v1beta3

package
v1.0.8 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 7, 2015 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AuthorizationAttributes added in v1.0.5

type AuthorizationAttributes struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	Namespace string `json:"namespace"`
	// Verb is one of: get, list, watch, create, update, delete
	Verb string `json:"verb"`
	// Resource is one of the existing resource types
	Resource string `json:"resource"`
	// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
	ResourceName string `json:"resourceName"`
	// Content is the actual content of the request for create and update
	Content kruntime.RawExtension `json:"content,omitempty"`
}

type ClusterPolicy

type ClusterPolicy struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted
	LastModified unversioned.Time `json:"lastModified"`

	// ClusterRoles holds all the ClusterRoles held by this ClusterPolicy, mapped by ClusterRole.Name
	Roles []NamedClusterRole `json:"roles"`
}

ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.

func (*ClusterPolicy) IsAnAPIObject

func (*ClusterPolicy) IsAnAPIObject()

type ClusterPolicyBinding

type ClusterPolicyBinding struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted
	LastModified unversioned.Time `json:"lastModified"`

	// PolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference `json:"policyRef"`
	// RoleBindings holds all the ClusterRoleBindings held by this ClusterPolicyBinding, mapped by ClusterRoleBinding.Name
	RoleBindings []NamedClusterRoleBinding `json:"roleBindings"`
}

ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace

func (*ClusterPolicyBinding) IsAnAPIObject

func (*ClusterPolicyBinding) IsAnAPIObject()

type ClusterPolicyBindingList

type ClusterPolicyBindingList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []ClusterPolicyBinding `json:"items"`
}

ClusterPolicyBindingList is a collection of ClusterPolicyBindings

func (*ClusterPolicyBindingList) IsAnAPIObject

func (*ClusterPolicyBindingList) IsAnAPIObject()

type ClusterPolicyList

type ClusterPolicyList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []ClusterPolicy `json:"items"`
}

ClusterPolicyList is a collection of ClusterPolicies

func (*ClusterPolicyList) IsAnAPIObject

func (*ClusterPolicyList) IsAnAPIObject()

type ClusterRole

type ClusterRole struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// Rules holds all the PolicyRules for this ClusterRole
	Rules []PolicyRule `json:"rules"`
}

ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.

func (*ClusterRole) IsAnAPIObject

func (*ClusterRole) IsAnAPIObject()

type ClusterRoleBinding

type ClusterRoleBinding struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// UserNames holds all the usernames directly bound to the role
	UserNames []string `json:"userNames"`
	// GroupNames holds all the groups directly bound to the role
	GroupNames []string `json:"groupNames"`
	// Subjects hold object references to authorize with this rule
	Subjects []kapi.ObjectReference `json:"subjects"`

	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	// ClusterRoleRefs can only reference the current namespace and the global namespace
	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
	RoleRef kapi.ObjectReference `json:"roleRef"`
}

ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func (*ClusterRoleBinding) IsAnAPIObject

func (*ClusterRoleBinding) IsAnAPIObject()

type ClusterRoleBindingList

type ClusterRoleBindingList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []ClusterRoleBinding `json:"items"`
}

ClusterRoleBindingList is a collection of ClusterRoleBindings

func (*ClusterRoleBindingList) IsAnAPIObject

func (*ClusterRoleBindingList) IsAnAPIObject()

type ClusterRoleList

type ClusterRoleList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []ClusterRole `json:"items"`
}

ClusterRoleList is a collection of ClusterRoles

func (*ClusterRoleList) IsAnAPIObject

func (*ClusterRoleList) IsAnAPIObject()

type IsPersonalSubjectAccessReview

type IsPersonalSubjectAccessReview struct {
	unversioned.TypeMeta `json:",inline"`
}

IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed

func (*IsPersonalSubjectAccessReview) IsAnAPIObject

func (*IsPersonalSubjectAccessReview) IsAnAPIObject()

type LocalResourceAccessReview added in v1.0.5

type LocalResourceAccessReview struct {
	unversioned.TypeMeta `json:",inline"`

	// AuthorizationAttributes describes the action being tested.  The Namespace element is FORCED to the current namespace.
	AuthorizationAttributes `json:",inline"`
}

LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace

func (*LocalResourceAccessReview) IsAnAPIObject added in v1.0.5

func (*LocalResourceAccessReview) IsAnAPIObject()

type LocalSubjectAccessReview added in v1.0.5

type LocalSubjectAccessReview struct {
	unversioned.TypeMeta `json:",inline"`

	// AuthorizationAttributes describes the action being tested.  The Namespace element is FORCED to the current namespace.
	AuthorizationAttributes `json:",inline"`
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string `json:"user"`
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	GroupsSlice []string `json:"groups"`
}

LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace

func (*LocalSubjectAccessReview) IsAnAPIObject added in v1.0.5

func (*LocalSubjectAccessReview) IsAnAPIObject()

type NamedClusterRole

type NamedClusterRole struct {
	Name string      `json:"name"`
	Role ClusterRole `json:"role"`
}

type NamedClusterRoleBinding

type NamedClusterRoleBinding struct {
	Name        string             `json:"name"`
	RoleBinding ClusterRoleBinding `json:"roleBinding"`
}

type NamedRole

type NamedRole struct {
	Name string `json:"name"`
	Role Role   `json:"role"`
}

type NamedRoleBinding

type NamedRoleBinding struct {
	Name        string      `json:"name"`
	RoleBinding RoleBinding `json:"roleBinding"`
}

type Policy

type Policy struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// LastModified is the last time that any part of the Policy was created, updated, or deleted
	LastModified unversioned.Time `json:"lastModified"`

	// Roles holds all the Roles held by this Policy, mapped by Role.Name
	Roles []NamedRole `json:"roles"`
}

Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.

func (*Policy) IsAnAPIObject

func (*Policy) IsAnAPIObject()

type PolicyBinding

type PolicyBinding struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted
	LastModified unversioned.Time `json:"lastModified"`

	// PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference `json:"policyRef"`
	// RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name
	RoleBindings []NamedRoleBinding `json:"roleBindings"`
}

PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace

func (*PolicyBinding) IsAnAPIObject

func (*PolicyBinding) IsAnAPIObject()

type PolicyBindingList

type PolicyBindingList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []PolicyBinding `json:"items"`
}

PolicyBindingList is a collection of PolicyBindings

func (*PolicyBindingList) IsAnAPIObject

func (*PolicyBindingList) IsAnAPIObject()

type PolicyList

type PolicyList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []Policy `json:"items"`
}

PolicyList is a collection of Policies

func (*PolicyList) IsAnAPIObject

func (*PolicyList) IsAnAPIObject()

type PolicyRule

type PolicyRule struct {
	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule.  VerbAll represents all kinds.
	Verbs []string `json:"verbs"`
	// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
	// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
	AttributeRestrictions kruntime.RawExtension `json:"attributeRestrictions,omitempty"`
	// APIGroups is the name of the APIGroup that contains the resources.  If this field is empty, then both kubernetes and origin API groups are assumed.
	// That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request
	// will be allowed
	APIGroups []string `json:"apiGroups" description:"list of API groups this rule applies to.  * represents all API groups."`
	// ResourceKinds is a list of resources this rule applies to.  ResourceAll represents all resources.
	// DEPRECATED
	ResourceKinds []string `json:"resourceKinds,omitempty"`
	// Resources is a list of resources this rule applies to.  ResourceAll represents all resources.
	Resources []string `json:"resources"`
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames []string `json:"resourceNames,omitempty"`
	// NonResourceURLsSlice is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
	// This name is intentionally different than the internal type so that the DefaultConvert works nicely and because the ordering may be different.
	NonResourceURLsSlice []string `json:"nonResourceURLs,omitempty"`
}

PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

type ResourceAccessReview

type ResourceAccessReview struct {
	unversioned.TypeMeta `json:",inline"`

	// AuthorizationAttributes describes the action being tested
	AuthorizationAttributes `json:",inline"`
}

ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec

func (*ResourceAccessReview) IsAnAPIObject

func (*ResourceAccessReview) IsAnAPIObject()

type ResourceAccessReviewResponse

type ResourceAccessReviewResponse struct {
	unversioned.TypeMeta `json:",inline"`

	// Namespace is the namespace used for the access review
	Namespace string `json:"namespace,omitempty"`
	// Users is the list of users who can perform the action
	UsersSlice []string `json:"users"`
	// Groups is the list of groups who can perform the action
	GroupsSlice []string `json:"groups"`
}

ResourceAccessReviewResponse describes who can perform the action

func (*ResourceAccessReviewResponse) IsAnAPIObject

func (*ResourceAccessReviewResponse) IsAnAPIObject()

type Role

type Role struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// Rules holds all the PolicyRules for this Role
	Rules []PolicyRule `json:"rules"`
}

Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.

func (*Role) IsAnAPIObject

func (*Role) IsAnAPIObject()

type RoleBinding

type RoleBinding struct {
	unversioned.TypeMeta `json:",inline"`
	kapi.ObjectMeta      `json:"metadata,omitempty"`

	// UserNames holds all the usernames directly bound to the role
	UserNames []string `json:"userNames"`
	// GroupNames holds all the groups directly bound to the role
	GroupNames []string `json:"groupNames"`
	// Subjects hold object references to authorize with this rule
	Subjects []kapi.ObjectReference `json:"subjects"`

	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	// RoleRefs can only reference the current namespace and the global namespace
	// If the RoleRef cannot be resolved, the Authorizer must return an error.
	RoleRef kapi.ObjectReference `json:"roleRef"`
}

RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func (*RoleBinding) IsAnAPIObject

func (*RoleBinding) IsAnAPIObject()

type RoleBindingList

type RoleBindingList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []RoleBinding `json:"items"`
}

RoleBindingList is a collection of RoleBindings

func (*RoleBindingList) IsAnAPIObject

func (*RoleBindingList) IsAnAPIObject()

type RoleList

type RoleList struct {
	unversioned.TypeMeta `json:",inline"`
	unversioned.ListMeta `json:"metadata,omitempty"`
	Items                []Role `json:"items"`
}

RoleList is a collection of Roles

func (*RoleList) IsAnAPIObject

func (*RoleList) IsAnAPIObject()

type SubjectAccessReview

type SubjectAccessReview struct {
	unversioned.TypeMeta `json:",inline"`

	// AuthorizationAttributes describes the action being tested
	AuthorizationAttributes `json:",inline"`
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string `json:"user"`
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	GroupsSlice []string `json:"groups"`
}

SubjectAccessReview is an object for requesting information about whether a user or group can perform an action

func (*SubjectAccessReview) IsAnAPIObject

func (*SubjectAccessReview) IsAnAPIObject()

type SubjectAccessReviewResponse

type SubjectAccessReviewResponse struct {
	unversioned.TypeMeta `json:",inline"`

	// Namespace is the namespace used for the access review
	Namespace string `json:"namespace,omitempty"`
	// Allowed is required.  True if the action would be allowed, false otherwise.
	Allowed bool `json:"allowed"`
	// Reason is optional.  It indicates why a request was allowed or denied.
	Reason string `json:"reason,omitempty"`
}

SubjectAccessReviewResponse describes whether or not a user or group can perform an action

func (*SubjectAccessReviewResponse) IsAnAPIObject

func (*SubjectAccessReviewResponse) IsAnAPIObject()

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL