permissionclaim

Documentation

Index

• Variables
• func InstallIndexers(apiExportInformer apisv1alpha1informers.APIExportClusterInformer)
• type Labeler
  • func NewLabeler(apiBindingInformer apisv1alpha1informers.APIBindingClusterInformer, ...) *Labeler
  • func (l *Labeler) LabelsFor(ctx context.Context, cluster logicalcluster.Name, ...) (map[string]string, error)

Variables

var NonPersistedResourcesClaimable = map[schema.GroupResource]bool{
	authorizationv1.SchemeGroupVersion.WithResource("localsubjectaccessreviews").GroupResource(): true,
	authorizationv1.SchemeGroupVersion.WithResource("selfsubjectaccessreviews").GroupResource():  false,
	authorizationv1.SchemeGroupVersion.WithResource("selfsubjectrulesreviews").GroupResource():   false,
	authorizationv1.SchemeGroupVersion.WithResource("subjectaccessreviews").GroupResource():      true,
	authenticationv1.SchemeGroupVersion.WithResource("selfsubjectreviews").GroupResource():       false,
	authenticationv1.SchemeGroupVersion.WithResource("tokenreviews").GroupResource():             false,
}

NonPersistedResourcesClaimable is a list of resources that are not persisted to etcd, and therefore should not be labeled with permission claims. The value means whether they are claimable or not.

Functions

func InstallIndexers

func InstallIndexers(apiExportInformer apisv1alpha1informers.APIExportClusterInformer)

InstallIndexers adds the additional indexers that this controller requires to the informers.

Types

type Labeler

type Labeler struct {
	// contains filtered or unexported fields
}

Labeler calculates labels to apply to all instances of a cluster-group-resource based on permission claims.

func NewLabeler

func NewLabeler(
	apiBindingInformer apisv1alpha1informers.APIBindingClusterInformer,
	apiExportInformer, globalAPIExportInformer apisv1alpha1informers.APIExportClusterInformer,
) *Labeler

NewLabeler returns a new Labeler.

func (*Labeler) LabelsFor

func (l *Labeler) LabelsFor(ctx context.Context, cluster logicalcluster.Name, groupResource schema.GroupResource, resourceName string) (map[string]string, error)

LabelsFor returns all the applicable labels for the cluster-group-resource relating to permission claims. This is the intersection of (1) all APIBindings in the cluster that have accepted claims for the group-resource with (2) associated APIExports that are claiming group-resource.