bootstrappolicy

Documentation

Index

• Variables
• func AddClusterRoleBindingFilter(filter ClusterRoleBindingFilter)
• func ClearClusterRoleBindingFilters()
• func ClusterRoleBindings() []rbac.ClusterRoleBinding
• func ClusterRoles() []rbac.ClusterRole
• func ControllerRoleBindings() []rbac.ClusterRoleBinding
• func ControllerRoles() []rbac.ClusterRole
• func NamespaceRoleBindings() map[string][]rbac.RoleBinding
• func NamespaceRoles() map[string][]rbac.Role
• func NodeRules() []rbac.PolicyRule
• type ClusterRoleBindingFilter

Variables

var (
	ReadWrite = []string{"get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"}
	Read      = []string{"get", "list", "watch"}

	Label      = map[string]string{"kubernetes.io/bootstrapping": "rbac-defaults"}
	Annotation = map[string]string{rbac.AutoUpdateAnnotationKey: "true"}
)

var OmitNodesGroupBinding = ClusterRoleBindingFilter(func(binding *rbac.ClusterRoleBinding) *rbac.ClusterRoleBinding {
	if binding.RoleRef.Name == systemNodeRoleName {
		subjects := []rbac.Subject{}
		for _, subject := range binding.Subjects {
			if subject.Kind == rbac.GroupKind && subject.Name == user.NodesGroup {
				continue
			}
			subjects = append(subjects, subject)
		}
		binding.Subjects = subjects
	}
	return binding
})

OmitNodesGroupBinding is a filter that omits the deprecated binding for the system:nodes group to the system:node role.

Functions

func AddClusterRoleBindingFilter

func AddClusterRoleBindingFilter(filter ClusterRoleBindingFilter)

AddClusterRoleBindingFilter adds the given filter to the list that is invoked when determing bootstrap roles to reconcile.

func ClearClusterRoleBindingFilters

func ClearClusterRoleBindingFilters()

ClearClusterRoleBindingFilters removes any filters added using AddClusterRoleBindingFilter

func ClusterRoleBindings

func ClusterRoleBindings() []rbac.ClusterRoleBinding

ClusterRoleBindings return default rolebindings to the default roles

func ClusterRoles

func ClusterRoles() []rbac.ClusterRole

ClusterRoles returns the cluster roles to bootstrap an API server with

func ControllerRoleBindings

func ControllerRoleBindings() []rbac.ClusterRoleBinding

ControllerRoleBindings returns the role bindings used by controllers

func ControllerRoles

func ControllerRoles() []rbac.ClusterRole

ControllerRoles returns the cluster roles used by controllers

func NamespaceRoleBindings

func NamespaceRoleBindings() map[string][]rbac.RoleBinding

NamespaceRoleBindings returns a map of namespace to slice of roles to create

func NamespaceRoles

func NamespaceRoles() map[string][]rbac.Role

NamespaceRoles returns a map of namespace to slice of roles to create

func NodeRules

func NodeRules() []rbac.PolicyRule

Types

type ClusterRoleBindingFilter

type ClusterRoleBindingFilter func(*rbac.ClusterRoleBinding) *rbac.ClusterRoleBinding

ClusterRoleBindingFilter can modify and return or omit (by returning nil) a role binding