auth

Documentation

Index

• Constants
• type AllowAll
  • func (AllowAll) Check(context.Context, string, string, string) error
• type Checker
• type RBAC
  • func NewRBAC(client kubernetes.Interface) *RBAC
  • func (r *RBAC) Check(ctx context.Context, namespace, resource, verb string) error

Constants

const (
	ResourceResults = "results"
	ResourceRecords = "records"

	PermissionCreate = "create"
	PermissionGet    = "get"
	PermissionList   = "list"
	PermissionDelete = "delete"
	PermissionUpdate = "update"
)

Types

type AllowAll

type AllowAll struct{}

AllowAll is an auth check that allows every request, regardless of the params. Useful for testing or cases where you want to disable auth checks.

func (AllowAll) Check

func (AllowAll) Check(context.Context, string, string, string) error

type Checker

type Checker interface {
	Check(ctx context.Context, parent, resource, verb string) error
}

Checker handles authentication and authorization checks for an action on a resource.

type RBAC

type RBAC struct {
	// contains filtered or unexported fields
}

RBAC is a Kubernetes RBAC based auth checker. This uses the Kubernetes TokenReview and SubjectAccessReview APIs to defer auth decisions to the cluster. Users should pass in `token` metadata through the gRPC context. This checks RBAC permissions in the `results.tekton.dev` group, and assumes checks are done at the namespace

func NewRBAC

func NewRBAC(client kubernetes.Interface) *RBAC

func (*RBAC) Check

func (r *RBAC) Check(ctx context.Context, namespace, resource, verb string) error