Documentation
¶
Index ¶
- func ConfirmNoEscalation(ctx genericapirequest.Context, ruleResolver AuthorizationRuleResolver, ...) error
- func Covers(ownerRules, servantRules []rbac.PolicyRule) (bool, []rbac.PolicyRule)
- func NewTestRuleResolver(roles []*rbac.Role, roleBindings []*rbac.RoleBinding, ...) (AuthorizationRuleResolver, *StaticRoles)
- type AuthorizationRuleResolver
- type ClusterRoleBindingLister
- type ClusterRoleGetter
- type DefaultRuleResolver
- func (r *DefaultRuleResolver) GetRoleReferenceRules(roleRef rbac.RoleRef, bindingNamespace string) ([]rbac.PolicyRule, error)
- func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac.PolicyRule, error)
- func (r *DefaultRuleResolver) VisitRulesFor(user user.Info, namespace string, ...)
- type RoleBindingLister
- type RoleGetter
- type StaticRoles
- func (r *StaticRoles) GetClusterRole(name string) (*rbac.ClusterRole, error)
- func (r *StaticRoles) GetRole(namespace, name string) (*rbac.Role, error)
- func (r *StaticRoles) ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error)
- func (r *StaticRoles) ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConfirmNoEscalation ¶
func ConfirmNoEscalation(ctx genericapirequest.Context, ruleResolver AuthorizationRuleResolver, rules []rbac.PolicyRule) error
ConfirmNoEscalation determines if the roles for a given user in a given namespace encompass the provided role.
func Covers ¶
func Covers(ownerRules, servantRules []rbac.PolicyRule) (bool, []rbac.PolicyRule)
Covers determines whether or not the ownerRules cover the servantRules in terms of allowed actions. It returns whether or not the ownerRules cover and a list of the rules that the ownerRules do not cover.
func NewTestRuleResolver ¶
func NewTestRuleResolver(roles []*rbac.Role, roleBindings []*rbac.RoleBinding, clusterRoles []*rbac.ClusterRole, clusterRoleBindings []*rbac.ClusterRoleBinding) (AuthorizationRuleResolver, *StaticRoles)
NewTestRuleResolver returns a rule resolver from lists of role objects.
Types ¶
type AuthorizationRuleResolver ¶
type AuthorizationRuleResolver interface { // GetRoleReferenceRules attempts to resolve the role reference of a RoleBinding or ClusterRoleBinding. The passed namespace should be the namepsace // of the role binding, the empty string if a cluster role binding. GetRoleReferenceRules(roleRef rbac.RoleRef, namespace string) ([]rbac.PolicyRule, error) // RulesFor returns the list of rules that apply to a given user in a given namespace and error. If an error is returned, the slice of // PolicyRules may not be complete, but it contains all retrievable rules. This is done because policy rules are purely additive and policy determinations // can be made on the basis of those rules that are found. RulesFor(user user.Info, namespace string) ([]rbac.PolicyRule, error) // VisitRulesFor invokes visitor() with each rule that applies to a given user in a given namespace, and each error encountered resolving those rules. // If visitor() returns false, visiting is short-circuited. VisitRulesFor(user user.Info, namespace string, visitor func(rule *rbac.PolicyRule, err error) bool) }
type ClusterRoleBindingLister ¶
type ClusterRoleBindingLister interface {
ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error)
}
type ClusterRoleGetter ¶
type ClusterRoleGetter interface {
GetClusterRole(name string) (*rbac.ClusterRole, error)
}
type DefaultRuleResolver ¶
type DefaultRuleResolver struct {
// contains filtered or unexported fields
}
func NewDefaultRuleResolver ¶
func NewDefaultRuleResolver(roleGetter RoleGetter, roleBindingLister RoleBindingLister, clusterRoleGetter ClusterRoleGetter, clusterRoleBindingLister ClusterRoleBindingLister) *DefaultRuleResolver
func (*DefaultRuleResolver) GetRoleReferenceRules ¶
func (r *DefaultRuleResolver) GetRoleReferenceRules(roleRef rbac.RoleRef, bindingNamespace string) ([]rbac.PolicyRule, error)
GetRoleReferenceRules attempts to resolve the RoleBinding or ClusterRoleBinding.
func (*DefaultRuleResolver) RulesFor ¶
func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbac.PolicyRule, error)
func (*DefaultRuleResolver) VisitRulesFor ¶ added in v1.7.1
func (r *DefaultRuleResolver) VisitRulesFor(user user.Info, namespace string, visitor func(rule *rbac.PolicyRule, err error) bool)
type RoleBindingLister ¶
type RoleBindingLister interface {
ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error)
}
type StaticRoles ¶
type StaticRoles struct {
// contains filtered or unexported fields
}
StaticRoles is a rule resolver that resolves from lists of role objects.
func (*StaticRoles) GetClusterRole ¶
func (r *StaticRoles) GetClusterRole(name string) (*rbac.ClusterRole, error)
func (*StaticRoles) GetRole ¶
func (r *StaticRoles) GetRole(namespace, name string) (*rbac.Role, error)
func (*StaticRoles) ListClusterRoleBindings ¶
func (r *StaticRoles) ListClusterRoleBindings() ([]*rbac.ClusterRoleBinding, error)
func (*StaticRoles) ListRoleBindings ¶
func (r *StaticRoles) ListRoleBindings(namespace string) ([]*rbac.RoleBinding, error)
Click to show internal directories.
Click to hide internal directories.