Documentation ¶
Overview ¶
+groupName=authorization.openshift.io Package api is the internal version of the API.
Index ¶
- Constants
- Variables
- func BuildSubjects(users, groups []string, ...) []kapi.ObjectReference
- func ClusterPolicyBindingToSelectableFields(policyBinding *ClusterPolicyBinding) fields.Set
- func ClusterPolicyToSelectableFields(policy *ClusterPolicy) fields.Set
- func Convert_authorization_ClusterRoleBinding_To_rbac_ClusterRoleBinding(in *ClusterRoleBinding, out *rbac.ClusterRoleBinding, _ conversion.Scope) error
- func Convert_authorization_ClusterRole_To_rbac_ClusterRole(in *ClusterRole, out *rbac.ClusterRole, _ conversion.Scope) error
- func Convert_authorization_RoleBinding_To_rbac_RoleBinding(in *RoleBinding, out *rbac.RoleBinding, _ conversion.Scope) error
- func Convert_authorization_Role_To_rbac_Role(in *Role, out *rbac.Role, _ conversion.Scope) error
- func Convert_rbac_ClusterRoleBinding_To_authorization_ClusterRoleBinding(in *rbac.ClusterRoleBinding, out *ClusterRoleBinding, _ conversion.Scope) error
- func Convert_rbac_ClusterRole_To_authorization_ClusterRole(in *rbac.ClusterRole, out *ClusterRole, _ conversion.Scope) error
- func Convert_rbac_RoleBinding_To_authorization_RoleBinding(in *rbac.RoleBinding, out *RoleBinding, _ conversion.Scope) error
- func Convert_rbac_Role_To_authorization_Role(in *rbac.Role, out *Role, _ conversion.Scope) error
- func DeepCopy_authorization_Action(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterPolicy(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterPolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterPolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterPolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterRole(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterRoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterRoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ClusterRoleList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_GroupRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_IsPersonalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_LocalResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_LocalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_Policy(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_PolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_PolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_PolicyRuleBuilder(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ResourceAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_Role(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleBindingRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleBindingRestrictionList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleBindingRestrictionSpec(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_RoleList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SelfSubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SelfSubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ServiceAccountReference(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_ServiceAccountRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SubjectAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_SubjectRulesReviewStatus(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_authorization_UserRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
- func GetPolicyBindingName(policyRefNamespace string) string
- func IsKindOrLegacy(kind string, gk schema.GroupKind) bool
- func IsResourceOrLegacy(resource string, gr schema.GroupResource) bool
- func Kind(kind string) schema.GroupKind
- func LegacyKind(kind string) schema.GroupKind
- func LegacyResource(resource string) schema.GroupResource
- func NormalizeResources(rawResources sets.String) sets.String
- func PolicyBindingToSelectableFields(policyBinding *PolicyBinding) fields.Set
- func PolicyToSelectableFields(policy *Policy) fields.Set
- func RegisterDeepCopies(scheme *runtime.Scheme) error
- func Resource(resource string) schema.GroupResource
- func RoleBindingRestrictionToSelectableFields(rbr *RoleBindingRestriction) fields.Set
- func RoleBindingToSelectableFields(roleBinding *RoleBinding) fields.Set
- func RoleToSelectableFields(role *Role) fields.Set
- func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)
- func SubjectsContainAnyGroup(subjects []kapi.ObjectReference, groups []string) bool
- func SubjectsContainUser(subjects []kapi.ObjectReference, currentNamespace string, user string) bool
- func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)
- func ToClusterPolicyRef(in kapi.ObjectReference) kapi.ObjectReference
- func ToClusterRoleBindingMap(in map[string]*RoleBinding) map[string]*ClusterRoleBinding
- func ToClusterRoleMap(in map[string]*Role) map[string]*ClusterRole
- func ToClusterRoleRef(in kapi.ObjectReference) kapi.ObjectReference
- func ToPolicyRef(in kapi.ObjectReference) kapi.ObjectReference
- func ToRoleBindingMap(in map[string]*ClusterRoleBinding) map[string]*RoleBinding
- func ToRoleMap(in map[string]*ClusterRole) map[string]*Role
- func ToRoleRef(in kapi.ObjectReference) kapi.ObjectReference
- type Action
- type ClusterPolicy
- type ClusterPolicyBinding
- type ClusterPolicyBindingList
- type ClusterPolicyList
- type ClusterRole
- type ClusterRoleBinding
- type ClusterRoleBindingList
- type ClusterRoleBindingsByName
- type ClusterRoleList
- type ClusterRolesByName
- type GroupRestriction
- type IsPersonalSubjectAccessReview
- type LocalResourceAccessReview
- type LocalSubjectAccessReview
- type Policy
- type PolicyBinding
- type PolicyBindingList
- type PolicyBindingSorter
- type PolicyList
- type PolicyRule
- type PolicyRuleBuilder
- func (r *PolicyRuleBuilder) Groups(groups ...string) *PolicyRuleBuilder
- func (r *PolicyRuleBuilder) Names(names ...string) *PolicyRuleBuilder
- func (r *PolicyRuleBuilder) Resources(resources ...string) *PolicyRuleBuilder
- func (r *PolicyRuleBuilder) Rule() (PolicyRule, error)
- func (r *PolicyRuleBuilder) RuleOrDie() PolicyRule
- type ResourceAccessReview
- type ResourceAccessReviewResponse
- type Role
- type RoleBinding
- type RoleBindingList
- type RoleBindingRestriction
- type RoleBindingRestrictionList
- type RoleBindingRestrictionSpec
- type RoleBindingSorter
- type RoleBindingsByName
- type RoleList
- type RolesByName
- type SelfSubjectRulesReview
- type SelfSubjectRulesReviewSpec
- type ServiceAccountReference
- type ServiceAccountRestriction
- type SortableRuleSlice
- type SubjectAccessReview
- type SubjectAccessReviewResponse
- type SubjectRulesReview
- type SubjectRulesReviewSpec
- type SubjectRulesReviewStatus
- type UserRestriction
Constants ¶
const ( LegacyGroupName = "" GroupName = "authorization.openshift.io" )
const ( DockerBuildResource = "builds/docker" OptimizedDockerBuildResource = "builds/optimizeddocker" SourceBuildResource = "builds/source" CustomBuildResource = "builds/custom" JenkinsPipelineBuildResource = "builds/jenkinspipeline" // these are valid under the "nodes" resource NodeMetricsSubresource = "metrics" NodeStatsSubresource = "stats" NodeSpecSubresource = "spec" NodeLogSubresource = "log" RestrictedEndpointsResource = "endpoints/restricted" )
Synthetic authorization endpoints
const ( // PolicyName is the name of Policy PolicyName = "default" APIGroupAll = "*" ResourceAll = "*" VerbAll = "*" NonResourceAll = "*" ScopesKey = "scopes.authorization.openshift.io" ScopesAllNamespaces = "*" UserKind = "User" GroupKind = "Group" ServiceAccountKind = "ServiceAccount" SystemUserKind = "SystemUser" SystemGroupKind = "SystemGroup" UserResource = "users" GroupResource = "groups" ServiceAccountResource = "serviceaccounts" SystemUserResource = "systemusers" SystemGroupResource = "systemgroups" )
Variables ¶
var ( SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal} LegacySchemeGroupVersion = schema.GroupVersion{Group: LegacyGroupName, Version: runtime.APIVersionInternal} LegacySchemeBuilder = runtime.NewSchemeBuilder(addLegacyKnownTypes) AddToSchemeInCoreGroup = LegacySchemeBuilder.AddToScheme SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addConversionFuncs) AddToScheme = SchemeBuilder.AddToScheme )
var ClusterPolicyBindingName = GetPolicyBindingName("")
var DiscoveryRule = PolicyRule{ Verbs: sets.NewString("get"), NonResourceURLs: sets.NewString( "/version", "/version/*", "/api", "/api/*", "/apis", "/apis/*", "/oapi", "/oapi/*", "/swaggerapi", "/swaggerapi/*", "/swagger.json", "/osapi", "/osapi/", "/.well-known", "/.well-known/*", ), }
DiscoveryRule is a rule that allows a client to discover the API resources available on this server
Functions ¶
func BuildSubjects ¶
func BuildSubjects(users, groups []string, userNameValidator, groupNameValidator validation.ValidateNameFunc) []kapi.ObjectReference
func ClusterPolicyBindingToSelectableFields ¶
func ClusterPolicyBindingToSelectableFields(policyBinding *ClusterPolicyBinding) fields.Set
ClusterPolicyBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func ClusterPolicyToSelectableFields ¶
func ClusterPolicyToSelectableFields(policy *ClusterPolicy) fields.Set
ClusterPolicyToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func Convert_authorization_ClusterRoleBinding_To_rbac_ClusterRoleBinding ¶
func Convert_authorization_ClusterRoleBinding_To_rbac_ClusterRoleBinding(in *ClusterRoleBinding, out *rbac.ClusterRoleBinding, _ conversion.Scope) error
func Convert_authorization_ClusterRole_To_rbac_ClusterRole ¶
func Convert_authorization_ClusterRole_To_rbac_ClusterRole(in *ClusterRole, out *rbac.ClusterRole, _ conversion.Scope) error
func Convert_authorization_RoleBinding_To_rbac_RoleBinding ¶
func Convert_authorization_RoleBinding_To_rbac_RoleBinding(in *RoleBinding, out *rbac.RoleBinding, _ conversion.Scope) error
func Convert_rbac_ClusterRoleBinding_To_authorization_ClusterRoleBinding ¶
func Convert_rbac_ClusterRoleBinding_To_authorization_ClusterRoleBinding(in *rbac.ClusterRoleBinding, out *ClusterRoleBinding, _ conversion.Scope) error
func Convert_rbac_ClusterRole_To_authorization_ClusterRole ¶
func Convert_rbac_ClusterRole_To_authorization_ClusterRole(in *rbac.ClusterRole, out *ClusterRole, _ conversion.Scope) error
func Convert_rbac_RoleBinding_To_authorization_RoleBinding ¶
func Convert_rbac_RoleBinding_To_authorization_RoleBinding(in *rbac.RoleBinding, out *RoleBinding, _ conversion.Scope) error
func DeepCopy_authorization_Action ¶
func DeepCopy_authorization_Action(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterPolicy ¶
func DeepCopy_authorization_ClusterPolicy(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterPolicyBinding ¶
func DeepCopy_authorization_ClusterPolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterPolicyBindingList ¶
func DeepCopy_authorization_ClusterPolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterPolicyList ¶
func DeepCopy_authorization_ClusterPolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterRole ¶
func DeepCopy_authorization_ClusterRole(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterRoleBinding ¶
func DeepCopy_authorization_ClusterRoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterRoleBindingList ¶
func DeepCopy_authorization_ClusterRoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ClusterRoleList ¶
func DeepCopy_authorization_ClusterRoleList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_GroupRestriction ¶
func DeepCopy_authorization_GroupRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_IsPersonalSubjectAccessReview ¶
func DeepCopy_authorization_IsPersonalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_LocalResourceAccessReview ¶
func DeepCopy_authorization_LocalResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_LocalSubjectAccessReview ¶
func DeepCopy_authorization_LocalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_Policy ¶
func DeepCopy_authorization_Policy(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_PolicyBinding ¶
func DeepCopy_authorization_PolicyBinding(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_PolicyBindingList ¶
func DeepCopy_authorization_PolicyBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_PolicyList ¶
func DeepCopy_authorization_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_PolicyRule ¶
func DeepCopy_authorization_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_PolicyRuleBuilder ¶
func DeepCopy_authorization_PolicyRuleBuilder(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ResourceAccessReview ¶
func DeepCopy_authorization_ResourceAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ResourceAccessReviewResponse ¶
func DeepCopy_authorization_ResourceAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_Role ¶
func DeepCopy_authorization_Role(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleBinding ¶
func DeepCopy_authorization_RoleBinding(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleBindingList ¶
func DeepCopy_authorization_RoleBindingList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleBindingRestriction ¶
func DeepCopy_authorization_RoleBindingRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleBindingRestrictionList ¶
func DeepCopy_authorization_RoleBindingRestrictionList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleBindingRestrictionSpec ¶
func DeepCopy_authorization_RoleBindingRestrictionSpec(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_RoleList ¶
func DeepCopy_authorization_RoleList(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SelfSubjectRulesReview ¶
func DeepCopy_authorization_SelfSubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SelfSubjectRulesReviewSpec ¶
func DeepCopy_authorization_SelfSubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ServiceAccountReference ¶
func DeepCopy_authorization_ServiceAccountReference(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_ServiceAccountRestriction ¶
func DeepCopy_authorization_ServiceAccountRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SubjectAccessReview ¶
func DeepCopy_authorization_SubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SubjectAccessReviewResponse ¶
func DeepCopy_authorization_SubjectAccessReviewResponse(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SubjectRulesReview ¶
func DeepCopy_authorization_SubjectRulesReview(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SubjectRulesReviewSpec ¶
func DeepCopy_authorization_SubjectRulesReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_SubjectRulesReviewStatus ¶
func DeepCopy_authorization_SubjectRulesReviewStatus(in interface{}, out interface{}, c *conversion.Cloner) error
func DeepCopy_authorization_UserRestriction ¶
func DeepCopy_authorization_UserRestriction(in interface{}, out interface{}, c *conversion.Cloner) error
func GetPolicyBindingName ¶
func IsKindOrLegacy ¶
IsKindOrLegacy checks if the provided GroupKind matches with the given kind by looking up the API group and also the legacy API.
func IsResourceOrLegacy ¶
func IsResourceOrLegacy(resource string, gr schema.GroupResource) bool
IsResourceOrLegacy checks if the provided GroupResources matches with the given resource by looking up the API group and also the legacy API.
func LegacyKind ¶
LegacyKind takes an unqualified kind and returns back a Group qualified GroupKind
func LegacyResource ¶
func LegacyResource(resource string) schema.GroupResource
LegacyResource takes an unqualified resource and returns back a Group qualified GroupResource using legacy API
func NormalizeResources ¶
NormalizeResources expands all resource groups and forces all resources to lower case. If the rawResources are already normalized, it returns the original set to avoid the allocation and GC cost, since this is hit multiple times for every REST call. That means you should NEVER MODIFY THE RESULT of this call.
func PolicyBindingToSelectableFields ¶
func PolicyBindingToSelectableFields(policyBinding *PolicyBinding) fields.Set
PolicyBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func PolicyToSelectableFields ¶
PolicyToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func RegisterDeepCopies ¶
RegisterDeepCopies adds deep-copy functions to the given scheme. Public to allow building arbitrary schemes.
func Resource ¶
func Resource(resource string) schema.GroupResource
Resource takes an unqualified resource and returns back a Group qualified GroupResource
func RoleBindingRestrictionToSelectableFields ¶
func RoleBindingRestrictionToSelectableFields(rbr *RoleBindingRestriction) fields.Set
RoleBindingRestrictionToSelectableFields returns a label set that be used to identify a RoleBindingRestriction object.
func RoleBindingToSelectableFields ¶
func RoleBindingToSelectableFields(roleBinding *RoleBinding) fields.Set
RoleBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func RoleToSelectableFields ¶
RoleToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func StringSubjectsFor ¶
func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)
StringSubjectsFor returns users and groups for comparison against user.Info. currentNamespace is used to to create usernames for service accounts where namespace=="".
func SubjectsContainAnyGroup ¶
func SubjectsContainAnyGroup(subjects []kapi.ObjectReference, groups []string) bool
SubjectsContainAnyGroup returns true if the provided subjects any of the named groups.
func SubjectsContainUser ¶
func SubjectsContainUser(subjects []kapi.ObjectReference, currentNamespace string, user string) bool
SubjectsContainUser returns true if the provided subjects contain the named user. currentNamespace is used to identify service accounts that are defined in a relative fashion.
func SubjectsStrings ¶
func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)
SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes. currentNamespace is used to hide the subject.Namespace for ServiceAccounts in the currentNamespace
func ToClusterPolicyRef ¶
func ToClusterPolicyRef(in kapi.ObjectReference) kapi.ObjectReference
func ToClusterRoleBindingMap ¶
func ToClusterRoleBindingMap(in map[string]*RoleBinding) map[string]*ClusterRoleBinding
func ToClusterRoleMap ¶
func ToClusterRoleMap(in map[string]*Role) map[string]*ClusterRole
func ToClusterRoleRef ¶
func ToClusterRoleRef(in kapi.ObjectReference) kapi.ObjectReference
func ToPolicyRef ¶
func ToPolicyRef(in kapi.ObjectReference) kapi.ObjectReference
func ToRoleBindingMap ¶
func ToRoleBindingMap(in map[string]*ClusterRoleBinding) map[string]*RoleBinding
func ToRoleRef ¶
func ToRoleRef(in kapi.ObjectReference) kapi.ObjectReference
Types ¶
type Action ¶
type Action struct { // Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces Namespace string // Verb is one of: get, list, watch, create, update, delete Verb string // Group is the API group of the resource Group string // Version is the API version of the resource Version string // Resource is one of the existing resource types Resource string // ResourceName is the name of the resource being requested for a "get" or deleted for a "delete" ResourceName string // Path is the path of a non resource URL Path string // IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy) IsNonResourceURL bool // Content is the actual content of the request for create and update Content kruntime.Object }
Action describes a request to be authorized
type ClusterPolicy ¶
type ClusterPolicy struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted LastModified metav1.Time // Roles holds all the ClusterRoles held by this ClusterPolicy, mapped by Role.Name Roles ClusterRolesByName }
ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.
func ToClusterPolicy ¶
func ToClusterPolicy(in *Policy) *ClusterPolicy
type ClusterPolicyBinding ¶
type ClusterPolicyBinding struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted LastModified metav1.Time // ClusterPolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference PolicyRef kapi.ObjectReference // RoleBindings holds all the RoleBindings held by this ClusterPolicyBinding, mapped by RoleBinding.Name RoleBindings ClusterRoleBindingsByName }
ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace
func ToClusterPolicyBinding ¶
func ToClusterPolicyBinding(in *PolicyBinding) *ClusterPolicyBinding
type ClusterPolicyBindingList ¶
type ClusterPolicyBindingList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of ClusterPolicyBindings Items []ClusterPolicyBinding }
ClusterPolicyBindingList is a collection of ClusterPolicyBindings
func ToClusterPolicyBindingList ¶
func ToClusterPolicyBindingList(in *PolicyBindingList) *ClusterPolicyBindingList
type ClusterPolicyList ¶
type ClusterPolicyList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of ClusterPolicies Items []ClusterPolicy }
ClusterPolicyList is a collection of ClusterPolicies
func ToClusterPolicyList ¶
func ToClusterPolicyList(in *PolicyList) *ClusterPolicyList
type ClusterRole ¶
type ClusterRole struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // Rules holds all the PolicyRules for this ClusterRole Rules []PolicyRule }
ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.
func ToClusterRole ¶
func ToClusterRole(in *Role) *ClusterRole
type ClusterRoleBinding ¶
type ClusterRoleBinding struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // Subjects hold object references of to authorize with this rule Subjects []kapi.ObjectReference // RoleRef can only reference the current namespace and the global namespace // If the ClusterRoleRef cannot be resolved, the Authorizer must return an error. // Since Policy is a singleton, this is sufficient knowledge to locate a role RoleRef kapi.ObjectReference }
ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
func ToClusterRoleBinding ¶
func ToClusterRoleBinding(in *RoleBinding) *ClusterRoleBinding
type ClusterRoleBindingList ¶
type ClusterRoleBindingList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of ClusterRoleBindings Items []ClusterRoleBinding }
ClusterRoleBindingList is a collection of ClusterRoleBindings
func ToClusterRoleBindingList ¶
func ToClusterRoleBindingList(in *RoleBindingList) *ClusterRoleBindingList
type ClusterRoleBindingsByName ¶
type ClusterRoleBindingsByName map[string]*ClusterRoleBinding
type ClusterRoleList ¶
type ClusterRoleList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of ClusterRoles Items []ClusterRole }
ClusterRoleList is a collection of ClusterRoles
func ToClusterRoleList ¶
func ToClusterRoleList(in *RoleList) *ClusterRoleList
type ClusterRolesByName ¶
type ClusterRolesByName map[string]*ClusterRole
type GroupRestriction ¶
type GroupRestriction struct { // Groups specifies a list of literal group names. Groups []string // Selectors specifies a list of label selectors over group labels. Selectors []metav1.LabelSelector }
GroupRestriction matches a group either by a string match on the group name or a label selector applied to group labels.
type IsPersonalSubjectAccessReview ¶
IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed
type LocalResourceAccessReview ¶
type LocalResourceAccessReview struct { metav1.TypeMeta // Action describes the action being tested Action }
LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace
type LocalSubjectAccessReview ¶
type LocalSubjectAccessReview struct { metav1.TypeMeta // Action describes the action being tested. The Namespace element is FORCED to the current namespace. Action // User is optional. If both User and Groups are empty, the current authenticated user is used. User string // Groups is optional. Groups is the list of groups to which the User belongs. // +k8s:conversion-gen=false Groups sets.String // Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups". // Nil for a self-SAR, means "use the scopes on this request". // Nil for a regular SAR, means the same as empty. // +k8s:conversion-gen=false Scopes []string }
LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
func AddUserToLSAR ¶
func AddUserToLSAR(user user.Info, lsar *LocalSubjectAccessReview) *LocalSubjectAccessReview
type Policy ¶
type Policy struct { metav1.TypeMeta metav1.ObjectMeta // LastModified is the last time that any part of the Policy was created, updated, or deleted LastModified metav1.Time // Roles holds all the Roles held by this Policy, mapped by Role.Name Roles RolesByName }
Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.
func ToPolicy ¶
func ToPolicy(in *ClusterPolicy) *Policy
type PolicyBinding ¶
type PolicyBinding struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted LastModified metav1.Time // PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference PolicyRef kapi.ObjectReference // RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name RoleBindings RoleBindingsByName }
PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace
func ToPolicyBinding ¶
func ToPolicyBinding(in *ClusterPolicyBinding) *PolicyBinding
type PolicyBindingList ¶
type PolicyBindingList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of policyBindings Items []PolicyBinding }
PolicyBindingList is a collection of PolicyBindings
func ToPolicyBindingList ¶
func ToPolicyBindingList(in *ClusterPolicyBindingList) *PolicyBindingList
type PolicyBindingSorter ¶
type PolicyBindingSorter []PolicyBinding
func (PolicyBindingSorter) Len ¶
func (s PolicyBindingSorter) Len() int
func (PolicyBindingSorter) Less ¶
func (s PolicyBindingSorter) Less(i, j int) bool
func (PolicyBindingSorter) Swap ¶
func (s PolicyBindingSorter) Swap(i, j int)
type PolicyList ¶
type PolicyList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of policies Items []Policy }
PolicyList is a collection of Policies
func ToPolicyList ¶
func ToPolicyList(in *ClusterPolicyList) *PolicyList
type PolicyRule ¶
type PolicyRule struct { // Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds. Verbs sets.String // AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports. // If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error. AttributeRestrictions kruntime.Object // APIGroups is the name of the APIGroup that contains the resources. If this field is empty, then both kubernetes and origin API groups are assumed. // That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request // will be allowed APIGroups []string // Resources is a list of resources this rule applies to. ResourceAll represents all resources. Resources sets.String // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. ResourceNames sets.String // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path // If an action is not a resource API request, then the URL is split on '/' and is checked against the NonResourceURLs to look for a match. NonResourceURLs sets.String }
PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.
func (PolicyRule) CompactString ¶
func (r PolicyRule) CompactString() string
CompactString exposes a compact string representation for use in escalation error messages
func (PolicyRule) String ¶
func (r PolicyRule) String() string
type PolicyRuleBuilder ¶
type PolicyRuleBuilder struct {
PolicyRule PolicyRule
}
+gencopy=false PolicyRuleBuilder let's us attach methods. A no-no for API types
func NewRule ¶
func NewRule(verbs ...string) *PolicyRuleBuilder
func (*PolicyRuleBuilder) Groups ¶
func (r *PolicyRuleBuilder) Groups(groups ...string) *PolicyRuleBuilder
func (*PolicyRuleBuilder) Names ¶
func (r *PolicyRuleBuilder) Names(names ...string) *PolicyRuleBuilder
func (*PolicyRuleBuilder) Resources ¶
func (r *PolicyRuleBuilder) Resources(resources ...string) *PolicyRuleBuilder
func (*PolicyRuleBuilder) Rule ¶
func (r *PolicyRuleBuilder) Rule() (PolicyRule, error)
func (*PolicyRuleBuilder) RuleOrDie ¶
func (r *PolicyRuleBuilder) RuleOrDie() PolicyRule
type ResourceAccessReview ¶
type ResourceAccessReview struct { metav1.TypeMeta // Action describes the action being tested Action }
ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec
type ResourceAccessReviewResponse ¶
type ResourceAccessReviewResponse struct { metav1.TypeMeta // Namespace is the namespace used for the access review Namespace string // Users is the list of users who can perform the action // +k8s:conversion-gen=false Users sets.String // Groups is the list of groups who can perform the action // +k8s:conversion-gen=false Groups sets.String // EvaluationError is an indication that some error occurred during resolution, but partial results can still be returned. // It is entirely possible to get an error and be able to continue determine authorization status in spite of it. This is // most common when a bound role is missing, but enough roles are still present and bound to reason about the request. EvaluationError string }
ResourceAccessReviewResponse describes who can perform the action
type Role ¶
type Role struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // Rules holds all the PolicyRules for this Role Rules []PolicyRule }
Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.
func ToRole ¶
func ToRole(in *ClusterRole) *Role
type RoleBinding ¶
type RoleBinding struct { metav1.TypeMeta metav1.ObjectMeta // Subjects hold object references of to authorize with this rule Subjects []kapi.ObjectReference // RoleRef can only reference the current namespace and the global namespace // If the RoleRef cannot be resolved, the Authorizer must return an error. // Since Policy is a singleton, this is sufficient knowledge to locate a role RoleRef kapi.ObjectReference }
RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
func ToRoleBinding ¶
func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding
type RoleBindingList ¶
type RoleBindingList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of roleBindings Items []RoleBinding }
RoleBindingList is a collection of RoleBindings
func ToRoleBindingList ¶
func ToRoleBindingList(in *ClusterRoleBindingList) *RoleBindingList
type RoleBindingRestriction ¶
type RoleBindingRestriction struct { metav1.TypeMeta // Standard object's metadata. metav1.ObjectMeta // Spec defines the matcher. Spec RoleBindingRestrictionSpec }
RoleBindingRestriction is an object that can be matched against a subject (user, group, or service account) to determine whether rolebindings on that subject are allowed in the namespace to which the RoleBindingRestriction belongs. If any one of those RoleBindingRestriction objects matches a subject, rolebindings on that subject in the namespace are allowed.
type RoleBindingRestrictionList ¶
type RoleBindingRestrictionList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of RoleBindingRestriction objects. Items []RoleBindingRestriction }
RoleBindingRestrictionList is a collection of RoleBindingRestriction objects.
type RoleBindingRestrictionSpec ¶
type RoleBindingRestrictionSpec struct { // UserRestriction matches against user subjects. UserRestriction *UserRestriction // GroupRestriction matches against group subjects. GroupRestriction *GroupRestriction // ServiceAccountRestriction matches against service-account subjects. ServiceAccountRestriction *ServiceAccountRestriction }
RoleBindingRestrictionSpec defines a rolebinding restriction. Exactly one field must be non-nil.
type RoleBindingSorter ¶
type RoleBindingSorter []RoleBinding
func (RoleBindingSorter) Len ¶
func (s RoleBindingSorter) Len() int
func (RoleBindingSorter) Less ¶
func (s RoleBindingSorter) Less(i, j int) bool
func (RoleBindingSorter) Swap ¶
func (s RoleBindingSorter) Swap(i, j int)
type RoleBindingsByName ¶
type RoleBindingsByName map[string]*RoleBinding
type RoleList ¶
type RoleList struct { metav1.TypeMeta // Standard object's metadata. metav1.ListMeta // Items is a list of roles Items []Role }
RoleList is a collection of Roles
func ToRoleList ¶
func ToRoleList(in *ClusterRoleList) *RoleList
type RolesByName ¶
type SelfSubjectRulesReview ¶
type SelfSubjectRulesReview struct { metav1.TypeMeta // Spec adds information about how to conduct the check Spec SelfSubjectRulesReviewSpec // Status is completed by the server to tell which permissions you have Status SubjectRulesReviewStatus }
SelfSubjectRulesReview is a resource you can create to determine which actions you can perform in a namespace
type SelfSubjectRulesReviewSpec ¶
type SelfSubjectRulesReviewSpec struct { // Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups". // Nil for a self-SubjectRulesReview, means "use the scopes on this request". // Nil for a regular SubjectRulesReview, means the same as empty. // +k8s:conversion-gen=false Scopes []string }
SelfSubjectRulesReviewSpec adds information about how to conduct the check
type ServiceAccountReference ¶
type ServiceAccountReference struct { // Name is the name of the service account. Name string // Namespace is the namespace of the service account. Service accounts from // inside the whitelisted namespaces are allowed to be bound to roles. If // Namespace is empty, then the namespace of the RoleBindingRestriction in // which the ServiceAccountReference is embedded is used. Namespace string }
ServiceAccountReference specifies a service account and namespace by their names.
type ServiceAccountRestriction ¶
type ServiceAccountRestriction struct { // ServiceAccounts specifies a list of literal service-account names. ServiceAccounts []ServiceAccountReference // Namespaces specifies a list of literal namespace names. ServiceAccounts // from inside the whitelisted namespaces are allowed to be bound to roles. Namespaces []string }
ServiceAccountRestriction matches a service account by a string match on either the service-account name or the name of the service account's namespace.
type SortableRuleSlice ¶
type SortableRuleSlice []PolicyRule
func (SortableRuleSlice) Len ¶
func (s SortableRuleSlice) Len() int
func (SortableRuleSlice) Less ¶
func (s SortableRuleSlice) Less(i, j int) bool
func (SortableRuleSlice) Swap ¶
func (s SortableRuleSlice) Swap(i, j int)
type SubjectAccessReview ¶
type SubjectAccessReview struct { metav1.TypeMeta // Action describes the action being tested Action // User is optional. If both User and Groups are empty, the current authenticated user is used. User string // Groups is optional. Groups is the list of groups to which the User belongs. // +k8s:conversion-gen=false Groups sets.String // Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups". // Nil for a self-SAR, means "use the scopes on this request". // Nil for a regular SAR, means the same as empty. // +k8s:conversion-gen=false Scopes []string }
SubjectAccessReview is an object for requesting information about whether a user or group can perform an action
func AddUserToSAR ¶
func AddUserToSAR(user user.Info, sar *SubjectAccessReview) *SubjectAccessReview
type SubjectAccessReviewResponse ¶
type SubjectAccessReviewResponse struct { metav1.TypeMeta // Namespace is the namespace used for the access review Namespace string // Allowed is required. True if the action would be allowed, false otherwise. Allowed bool // Reason is optional. It indicates why a request was allowed or denied. Reason string // EvaluationError is an indication that some error occurred during the authorization check. // It is entirely possible to get an error and be able to continue determine authorization status in spite of it. This is // most common when a bound role is missing, but enough roles are still present and bound to reason about the request. EvaluationError string }
SubjectAccessReviewResponse describes whether or not a user or group can perform an action
type SubjectRulesReview ¶
type SubjectRulesReview struct { metav1.TypeMeta // Spec adds information about how to conduct the check Spec SubjectRulesReviewSpec // Status is completed by the server to tell which permissions you have Status SubjectRulesReviewStatus }
SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace
type SubjectRulesReviewSpec ¶
type SubjectRulesReviewSpec struct { // User is optional. At least one of User and Groups must be specified. User string // Groups is optional. Groups is the list of groups to which the User belongs. At least one of User and Groups must be specified. Groups []string // Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups". Scopes []string }
SubjectRulesReviewSpec adds information about how to conduct the check
type SubjectRulesReviewStatus ¶
type SubjectRulesReviewStatus struct { // Rules is the list of rules (no particular sort) that are allowed for the subject Rules []PolicyRule // EvaluationError can appear in combination with Rules. It means some error happened during evaluation // that may have prevented additional rules from being populated. EvaluationError string }
SubjectRulesReviewStatus is contains the result of a rules check
type UserRestriction ¶
type UserRestriction struct { // Users specifies a list of literal user names. Users []string // Groups is a list of groups used to match against an individual user's // groups. If the user is a member of one of the whitelisted groups, the user // is allowed to be bound to a role. Groups []string // Selectors specifies a list of label selectors over user labels. Selectors []metav1.LabelSelector }
UserRestriction matches a user either by a string match on the user name, a string match on the name of a group to which the user belongs, or a label selector applied to the user labels.
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
+groupName=authorization.openshift.io Package v1 is the v1 version of the API.
|
+groupName=authorization.openshift.io Package v1 is the v1 version of the API. |