Documentation
¶
Index ¶
- Variables
- type AuthorizationAttributes
- type ClusterPolicy
- type ClusterPolicyBinding
- type ClusterPolicyBindingList
- type ClusterPolicyList
- type ClusterRole
- type ClusterRoleBinding
- type ClusterRoleBindingList
- type ClusterRoleList
- type IsPersonalSubjectAccessReview
- type LocalResourceAccessReview
- type LocalSubjectAccessReview
- type NamedClusterRole
- type NamedClusterRoleBinding
- type NamedRole
- type NamedRoleBinding
- type Policy
- type PolicyBinding
- type PolicyBindingList
- type PolicyList
- type PolicyRule
- type ResourceAccessReview
- type ResourceAccessReviewResponse
- type Role
- type RoleBinding
- type RoleBindingList
- type RoleList
- type SubjectAccessReview
- type SubjectAccessReviewResponse
Constants ¶
This section is empty.
Variables ¶
var Codec = runtime.CodecFor(api.Scheme, SchemeGroupVersion.String())
Codec encodes internal objects to the v1beta3 scheme
var SchemeGroupVersion = unversioned.GroupVersion{Group: "", Version: "v1beta3"}
SchemeGroupVersion is group version used to register these objects
Functions ¶
This section is empty.
Types ¶
type AuthorizationAttributes ¶ added in v1.0.5
type AuthorizationAttributes struct { // Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces Namespace string `json:"namespace"` // Verb is one of: get, list, watch, create, update, delete Verb string `json:"verb"` // Resource is one of the existing resource types Resource string `json:"resource"` // ResourceName is the name of the resource being requested for a "get" or deleted for a "delete" ResourceName string `json:"resourceName"` // Content is the actual content of the request for create and update Content kruntime.RawExtension `json:"content,omitempty"` }
type ClusterPolicy ¶ added in v0.5.1
type ClusterPolicy struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted LastModified unversioned.Time `json:"lastModified"` // ClusterRoles holds all the ClusterRoles held by this ClusterPolicy, mapped by ClusterRole.Name Roles []NamedClusterRole `json:"roles"` }
ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.
func (*ClusterPolicy) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterPolicy) IsAnAPIObject()
type ClusterPolicyBinding ¶ added in v0.5.1
type ClusterPolicyBinding struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted LastModified unversioned.Time `json:"lastModified"` // PolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference PolicyRef kapi.ObjectReference `json:"policyRef"` // RoleBindings holds all the ClusterRoleBindings held by this ClusterPolicyBinding, mapped by ClusterRoleBinding.Name RoleBindings []NamedClusterRoleBinding `json:"roleBindings"` }
ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace
func (*ClusterPolicyBinding) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterPolicyBinding) IsAnAPIObject()
type ClusterPolicyBindingList ¶ added in v0.5.1
type ClusterPolicyBindingList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []ClusterPolicyBinding `json:"items"` }
ClusterPolicyBindingList is a collection of ClusterPolicyBindings
func (*ClusterPolicyBindingList) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterPolicyBindingList) IsAnAPIObject()
type ClusterPolicyList ¶ added in v0.5.1
type ClusterPolicyList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []ClusterPolicy `json:"items"` }
ClusterPolicyList is a collection of ClusterPolicies
func (*ClusterPolicyList) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterPolicyList) IsAnAPIObject()
type ClusterRole ¶ added in v0.5.1
type ClusterRole struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // Rules holds all the PolicyRules for this ClusterRole Rules []PolicyRule `json:"rules"` }
ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.
func (*ClusterRole) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterRole) IsAnAPIObject()
type ClusterRoleBinding ¶ added in v0.5.1
type ClusterRoleBinding struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // UserNames holds all the usernames directly bound to the role UserNames []string `json:"userNames"` // GroupNames holds all the groups directly bound to the role GroupNames []string `json:"groupNames"` // Subjects hold object references to authorize with this rule Subjects []kapi.ObjectReference `json:"subjects"` // Since Policy is a singleton, this is sufficient knowledge to locate a role // ClusterRoleRefs can only reference the current namespace and the global namespace // If the ClusterRoleRef cannot be resolved, the Authorizer must return an error. RoleRef kapi.ObjectReference `json:"roleRef"` }
ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
func (*ClusterRoleBinding) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterRoleBinding) IsAnAPIObject()
type ClusterRoleBindingList ¶ added in v0.5.1
type ClusterRoleBindingList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []ClusterRoleBinding `json:"items"` }
ClusterRoleBindingList is a collection of ClusterRoleBindings
func (*ClusterRoleBindingList) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterRoleBindingList) IsAnAPIObject()
type ClusterRoleList ¶ added in v0.5.1
type ClusterRoleList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []ClusterRole `json:"items"` }
ClusterRoleList is a collection of ClusterRoles
func (*ClusterRoleList) IsAnAPIObject ¶ added in v0.5.1
func (*ClusterRoleList) IsAnAPIObject()
type IsPersonalSubjectAccessReview ¶
type IsPersonalSubjectAccessReview struct {
unversioned.TypeMeta `json:",inline"`
}
IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed
func (*IsPersonalSubjectAccessReview) IsAnAPIObject ¶
func (*IsPersonalSubjectAccessReview) IsAnAPIObject()
type LocalResourceAccessReview ¶ added in v1.0.5
type LocalResourceAccessReview struct { unversioned.TypeMeta `json:",inline"` // AuthorizationAttributes describes the action being tested. The Namespace element is FORCED to the current namespace. AuthorizationAttributes `json:",inline"` }
LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace
func (*LocalResourceAccessReview) IsAnAPIObject ¶ added in v1.0.5
func (*LocalResourceAccessReview) IsAnAPIObject()
type LocalSubjectAccessReview ¶ added in v1.0.5
type LocalSubjectAccessReview struct { unversioned.TypeMeta `json:",inline"` // AuthorizationAttributes describes the action being tested. The Namespace element is FORCED to the current namespace. AuthorizationAttributes `json:",inline"` // User is optional. If both User and Groups are empty, the current authenticated user is used. User string `json:"user"` // Groups is optional. Groups is the list of groups to which the User belongs. GroupsSlice []string `json:"groups"` }
LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
func (*LocalSubjectAccessReview) IsAnAPIObject ¶ added in v1.0.5
func (*LocalSubjectAccessReview) IsAnAPIObject()
type NamedClusterRole ¶ added in v0.5.1
type NamedClusterRole struct { Name string `json:"name"` Role ClusterRole `json:"role"` }
type NamedClusterRoleBinding ¶ added in v0.5.1
type NamedClusterRoleBinding struct { Name string `json:"name"` RoleBinding ClusterRoleBinding `json:"roleBinding"` }
type NamedRoleBinding ¶
type NamedRoleBinding struct { Name string `json:"name"` RoleBinding RoleBinding `json:"roleBinding"` }
type Policy ¶
type Policy struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // LastModified is the last time that any part of the Policy was created, updated, or deleted LastModified unversioned.Time `json:"lastModified"` // Roles holds all the Roles held by this Policy, mapped by Role.Name Roles []NamedRole `json:"roles"` }
Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.
func (*Policy) IsAnAPIObject ¶
func (*Policy) IsAnAPIObject()
type PolicyBinding ¶
type PolicyBinding struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted LastModified unversioned.Time `json:"lastModified"` // PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference PolicyRef kapi.ObjectReference `json:"policyRef"` // RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name RoleBindings []NamedRoleBinding `json:"roleBindings"` }
PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace
func (*PolicyBinding) IsAnAPIObject ¶
func (*PolicyBinding) IsAnAPIObject()
type PolicyBindingList ¶
type PolicyBindingList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []PolicyBinding `json:"items"` }
PolicyBindingList is a collection of PolicyBindings
func (*PolicyBindingList) IsAnAPIObject ¶
func (*PolicyBindingList) IsAnAPIObject()
type PolicyList ¶
type PolicyList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []Policy `json:"items"` }
PolicyList is a collection of Policies
func (*PolicyList) IsAnAPIObject ¶
func (*PolicyList) IsAnAPIObject()
type PolicyRule ¶
type PolicyRule struct { // Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds. Verbs []string `json:"verbs"` // AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports. // If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error. AttributeRestrictions kruntime.RawExtension `json:"attributeRestrictions,omitempty"` // APIGroups is the name of the APIGroup that contains the resources. If this field is empty, then both kubernetes and origin API groups are assumed. // That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request // will be allowed APIGroups []string `json:"apiGroups" description:"list of API groups this rule applies to. * represents all API groups."` // ResourceKinds is a list of resources this rule applies to. ResourceAll represents all resources. // DEPRECATED ResourceKinds []string `json:"resourceKinds,omitempty"` // Resources is a list of resources this rule applies to. ResourceAll represents all resources. Resources []string `json:"resources"` // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. ResourceNames []string `json:"resourceNames,omitempty"` // NonResourceURLsSlice is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path // This name is intentionally different than the internal type so that the DefaultConvert works nicely and because the ordering may be different. NonResourceURLsSlice []string `json:"nonResourceURLs,omitempty"` }
PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.
type ResourceAccessReview ¶
type ResourceAccessReview struct { unversioned.TypeMeta `json:",inline"` // AuthorizationAttributes describes the action being tested AuthorizationAttributes `json:",inline"` }
ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec
func (*ResourceAccessReview) IsAnAPIObject ¶
func (*ResourceAccessReview) IsAnAPIObject()
type ResourceAccessReviewResponse ¶
type ResourceAccessReviewResponse struct { unversioned.TypeMeta `json:",inline"` // Namespace is the namespace used for the access review Namespace string `json:"namespace,omitempty"` // Users is the list of users who can perform the action UsersSlice []string `json:"users"` // Groups is the list of groups who can perform the action GroupsSlice []string `json:"groups"` }
ResourceAccessReviewResponse describes who can perform the action
func (*ResourceAccessReviewResponse) IsAnAPIObject ¶
func (*ResourceAccessReviewResponse) IsAnAPIObject()
type Role ¶
type Role struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // Rules holds all the PolicyRules for this Role Rules []PolicyRule `json:"rules"` }
Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.
func (*Role) IsAnAPIObject ¶
func (*Role) IsAnAPIObject()
type RoleBinding ¶
type RoleBinding struct { unversioned.TypeMeta `json:",inline"` kapi.ObjectMeta `json:"metadata,omitempty"` // UserNames holds all the usernames directly bound to the role UserNames []string `json:"userNames"` // GroupNames holds all the groups directly bound to the role GroupNames []string `json:"groupNames"` // Subjects hold object references to authorize with this rule Subjects []kapi.ObjectReference `json:"subjects"` // Since Policy is a singleton, this is sufficient knowledge to locate a role // RoleRefs can only reference the current namespace and the global namespace // If the RoleRef cannot be resolved, the Authorizer must return an error. RoleRef kapi.ObjectReference `json:"roleRef"` }
RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
func (*RoleBinding) IsAnAPIObject ¶
func (*RoleBinding) IsAnAPIObject()
type RoleBindingList ¶
type RoleBindingList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []RoleBinding `json:"items"` }
RoleBindingList is a collection of RoleBindings
func (*RoleBindingList) IsAnAPIObject ¶
func (*RoleBindingList) IsAnAPIObject()
type RoleList ¶
type RoleList struct { unversioned.TypeMeta `json:",inline"` unversioned.ListMeta `json:"metadata,omitempty"` Items []Role `json:"items"` }
RoleList is a collection of Roles
func (*RoleList) IsAnAPIObject ¶
func (*RoleList) IsAnAPIObject()
type SubjectAccessReview ¶
type SubjectAccessReview struct { unversioned.TypeMeta `json:",inline"` // AuthorizationAttributes describes the action being tested AuthorizationAttributes `json:",inline"` // User is optional. If both User and Groups are empty, the current authenticated user is used. User string `json:"user"` // Groups is optional. Groups is the list of groups to which the User belongs. GroupsSlice []string `json:"groups"` }
SubjectAccessReview is an object for requesting information about whether a user or group can perform an action
func (*SubjectAccessReview) IsAnAPIObject ¶
func (*SubjectAccessReview) IsAnAPIObject()
type SubjectAccessReviewResponse ¶
type SubjectAccessReviewResponse struct { unversioned.TypeMeta `json:",inline"` // Namespace is the namespace used for the access review Namespace string `json:"namespace,omitempty"` // Allowed is required. True if the action would be allowed, false otherwise. Allowed bool `json:"allowed"` // Reason is optional. It indicates why a request was allowed or denied. Reason string `json:"reason,omitempty"` }
SubjectAccessReviewResponse describes whether or not a user or group can perform an action
func (*SubjectAccessReviewResponse) IsAnAPIObject ¶
func (*SubjectAccessReviewResponse) IsAnAPIObject()