authorizer

Documentation

Index

• func IsPersonalAccessReview(a AuthorizationAttributes) (bool, error)
• type AuthorizationAttributeBuilder
  • func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, ...) AuthorizationAttributeBuilder
• type AuthorizationAttributes
• type Authorizer
  • func NewAuthorizer(masterAuthorizationNamespace string, ...) Authorizer
• type DefaultAuthorizationAttributes
  • func (a DefaultAuthorizationAttributes) GetAPIVersion() string
  • func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}
  • func (a DefaultAuthorizationAttributes) GetResource() string
  • func (a DefaultAuthorizationAttributes) GetResourceName() string
  • func (a DefaultAuthorizationAttributes) GetURL() string
  • func (a DefaultAuthorizationAttributes) GetVerb() string
  • func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool
  • func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)

Functions

func IsPersonalAccessReview

func IsPersonalAccessReview(a AuthorizationAttributes) (bool, error)

Types

type AuthorizationAttributeBuilder

type AuthorizationAttributeBuilder interface {
	GetAttributes(request *http.Request) (AuthorizationAttributes, error)
}

func NewAuthorizationAttributeBuilder

func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver *kapiserver.APIRequestInfoResolver) AuthorizationAttributeBuilder

type AuthorizationAttributes

type AuthorizationAttributes interface {
	GetVerb() string
	GetAPIVersion() string
	// GetResource returns the resource type.  If IsNonResourceURL() is true, then GetResource() is "".
	GetResource() string
	GetResourceName() string
	// GetRequestAttributes is of type interface{} because different verbs and different Authorizer/AuthorizationAttributeBuilder pairs may have different contract requirements.
	GetRequestAttributes() interface{}
	// IsNonResourceURL returns true if this is not an action performed against the resource API
	IsNonResourceURL() bool
	// GetURL returns the URL path being requested, including the leading '/'
	GetURL() string
}

type Authorizer

type Authorizer interface {
	Authorize(ctx kapi.Context, a AuthorizationAttributes) (allowed bool, reason string, err error)
	GetAllowedSubjects(ctx kapi.Context, attributes AuthorizationAttributes) (util.StringSet, util.StringSet, error)
}

func NewAuthorizer

func NewAuthorizer(masterAuthorizationNamespace string, ruleResolver rulevalidation.AuthorizationRuleResolver) Authorizer

type DefaultAuthorizationAttributes

type DefaultAuthorizationAttributes struct {
	Verb              string
	APIVersion        string
	Resource          string
	ResourceName      string
	RequestAttributes interface{}
	NonResourceURL    bool
	URL               string
}

func (DefaultAuthorizationAttributes) GetAPIVersion

func (a DefaultAuthorizationAttributes) GetAPIVersion() string

func (DefaultAuthorizationAttributes) GetRequestAttributes

func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}

func (DefaultAuthorizationAttributes) GetResource

func (a DefaultAuthorizationAttributes) GetResource() string

func (DefaultAuthorizationAttributes) GetResourceName

func (a DefaultAuthorizationAttributes) GetResourceName() string

func (DefaultAuthorizationAttributes) GetURL

func (a DefaultAuthorizationAttributes) GetURL() string

func (DefaultAuthorizationAttributes) GetVerb

func (a DefaultAuthorizationAttributes) GetVerb() string

func (DefaultAuthorizationAttributes) IsNonResourceURL

func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool

func (DefaultAuthorizationAttributes) RuleMatches

func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)