authorization

Documentation

Index

• Constants
• func IsDeepSubjectAccessReviewFrom(ctx context.Context, attr authorizer.Attributes) bool
• func NewAPIBindingAccessAuthorizer(kubeInformers kubernetesinformers.SharedInformerFactory, ...) (authorizer.Authorizer, error)
• func NewBootstrapPolicyAuthorizer(informers kubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)
• func NewLocalAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)
• func NewSystemCRDAuthorizer(delegate authorizer.Authorizer) authorizer.Authorizer
• func NewTopLevelOrganizationAccessAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory, ...) authorizer.Authorizer
• func NewWorkspaceContentAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory, ...) authorizer.Authorizer
• func WithDeepSARConfig(config *rest.Config) *rest.Config
• func WithDeepSubjectAccessReview(handler http.Handler) http.Handler
• type BootstrapPolicyAuthorizer
  • func (a *BootstrapPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
  • func (a *BootstrapPolicyAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)
• type LocalAuthorizer
  • func (a *LocalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
  • func (a *LocalAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)
• type SystemCRDAuthorizer
  • func (a *SystemCRDAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

Constants

const (
	APIBindingContentAuditPrefix   = "apibinding.authorization.kcp.dev/"
	APIBindingContentAuditDecision = APIBindingContentAuditPrefix + "decision"
	APIBindingContentAuditReason   = APIBindingContentAuditPrefix + "reason"
)

const (
	BootstrapPolicyAuditPrefix   = "bootstrap.authorization.kcp.dev/"
	BootstrapPolicyAuditDecision = BootstrapPolicyAuditPrefix + "decision"
	BootstrapPolicyAuditReason   = BootstrapPolicyAuditPrefix + "reason"
)

const (
	DecisionNoOpinion = "NoOpinion"
	DecisionAllowed   = "Allowed"
	DecisionDenied    = "Denied"
)

const (
	LocalAuditPrefix   = "local.authorization.kcp.dev/"
	LocalAuditDecision = LocalAuditPrefix + "decision"
	LocalAuditReason   = LocalAuditPrefix + "reason"
)

const (
	SystemCRDAuditPrefix   = "systemcrd.authorization.kcp.dev/"
	SystemCRDAuditDecision = SystemCRDAuditPrefix + "decision"
	SystemCRDAuditReason   = SystemCRDAuditPrefix + "reason"
)

const (
	TopLevelContentAuditPrefix   = "toplevel.authorization.kcp.dev/"
	TopLevelContentAuditDecision = TopLevelContentAuditPrefix + "decision"
	TopLevelContentAuditReason   = TopLevelContentAuditPrefix + "reason"
)

const (
	WorkspaceAcccessNotPermittedReason = "workspace access not permitted"

	WorkspaceContentAuditPrefix   = "content.authorization.kcp.dev/"
	WorkspaceContentAuditDecision = WorkspaceContentAuditPrefix + "decision"
	WorkspaceContentAuditReason   = WorkspaceContentAuditPrefix + "reason"
)

Functions

func IsDeepSubjectAccessReviewFrom

func IsDeepSubjectAccessReviewFrom(ctx context.Context, attr authorizer.Attributes) bool

IsDeepSubjectAccessReviewFrom returns whether this is a deep SAR request. If true, top-level workspace and workspace content authorization checks have to be skipped.

func NewAPIBindingAccessAuthorizer

func NewAPIBindingAccessAuthorizer(kubeInformers kubernetesinformers.SharedInformerFactory, kcpInformers kcpinformers.SharedInformerFactory, delegate authorizer.Authorizer) (authorizer.Authorizer, error)

NewAPIBindingAccessAuthorizer returns an authorizer that checks if the the request is for a bound resource or not. If the resource is bound we will check the user has RBAC access in the exported resources workspace. If it is not allowed we will return NoDecision, if allowed we will call the delegate authorizer.

func NewBootstrapPolicyAuthorizer

func NewBootstrapPolicyAuthorizer(informers kubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)

func NewLocalAuthorizer

func NewLocalAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory) (authorizer.Authorizer, authorizer.RuleResolver)

func NewSystemCRDAuthorizer

func NewSystemCRDAuthorizer(delegate authorizer.Authorizer) authorizer.Authorizer

func NewTopLevelOrganizationAccessAuthorizer

func NewTopLevelOrganizationAccessAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory, clusterWorkspaceLister tenancylisters.ClusterWorkspaceLister, delegate authorizer.Authorizer) authorizer.Authorizer

NewTopLevelOrganizationAccessAuthorizer returns an authorizer that checks for access+member verb in clusterworkspaces/content of the top-level workspace the request workspace is nested in. If one of these verbs are admitted, the delegate authorizer is called. Otherwise, NoOpionion is returned if the top-level workspace exists, and Deny otherwise.

func NewWorkspaceContentAuthorizer

func NewWorkspaceContentAuthorizer(versionedInformers kubernetesinformers.SharedInformerFactory, clusterWorkspaceLister tenancylisters.ClusterWorkspaceLister, delegate authorizer.Authorizer) authorizer.Authorizer

func WithDeepSARConfig

func WithDeepSARConfig(config *rest.Config) *rest.Config

WithDeepSARConfig modifies and returns the input rest.Config with an additional header making SARs to be deep.

func WithDeepSubjectAccessReview

func WithDeepSubjectAccessReview(handler http.Handler) http.Handler

WithDeepSubjectAccessReview attaches to the context that this request has set the DeepSubjectAccessReview header. The header is ignored for non-system:master users and for non-SAR request.

A deep SAR request skips top-level workspace and workspace content authorization checks.

Types

type BootstrapPolicyAuthorizer

type BootstrapPolicyAuthorizer struct {
	// contains filtered or unexported fields
}

func (*BootstrapPolicyAuthorizer) Authorize

func (a *BootstrapPolicyAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

func (*BootstrapPolicyAuthorizer) RulesFor

func (a *BootstrapPolicyAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

type LocalAuthorizer

type LocalAuthorizer struct {
	// contains filtered or unexported fields
}

func (*LocalAuthorizer) Authorize

func (a *LocalAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

func (*LocalAuthorizer) RulesFor

func (a *LocalAuthorizer) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

type SystemCRDAuthorizer

type SystemCRDAuthorizer struct {
	// contains filtered or unexported fields
}

SystemCRDAuthorizer protects the system CRDs from users who are admins in their workspaces.

func (*SystemCRDAuthorizer) Authorize

func (a *SystemCRDAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)