authorization

Documentation

Index

• Constants
• func DelegateAuthorization(delegationReason string, delegate authorizer.Authorizer) authorizer.Authorizer
• func IsDeepSubjectAccessReviewFrom(ctx context.Context, attr authorizer.Attributes) bool
• func NewBootstrapPolicyAuthorizer(informers kcpkubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)
• func NewGlobalAuthorizer(...) (authorizer.Authorizer, authorizer.RuleResolver)
• func NewLocalAuthorizer(versionedInformers kcpkubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)
• func NewMaximalPermissionPolicyAuthorizer(...) authorizer.Authorizer
• func NewRequiredGroupsAuthorizer(local, global corev1alpha1listers.LogicalClusterClusterLister, ...) authorizer.Authorizer
• func NewSystemCRDAuthorizer(delegate authorizer.Authorizer) authorizer.Authorizer
• func NewWorkspaceContentAuthorizer(localInformers, globalInformers kcpkubernetesinformers.SharedInformerFactory, ...) authorizer.Authorizer
• func WithAuditLogging(annotationDomain string, delegate authorizer.Authorizer) authorizer.Authorizer
• func WithDeepSARConfig(config *rest.Config) *rest.Config
• func WithDeepSubjectAccessReview(handler http.Handler) http.Handler
• func WithSubjectAccessReviewAuditAnnotations(handler http.Handler) http.Handler
• type BootstrapPolicyAuthorizer
  • func (a *BootstrapPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
  • func (a *BootstrapPolicyAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)
• type Decorator
  • func NewDecorator(key string, target authorizer.Authorizer) *Decorator
  • func (d *Decorator) AddAnonymization() *Decorator
  • func (d *Decorator) AddAuditLogging() *Decorator
  • func (d *Decorator) AddReasonAnnotation() *Decorator
  • func (d *Decorator) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error)
• type GlobalAuthorizer
  • func (a *GlobalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
  • func (a *GlobalAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)
• type LocalAuthorizer
  • func (a *LocalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
  • func (a *LocalAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)
• type MaximalPermissionPolicyAuthorizer
  • func (a *MaximalPermissionPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error)
• type SystemCRDAuthorizer
  • func (a *SystemCRDAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

Constants

const (
	DecisionNoOpinion = "NoOpinion"
	DecisionAllowed   = "Allowed"
	DecisionDenied    = "Denied"
)

const (
	MaximalPermissionPolicyAccessNotPermittedReason = "access not permitted by maximal permission policy"
)

const (
	// RequiredGroupsAnnotationKey is a comma-separated list (OR'ed) of semicolon separated
	// groups (AND'ed) that a user must be a member of to be able to access the workspace.
	RequiredGroupsAnnotationKey = "authorization.kcp.io/required-groups"
)

const (
	WorkspaceAccessNotPermittedReason = "workspace access not permitted"
)

Functions

func DelegateAuthorization

func DelegateAuthorization(delegationReason string, delegate authorizer.Authorizer) authorizer.Authorizer

DelegateAuthorization delegates authorization to the given delegate authorizer and prefixes the given reason with the reason after the given delegate authorizer executed.

func IsDeepSubjectAccessReviewFrom

func IsDeepSubjectAccessReviewFrom(ctx context.Context, attr authorizer.Attributes) bool

IsDeepSubjectAccessReviewFrom returns whether this is a deep SAR request. If true, top-level workspace and workspace content authorization checks have to be skipped.

func NewBootstrapPolicyAuthorizer

func NewBootstrapPolicyAuthorizer(informers kcpkubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)

func NewGlobalAuthorizer

func NewGlobalAuthorizer(localKubeInformers, globalKubeInformers kcpkubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)

func NewLocalAuthorizer

func NewLocalAuthorizer(versionedInformers kcpkubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)

func NewMaximalPermissionPolicyAuthorizer

func NewMaximalPermissionPolicyAuthorizer(kubeInformers, globalKubeInformers kcpkubernetesinformers.SharedInformerFactory, kcpInformers, globalKcpInformers kcpinformers.SharedInformerFactory, delegate authorizer.Authorizer) authorizer.Authorizer

NewMaximalPermissionPolicyAuthorizer returns an authorizer that first checks if the request is for a bound resource or not. If the resource is bound it checks the maximal permission policy of the underlying API export.

func NewRequiredGroupsAuthorizer

func NewRequiredGroupsAuthorizer(local, global corev1alpha1listers.LogicalClusterClusterLister, delegate authorizer.Authorizer) authorizer.Authorizer

NewRequiredGroupsAuthorizer returns an authorizer that a set of groups stored on the LogicalCluster object. Service account by-pass this.

func NewSystemCRDAuthorizer

func NewSystemCRDAuthorizer(delegate authorizer.Authorizer) authorizer.Authorizer

func NewWorkspaceContentAuthorizer

func NewWorkspaceContentAuthorizer(localInformers, globalInformers kcpkubernetesinformers.SharedInformerFactory, localLogicalClusterLister, globalLogicalClusterLister corev1alpha1listers.LogicalClusterClusterLister, delegate authorizer.Authorizer) authorizer.Authorizer

func WithAuditLogging

func WithAuditLogging(annotationDomain string, delegate authorizer.Authorizer) authorizer.Authorizer

WithAuditLogging stores the given domain in the context to be used when logging audit events in the given authorizer chain. The annotations will have the format <prefix>.<domain>/<key>. If that context is not set, audit logging is skipped. Note that this is only respected by authorizers that have been decorated using Decorator.AddAuditLogging.

func WithDeepSARConfig

func WithDeepSARConfig(config *rest.Config) *rest.Config

WithDeepSARConfig modifies and returns the input rest.Config with an additional header making SARs to be deep.

func WithDeepSubjectAccessReview

func WithDeepSubjectAccessReview(handler http.Handler) http.Handler

WithDeepSubjectAccessReview attaches to the context that this request has set the DeepSubjectAccessReview header. The header is ignored for non-system:master users and for non-SAR request.

A deep SAR request skips top-level workspace and workspace content authorization checks.

func WithSubjectAccessReviewAuditAnnotations

func WithSubjectAccessReviewAuditAnnotations(handler http.Handler) http.Handler

Types

type BootstrapPolicyAuthorizer

type BootstrapPolicyAuthorizer struct {
	// contains filtered or unexported fields
}

func (*BootstrapPolicyAuthorizer) Authorize

func (a *BootstrapPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

func (*BootstrapPolicyAuthorizer) RulesFor

func (a *BootstrapPolicyAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

type Decorator

type Decorator struct {
	// contains filtered or unexported fields
}

func NewDecorator

func NewDecorator(key string, target authorizer.Authorizer) *Decorator

NewDecorator returns a new authorizer which is associated with the given key. The prefix key must not contain a slash `/`. Decorating functions are applied in the order they have been invoked.

func (*Decorator) AddAnonymization

func (d *Decorator) AddAnonymization() *Decorator

AddAnonymization anonymizes authorization decisions, returning "access granted" reason in case of an allow decision and "access denied" reason otherwise to the next decoration. Previous decorations are not anonymized.

func (*Decorator) AddAuditLogging

func (d *Decorator) AddAuditLogging() *Decorator

AddAuditLogging logs every decision of the target authorizer for the given audit prefix key if the decision is not allowed. All authorizer decisions are being logged in the audit log if the context was set using WithAuditLogging. This prevents double audit log entries by multiple invocations of the authorizer chain.

func (*Decorator) AddReasonAnnotation

func (d *Decorator) AddReasonAnnotation() *Decorator

AddReasonAnnotation adds the authorizer key as a prefix to the authorizer reason and passes that to the next decoration. This is useful where AddAnonymization was used as a decoration, but we still want to identify the authorizer in audit logs when this decorator is passed as a delegate in an authorizer chains.

func (*Decorator) Authorize

func (d *Decorator) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error)

type GlobalAuthorizer

type GlobalAuthorizer struct {
	// contains filtered or unexported fields
}

func (*GlobalAuthorizer) Authorize

func (a *GlobalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

func (*GlobalAuthorizer) RulesFor

func (a *GlobalAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

type LocalAuthorizer

type LocalAuthorizer struct {
	// contains filtered or unexported fields
}

func (*LocalAuthorizer) Authorize

func (a *LocalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

func (*LocalAuthorizer) RulesFor

func (a *LocalAuthorizer) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

type MaximalPermissionPolicyAuthorizer

type MaximalPermissionPolicyAuthorizer struct {
	// contains filtered or unexported fields
}

func (*MaximalPermissionPolicyAuthorizer) Authorize

func (a *MaximalPermissionPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error)

type SystemCRDAuthorizer

type SystemCRDAuthorizer struct {
	// contains filtered or unexported fields
}

SystemCRDAuthorizer protects the system CRDs from users who are admins in their workspaces.

func (*SystemCRDAuthorizer) Authorize

func (a *SystemCRDAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)