificateRequestPolicy) ([]policyapi.CertificateRequestPolicy, error)

SelectorIssuerRef is a Predicate that returns the subset of given policies that have an `spec.selector.issuerRef` matching the `spec.issuerRef` in the request. PredicateSelectorIssuerRef will match on strings using wilcards "*". Empty selector is equivalent to "*" and will match on anything.

Types

type Predicate

type Predicate func(context.Context, *cmapi.CertificateRequest, []policyapi.CertificateRequestPolicy) ([]policyapi.CertificateRequestPolicy, error)

Predicate is a func called by the Approver Manager to filter the set of CertificateRequestPolicies that should be evaluated on the CertificateRequest. Returned list of CertificateRequestPolicies pass the predicate or filter.

func RBACBound

func RBACBound(client client.Client) Predicate

RBACBoundPolicies is a Predicate that returns the subset of CertificateRequestPolicies that have been RBAC bound to the user in the CertificateRequest. Achieved using SubjectAccessReviews.

func SelectorNamespace

func SelectorNamespace(lister client.Reader) Predicate

SelectorNamespace is a Predicate that returns the subset of given policies that have an `spec.selector.namespace` matching the `metadata.namespace` of the request. SelectorNamespace will match with `namespace.matchNames` on namespaces using wilcards "*". Empty selector is equivalent to "*" and will match on any Namespace.