api

package
v1.3.0-alpha.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 21, 2016 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ResourceGroupPrefix is the prefix for indicating that a resource entry is actually a group of resources.  The groups are defined in code and indicate resources that are commonly permissioned together
	ResourceGroupPrefix = "resourcegroup:"
	BuildGroupName      = ResourceGroupPrefix + "builds"
	DeploymentGroupName = ResourceGroupPrefix + "deployments"
	ImageGroupName      = ResourceGroupPrefix + "images"
	OAuthGroupName      = ResourceGroupPrefix + "oauth"
	UserGroupName       = ResourceGroupPrefix + "users"
	TemplateGroupName   = ResourceGroupPrefix + "templates"
	SDNGroupName        = ResourceGroupPrefix + "sdn"
	// PolicyOwnerGroupName includes the physical resources behind the PermissionGrantingGroupName.  Unless these physical objects are created first, users with privileges to PermissionGrantingGroupName will
	// only be able to bind to global roles
	PolicyOwnerGroupName = ResourceGroupPrefix + "policy"
	// PermissionGrantingGroupName includes resources that are necessary to maintain authorization roles and bindings.  By itself, this group is insufficient to create anything except for bindings
	// to master roles.  If a local Policy already exists, then privileges to this group will allow for modification of local roles.
	PermissionGrantingGroupName = ResourceGroupPrefix + "granter"
	// OpenshiftExposedGroupName includes resources that are commonly viewed and modified by end users of the system.  It does not include any sensitive resources that control authentication or authorization
	OpenshiftExposedGroupName = ResourceGroupPrefix + "exposedopenshift"
	OpenshiftAllGroupName     = ResourceGroupPrefix + "allopenshift"
	OpenshiftStatusGroupName  = ResourceGroupPrefix + "allopenshift-status"

	QuotaGroupName = ResourceGroupPrefix + "quota"
	// KubeInternalsGroupName includes those resources that should reasonably be viewable to end users, but that most users should probably not modify.  Kubernetes herself will maintain these resources
	KubeInternalsGroupName = ResourceGroupPrefix + "privatekube"
	// KubeExposedGroupName includes resources that are commonly viewed and modified by end users of the system.
	KubeExposedGroupName = ResourceGroupPrefix + "exposedkube"
	KubeAllGroupName     = ResourceGroupPrefix + "allkube"
	KubeStatusGroupName  = ResourceGroupPrefix + "allkube-status"

	// NonEscalatingResourcesGroupName contains all resources that can be viewed without exposing the risk of using view rights to locate a secret to escalate privileges.  For example, view
	// rights on secrets could be used locate a secret that happened to be  serviceaccount token that has more privileges
	NonEscalatingResourcesGroupName         = ResourceGroupPrefix + "non-escalating"
	KubeNonEscalatingViewableGroupName      = ResourceGroupPrefix + "kube-non-escalating"
	OpenshiftNonEscalatingViewableGroupName = ResourceGroupPrefix + "openshift-non-escalating"

	// EscalatingResourcesGroupName contains all resources that can be used to escalate privileges when simply viewed
	EscalatingResourcesGroupName         = ResourceGroupPrefix + "escalating"
	KubeEscalatingViewableGroupName      = ResourceGroupPrefix + "kube-escalating"
	OpenshiftEscalatingViewableGroupName = ResourceGroupPrefix + "openshift-escalating"
)
View Source 
const (
	DockerBuildResource          = "builds/docker"
	SourceBuildResource          = "builds/source"
	CustomBuildResource          = "builds/custom"
	JenkinsPipelineBuildResource = "builds/jenkinspipeline"

	NodeMetricsResource = "nodes/metrics"
	NodeStatsResource   = "nodes/stats"
	NodeLogResource     = "nodes/log"
)

Synthetic authorization endpoints

View Source 
const (
	// PolicyName is the name of Policy
	PolicyName     = "default"
	APIGroupAll    = "*"
	ResourceAll    = "*"
	VerbAll        = "*"
	NonResourceAll = "*"

	ScopesKey           = "authorization.openshift.io/scopes"
	ScopesAllNamespaces = "*"

	UserKind           = "User"
	GroupKind          = "Group"
	ServiceAccountKind = "ServiceAccount"
	SystemUserKind     = "SystemUser"
	SystemGroupKind    = "SystemGroup"

	UserResource           = "users"
	GroupResource          = "groups"
	ServiceAccountResource = "serviceaccounts"
	SystemUserResource     = "systemusers"
	SystemGroupResource    = "systemgroups"
)
View Source 
const GroupName = ""

Variables

View Source 
var ClusterPolicyBindingName = GetPolicyBindingName("")
View Source 
var DiscoveryRule = PolicyRule{
	Verbs: sets.NewString("get"),
	NonResourceURLs: sets.NewString(

		"/version",

		"/api", "/api/*",
		"/apis", "/apis/*",
		"/oapi", "/oapi/*",
		"/osapi", "/osapi/",
	),
}

DiscoveryRule is a rule that allows a client to discover the API resources available on this server

View Source 
var (
	GroupsToResources = map[string][]string{
		BuildGroupName:       {"builds", "buildconfigs", "buildlogs", "buildconfigs/instantiate", "buildconfigs/instantiatebinary", "builds/log", "builds/clone", "buildconfigs/webhooks"},
		ImageGroupName:       {"imagestreams", "imagestreammappings", "imagestreamtags", "imagestreamimages", "imagestreamimports"},
		DeploymentGroupName:  {"deploymentconfigs", "generatedeploymentconfigs", "deploymentconfigrollbacks", "deploymentconfigs/log", "deploymentconfigs/scale"},
		SDNGroupName:         {"clusternetworks", "hostsubnets", "netnamespaces"},
		TemplateGroupName:    {"templates", "templateconfigs", "processedtemplates"},
		UserGroupName:        {"identities", "users", "useridentitymappings", "groups"},
		OAuthGroupName:       {"oauthauthorizetokens", "oauthaccesstokens", "oauthclients", "oauthclientauthorizations"},
		PolicyOwnerGroupName: {"policies", "policybindings"},

		PermissionGrantingGroupName: {"roles", "rolebindings", "resourceaccessreviews", "subjectaccessreviews", "localresourceaccessreviews", "localsubjectaccessreviews"},
		OpenshiftExposedGroupName:   {BuildGroupName, ImageGroupName, DeploymentGroupName, TemplateGroupName, "routes"},
		OpenshiftAllGroupName: {OpenshiftExposedGroupName, UserGroupName, OAuthGroupName, PolicyOwnerGroupName, SDNGroupName, PermissionGrantingGroupName, OpenshiftStatusGroupName, "projects",
			"clusterroles", "clusterrolebindings", "clusterpolicies", "clusterpolicybindings", "images", "projectrequests", "builds/details", "imagestreams/secrets",
			"selfsubjectrulesreviews"},
		OpenshiftStatusGroupName: {"imagestreams/status", "routes/status", "deploymentconfigs/status"},

		QuotaGroupName:         {"limitranges", "resourcequotas", "resourcequotausages"},
		KubeExposedGroupName:   {"pods", "replicationcontrollers", "serviceaccounts", "services", "endpoints", "persistentvolumeclaims", "pods/log", "configmaps"},
		KubeInternalsGroupName: {"minions", "nodes", "bindings", "events", "namespaces", "persistentvolumes", "securitycontextconstraints"},
		KubeAllGroupName:       {KubeInternalsGroupName, KubeExposedGroupName, QuotaGroupName},
		KubeStatusGroupName:    {"pods/status", "resourcequotas/status", "namespaces/status", "replicationcontrollers/status"},

		OpenshiftEscalatingViewableGroupName: {"oauthauthorizetokens", "oauthaccesstokens", "imagestreams/secrets"},
		KubeEscalatingViewableGroupName:      {"secrets"},
		EscalatingResourcesGroupName:         {OpenshiftEscalatingViewableGroupName, KubeEscalatingViewableGroupName},

		NonEscalatingResourcesGroupName: {OpenshiftNonEscalatingViewableGroupName, KubeNonEscalatingViewableGroupName},
	}
)
View Source 
var SchemeGroupVersion = unversioned.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}

SchemeGroupVersion is group version used to register these objects

Functions

func AddToScheme added in v1.1.3 

func AddToScheme(scheme *runtime.Scheme)

func BuildSubjects added in v1.0.5 

func BuildSubjects(users, groups []string, userNameValidator, groupNameValidator validation.ValidateNameFunc) []kapi.ObjectReference

func ClusterPolicyBindingToSelectableFields added in v1.0.8 

func ClusterPolicyBindingToSelectableFields(policyBinding *ClusterPolicyBinding) fields.Set

ClusterPolicyBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func ClusterPolicyToSelectableFields added in v1.0.8 

func ClusterPolicyToSelectableFields(policy *ClusterPolicy) fields.Set

ClusterPolicyToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func DeepCopy_api_AuthorizationAttributes 

func DeepCopy_api_AuthorizationAttributes(in AuthorizationAttributes, out *AuthorizationAttributes, c *conversion.Cloner) error

func DeepCopy_api_ClusterPolicy 

func DeepCopy_api_ClusterPolicy(in ClusterPolicy, out *ClusterPolicy, c *conversion.Cloner) error

func DeepCopy_api_ClusterPolicyBinding 

func DeepCopy_api_ClusterPolicyBinding(in ClusterPolicyBinding, out *ClusterPolicyBinding, c *conversion.Cloner) error

func DeepCopy_api_ClusterPolicyBindingList 

func DeepCopy_api_ClusterPolicyBindingList(in ClusterPolicyBindingList, out *ClusterPolicyBindingList, c *conversion.Cloner) error

func DeepCopy_api_ClusterPolicyList 

func DeepCopy_api_ClusterPolicyList(in ClusterPolicyList, out *ClusterPolicyList, c *conversion.Cloner) error

func DeepCopy_api_ClusterRole 

func DeepCopy_api_ClusterRole(in ClusterRole, out *ClusterRole, c *conversion.Cloner) error

func DeepCopy_api_ClusterRoleBinding 

func DeepCopy_api_ClusterRoleBinding(in ClusterRoleBinding, out *ClusterRoleBinding, c *conversion.Cloner) error

func DeepCopy_api_ClusterRoleBindingList 

func DeepCopy_api_ClusterRoleBindingList(in ClusterRoleBindingList, out *ClusterRoleBindingList, c *conversion.Cloner) error

func DeepCopy_api_ClusterRoleList 

func DeepCopy_api_ClusterRoleList(in ClusterRoleList, out *ClusterRoleList, c *conversion.Cloner) error

func DeepCopy_api_IsPersonalSubjectAccessReview 

func DeepCopy_api_IsPersonalSubjectAccessReview(in IsPersonalSubjectAccessReview, out *IsPersonalSubjectAccessReview, c *conversion.Cloner) error

func DeepCopy_api_LocalResourceAccessReview 

func DeepCopy_api_LocalResourceAccessReview(in LocalResourceAccessReview, out *LocalResourceAccessReview, c *conversion.Cloner) error

func DeepCopy_api_LocalSubjectAccessReview 

func DeepCopy_api_LocalSubjectAccessReview(in LocalSubjectAccessReview, out *LocalSubjectAccessReview, c *conversion.Cloner) error

func DeepCopy_api_Policy 

func DeepCopy_api_Policy(in Policy, out *Policy, c *conversion.Cloner) error

func DeepCopy_api_PolicyBinding 

func DeepCopy_api_PolicyBinding(in PolicyBinding, out *PolicyBinding, c *conversion.Cloner) error

func DeepCopy_api_PolicyBindingList 

func DeepCopy_api_PolicyBindingList(in PolicyBindingList, out *PolicyBindingList, c *conversion.Cloner) error

func DeepCopy_api_PolicyList 

func DeepCopy_api_PolicyList(in PolicyList, out *PolicyList, c *conversion.Cloner) error

func DeepCopy_api_PolicyRule 

func DeepCopy_api_PolicyRule(in PolicyRule, out *PolicyRule, c *conversion.Cloner) error

func DeepCopy_api_ResourceAccessReview 

func DeepCopy_api_ResourceAccessReview(in ResourceAccessReview, out *ResourceAccessReview, c *conversion.Cloner) error

func DeepCopy_api_ResourceAccessReviewResponse 

func DeepCopy_api_ResourceAccessReviewResponse(in ResourceAccessReviewResponse, out *ResourceAccessReviewResponse, c *conversion.Cloner) error

func DeepCopy_api_Role 

func DeepCopy_api_Role(in Role, out *Role, c *conversion.Cloner) error

func DeepCopy_api_RoleBinding 

func DeepCopy_api_RoleBinding(in RoleBinding, out *RoleBinding, c *conversion.Cloner) error

func DeepCopy_api_RoleBindingList 

func DeepCopy_api_RoleBindingList(in RoleBindingList, out *RoleBindingList, c *conversion.Cloner) error

func DeepCopy_api_RoleList 

func DeepCopy_api_RoleList(in RoleList, out *RoleList, c *conversion.Cloner) error

func DeepCopy_api_SelfSubjectRulesReview 

func DeepCopy_api_SelfSubjectRulesReview(in SelfSubjectRulesReview, out *SelfSubjectRulesReview, c *conversion.Cloner) error

func DeepCopy_api_SelfSubjectRulesReviewSpec 

func DeepCopy_api_SelfSubjectRulesReviewSpec(in SelfSubjectRulesReviewSpec, out *SelfSubjectRulesReviewSpec, c *conversion.Cloner) error

func DeepCopy_api_SubjectAccessReview 

func DeepCopy_api_SubjectAccessReview(in SubjectAccessReview, out *SubjectAccessReview, c *conversion.Cloner) error

func DeepCopy_api_SubjectAccessReviewResponse 

func DeepCopy_api_SubjectAccessReviewResponse(in SubjectAccessReviewResponse, out *SubjectAccessReviewResponse, c *conversion.Cloner) error

func DeepCopy_api_SubjectRulesReviewStatus 

func DeepCopy_api_SubjectRulesReviewStatus(in SubjectRulesReviewStatus, out *SubjectRulesReviewStatus, c *conversion.Cloner) error

func GetPolicyBindingName added in v0.5.1 

func GetPolicyBindingName(policyRefNamespace string) string

func Kind added in v1.1.2 

func Kind(kind string) unversioned.GroupKind

Kind takes an unqualified kind and returns back a Group qualified GroupKind

func NormalizeResources added in v1.1.1 

func NormalizeResources(rawResources sets.String) sets.String

NormalizeResources expands all resource groups and forces all resources to lower case. If the rawResources are already normalized, it returns the original set to avoid the allocation and GC cost, since this is hit multiple times for every REST call. That means you should NEVER MODIFY THE RESULT of this call.

func PolicyBindingToSelectableFields added in v1.0.8 

func PolicyBindingToSelectableFields(policyBinding *PolicyBinding) fields.Set

PolicyBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func PolicyToSelectableFields added in v1.0.8 

func PolicyToSelectableFields(policy *Policy) fields.Set

PolicyToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func Resource added in v1.1.2 

func Resource(resource string) unversioned.GroupResource

Resource takes an unqualified resource and returns back a Group qualified GroupResource

func RoleBindingToSelectableFields added in v1.0.8 

func RoleBindingToSelectableFields(roleBinding *RoleBinding) fields.Set

RoleBindingToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func RoleToSelectableFields added in v1.0.8 

func RoleToSelectableFields(role *Role) fields.Set

RoleToSelectableFields returns a label set that represents the object changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc

func StringSubjectsFor added in v1.0.5 

func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string)

StringSubjectsFor returns users and groups for comparison against user.Info. currentNamespace is used to to create usernames for service accounts where namespace=="".

func SubjectsStrings added in v1.0.5 

func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string)

SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes. currentNamespace is used to hide the subject.Namespace for ServiceAccounts in the currentNamespace

func ToClusterPolicyRef added in v0.5.1 

func ToClusterPolicyRef(in kapi.ObjectReference) kapi.ObjectReference

func ToClusterRoleBindingMap added in v0.5.1 

func ToClusterRoleBindingMap(in map[string]*RoleBinding) map[string]*ClusterRoleBinding

func ToClusterRoleMap added in v0.5.1 

func ToClusterRoleMap(in map[string]*Role) map[string]*ClusterRole

func ToClusterRoleRef added in v0.5.1 

func ToClusterRoleRef(in kapi.ObjectReference) kapi.ObjectReference

func ToPolicyRef added in v0.5.1 

func ToPolicyRef(in kapi.ObjectReference) kapi.ObjectReference

func ToRoleBindingMap added in v0.5.1 

func ToRoleBindingMap(in map[string]*ClusterRoleBinding) map[string]*RoleBinding

func ToRoleMap added in v0.5.1 

func ToRoleMap(in map[string]*ClusterRole) map[string]*Role

func ToRoleRef added in v0.5.1 

func ToRoleRef(in kapi.ObjectReference) kapi.ObjectReference

Types

type AuthorizationAttributes added in v1.0.5 

type AuthorizationAttributes struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	Namespace string
	// Verb is one of: get, list, watch, create, update, delete
	Verb string
	// Group is the API group of the resource
	Group string
	// Version is the API version of the resource
	Version string
	// Resource is one of the existing resource types
	Resource string
	// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
	ResourceName string
	// Content is the actual content of the request for create and update
	Content kruntime.Object
}

AuthorizationAttributes describes a request to be authorized

type ClusterPolicy added in v0.5.1 

type ClusterPolicy struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted
	LastModified unversioned.Time

	// Roles holds all the ClusterRoles held by this ClusterPolicy, mapped by Role.Name
	Roles map[string]*ClusterRole
}

ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most one ClusterPolicy document per namespace.

func ToClusterPolicy added in v0.5.1 

func ToClusterPolicy(in *Policy) *ClusterPolicy

func (*ClusterPolicy) GetObjectKind added in v1.1.3 

func (obj *ClusterPolicy) GetObjectKind() unversioned.ObjectKind

type ClusterPolicyBinding added in v0.5.1 

type ClusterPolicyBinding struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted
	LastModified unversioned.Time

	// ClusterPolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this ClusterPolicyBinding, mapped by RoleBinding.Name
	RoleBindings map[string]*ClusterRoleBinding
}

ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is one ClusterPolicyBinding document per referenced ClusterPolicy namespace

func ToClusterPolicyBinding added in v0.5.1 

func ToClusterPolicyBinding(in *PolicyBinding) *ClusterPolicyBinding

func (*ClusterPolicyBinding) GetObjectKind added in v1.1.3 

func (obj *ClusterPolicyBinding) GetObjectKind() unversioned.ObjectKind

type ClusterPolicyBindingList added in v0.5.1 

type ClusterPolicyBindingList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of ClusterPolicyBindings
	Items []ClusterPolicyBinding
}

ClusterPolicyBindingList is a collection of ClusterPolicyBindings

func ToClusterPolicyBindingList added in v0.5.1 

func ToClusterPolicyBindingList(in *PolicyBindingList) *ClusterPolicyBindingList

func (*ClusterPolicyBindingList) GetObjectKind added in v1.1.3 

func (obj *ClusterPolicyBindingList) GetObjectKind() unversioned.ObjectKind

type ClusterPolicyList added in v0.5.1 

type ClusterPolicyList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of ClusterPolicies
	Items []ClusterPolicy
}

ClusterPolicyList is a collection of ClusterPolicies

func ToClusterPolicyList added in v0.5.1 

func ToClusterPolicyList(in *PolicyList) *ClusterPolicyList

func (*ClusterPolicyList) GetObjectKind added in v1.1.3 

func (obj *ClusterPolicyList) GetObjectKind() unversioned.ObjectKind

type ClusterRole added in v0.5.1 

type ClusterRole struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// Rules holds all the PolicyRules for this ClusterRole
	Rules []PolicyRule
}

ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.

func ToClusterRole added in v0.5.1 

func ToClusterRole(in *Role) *ClusterRole

func (*ClusterRole) GetObjectKind added in v1.1.3 

func (obj *ClusterRole) GetObjectKind() unversioned.ObjectKind

type ClusterRoleBinding added in v0.5.1 

type ClusterRoleBinding struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func ToClusterRoleBinding added in v0.5.1 

func ToClusterRoleBinding(in *RoleBinding) *ClusterRoleBinding

func (*ClusterRoleBinding) GetObjectKind added in v1.1.3 

func (obj *ClusterRoleBinding) GetObjectKind() unversioned.ObjectKind

type ClusterRoleBindingList added in v0.5.1 

type ClusterRoleBindingList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of ClusterRoleBindings
	Items []ClusterRoleBinding
}

ClusterRoleBindingList is a collection of ClusterRoleBindings

func ToClusterRoleBindingList added in v0.5.1 

func ToClusterRoleBindingList(in *RoleBindingList) *ClusterRoleBindingList

func (*ClusterRoleBindingList) GetObjectKind added in v1.1.3 

func (obj *ClusterRoleBindingList) GetObjectKind() unversioned.ObjectKind

type ClusterRoleList added in v0.5.1 

type ClusterRoleList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of ClusterRoles
	Items []ClusterRole
}

ClusterRoleList is a collection of ClusterRoles

func ToClusterRoleList added in v0.5.1 

func ToClusterRoleList(in *RoleList) *ClusterRoleList

func (*ClusterRoleList) GetObjectKind added in v1.1.3 

func (obj *ClusterRoleList) GetObjectKind() unversioned.ObjectKind

type IsPersonalSubjectAccessReview added in v0.4.2 

type IsPersonalSubjectAccessReview struct {
	unversioned.TypeMeta
}

IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed

func (*IsPersonalSubjectAccessReview) GetObjectKind added in v1.1.3 

func (obj *IsPersonalSubjectAccessReview) GetObjectKind() unversioned.ObjectKind

type LocalResourceAccessReview added in v1.0.5 

type LocalResourceAccessReview struct {
	unversioned.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
}

LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace

func (*LocalResourceAccessReview) GetObjectKind added in v1.1.3 

func (obj *LocalResourceAccessReview) GetObjectKind() unversioned.ObjectKind

type LocalSubjectAccessReview added in v1.0.5 

type LocalSubjectAccessReview struct {
	unversioned.TypeMeta

	// Action describes the action being tested.  The Namespace element is FORCED to the current namespace.
	Action AuthorizationAttributes
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	Scopes []string
}

LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace

func AddUserToLSAR 

func AddUserToLSAR(user user.Info, lsar *LocalSubjectAccessReview) *LocalSubjectAccessReview

func (*LocalSubjectAccessReview) GetObjectKind added in v1.1.3 

func (obj *LocalSubjectAccessReview) GetObjectKind() unversioned.ObjectKind

type Policy 

type Policy struct {
	unversioned.TypeMeta
	kapi.ObjectMeta

	// LastModified is the last time that any part of the Policy was created, updated, or deleted
	LastModified unversioned.Time

	// Roles holds all the Roles held by this Policy, mapped by Role.Name
	Roles map[string]*Role
}

Policy is a object that holds all the Roles for a particular namespace. There is at most one Policy document per namespace.

func ToPolicy added in v0.5.1 

func ToPolicy(in *ClusterPolicy) *Policy

func (*Policy) GetObjectKind added in v1.1.3 

func (obj *Policy) GetObjectKind() unversioned.ObjectKind

type PolicyBinding 

type PolicyBinding struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted
	LastModified unversioned.Time

	// PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference
	PolicyRef kapi.ObjectReference
	// RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name
	RoleBindings map[string]*RoleBinding
}

PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is one PolicyBinding document per referenced Policy namespace

func ToPolicyBinding added in v0.5.1 

func ToPolicyBinding(in *ClusterPolicyBinding) *PolicyBinding

func (*PolicyBinding) GetObjectKind added in v1.1.3 

func (obj *PolicyBinding) GetObjectKind() unversioned.ObjectKind

type PolicyBindingList 

type PolicyBindingList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of policyBindings
	Items []PolicyBinding
}

PolicyBindingList is a collection of PolicyBindings

func ToPolicyBindingList added in v0.5.1 

func ToPolicyBindingList(in *ClusterPolicyBindingList) *PolicyBindingList

func (*PolicyBindingList) GetObjectKind added in v1.1.3 

func (obj *PolicyBindingList) GetObjectKind() unversioned.ObjectKind

type PolicyBindingSorter added in v0.5.1 

type PolicyBindingSorter []PolicyBinding

func (PolicyBindingSorter) Len added in v0.5.1 

func (s PolicyBindingSorter) Len() int

func (PolicyBindingSorter) Less added in v0.5.1 

func (s PolicyBindingSorter) Less(i, j int) bool

func (PolicyBindingSorter) Swap added in v0.5.1 

func (s PolicyBindingSorter) Swap(i, j int)

type PolicyList 

type PolicyList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of policies
	Items []Policy
}

PolicyList is a collection of Policies

func ToPolicyList added in v0.5.1 

func ToPolicyList(in *ClusterPolicyList) *PolicyList

func (*PolicyList) GetObjectKind added in v1.1.3 

func (obj *PolicyList) GetObjectKind() unversioned.ObjectKind

type PolicyRule 

type PolicyRule struct {
	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule.  VerbAll represents all kinds.
	Verbs sets.String
	// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
	// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
	AttributeRestrictions kruntime.Object
	// APIGroups is the name of the APIGroup that contains the resources.  If this field is empty, then both kubernetes and origin API groups are assumed.
	// That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request
	// will be allowed
	APIGroups []string
	// Resources is a list of resources this rule applies to.  ResourceAll represents all resources.
	Resources sets.String
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames sets.String
	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
	// If an action is not a resource API request, then the URL is split on '/' and is checked against the NonResourceURLs to look for a match.
	NonResourceURLs sets.String
}

PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

func (PolicyRule) CompactString 

func (r PolicyRule) CompactString() string

CompactString exposes a compact string representation for use in escalation error messages

func (PolicyRule) String added in v0.3.2 

func (r PolicyRule) String() string

type PolicyRuleBuilder 

type PolicyRuleBuilder struct {
	PolicyRule PolicyRule
}

+gencopy=false PolicyRuleBuilder let's us attach methods. A no-no for API types

func NewRule 

func NewRule(verbs ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Groups 

func (r *PolicyRuleBuilder) Groups(groups ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Names 

func (r *PolicyRuleBuilder) Names(names ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Resources 

func (r *PolicyRuleBuilder) Resources(resources ...string) *PolicyRuleBuilder

func (*PolicyRuleBuilder) Rule 

func (r *PolicyRuleBuilder) Rule() (PolicyRule, error)

func (*PolicyRuleBuilder) RuleOrDie 

func (r *PolicyRuleBuilder) RuleOrDie() PolicyRule

type ResourceAccessReview added in v0.3.1 

type ResourceAccessReview struct {
	unversioned.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
}

ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec

func (*ResourceAccessReview) GetObjectKind added in v1.1.3 

func (obj *ResourceAccessReview) GetObjectKind() unversioned.ObjectKind

type ResourceAccessReviewResponse added in v0.3.1 

type ResourceAccessReviewResponse struct {
	unversioned.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Users is the list of users who can perform the action
	Users sets.String
	// Groups is the list of groups who can perform the action
	Groups sets.String
}

ResourceAccessReviewResponse describes who can perform the action

func (*ResourceAccessReviewResponse) GetObjectKind added in v1.1.3 

func (obj *ResourceAccessReviewResponse) GetObjectKind() unversioned.ObjectKind

type Role 

type Role struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	kapi.ObjectMeta

	// Rules holds all the PolicyRules for this Role
	Rules []PolicyRule
}

Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.

func ToRole added in v0.5.1 

func ToRole(in *ClusterRole) *Role

func (*Role) GetObjectKind added in v1.1.3 

func (obj *Role) GetObjectKind() unversioned.ObjectKind

type RoleBinding 

type RoleBinding struct {
	unversioned.TypeMeta
	kapi.ObjectMeta

	// Subjects hold object references of to authorize with this rule
	Subjects []kapi.ObjectReference

	// RoleRef can only reference the current namespace and the global namespace
	// If the RoleRef cannot be resolved, the Authorizer must return an error.
	// Since Policy is a singleton, this is sufficient knowledge to locate a role
	RoleRef kapi.ObjectReference
}

RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace. It adds who information via Users and Groups and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).

func SortRoleBindings added in v0.5.1 

func SortRoleBindings(roleBindingMap map[string]*RoleBinding, reverse bool) []*RoleBinding

func ToRoleBinding added in v0.5.1 

func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding

func (*RoleBinding) GetObjectKind added in v1.1.3 

func (obj *RoleBinding) GetObjectKind() unversioned.ObjectKind

type RoleBindingList added in v0.3.2 

type RoleBindingList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of roleBindings
	Items []RoleBinding
}

RoleBindingList is a collection of RoleBindings

func ToRoleBindingList added in v0.5.1 

func ToRoleBindingList(in *ClusterRoleBindingList) *RoleBindingList

func (*RoleBindingList) GetObjectKind added in v1.1.3 

func (obj *RoleBindingList) GetObjectKind() unversioned.ObjectKind

type RoleBindingSorter added in v0.5.1 

type RoleBindingSorter []*RoleBinding

func (RoleBindingSorter) Len added in v0.5.1 

func (s RoleBindingSorter) Len() int

func (RoleBindingSorter) Less added in v0.5.1 

func (s RoleBindingSorter) Less(i, j int) bool

func (RoleBindingSorter) Swap added in v0.5.1 

func (s RoleBindingSorter) Swap(i, j int)

type RoleList added in v0.4.2 

type RoleList struct {
	unversioned.TypeMeta
	// Standard object's metadata.
	unversioned.ListMeta

	// Items is a list of roles
	Items []Role
}

RoleList is a collection of Roles

func ToRoleList added in v0.5.1 

func ToRoleList(in *ClusterRoleList) *RoleList

func (*RoleList) GetObjectKind added in v1.1.3 

func (obj *RoleList) GetObjectKind() unversioned.ObjectKind

type SelfSubjectRulesReview 

type SelfSubjectRulesReview struct {
	unversioned.TypeMeta

	// Spec adds information about how to conduct the check
	Spec SelfSubjectRulesReviewSpec

	// Status is completed by the server to tell which permissions you have
	Status SubjectRulesReviewStatus
}

SelfSubjectRulesReview is a resource you can create to determine which actions you can perform in a namespace

func (*SelfSubjectRulesReview) GetObjectKind 

func (obj *SelfSubjectRulesReview) GetObjectKind() unversioned.ObjectKind

type SelfSubjectRulesReviewSpec 

type SelfSubjectRulesReviewSpec struct {
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SubjectRulesReview, means "use the scopes on this request".
	// Nil for a regular SubjectRulesReview, means the same as empty.
	Scopes []string
}

SelfSubjectRulesReviewSpec adds information about how to conduct the check

type SortableRuleSlice 

type SortableRuleSlice []PolicyRule

func (SortableRuleSlice) Len 

func (s SortableRuleSlice) Len() int

func (SortableRuleSlice) Less 

func (s SortableRuleSlice) Less(i, j int) bool

func (SortableRuleSlice) Swap 

func (s SortableRuleSlice) Swap(i, j int)

type SubjectAccessReview added in v0.3.1 

type SubjectAccessReview struct {
	unversioned.TypeMeta

	// Action describes the action being tested
	Action AuthorizationAttributes
	// User is optional.  If both User and Groups are empty, the current authenticated user is used.
	User string
	// Groups is optional.  Groups is the list of groups to which the User belongs.
	Groups sets.String
	// Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".
	// Nil for a self-SAR, means "use the scopes on this request".
	// Nil for a regular SAR, means the same as empty.
	Scopes []string
}

SubjectAccessReview is an object for requesting information about whether a user or group can perform an action

func AddUserToSAR 

func AddUserToSAR(user user.Info, sar *SubjectAccessReview) *SubjectAccessReview

func (*SubjectAccessReview) GetObjectKind added in v1.1.3 

func (obj *SubjectAccessReview) GetObjectKind() unversioned.ObjectKind

type SubjectAccessReviewResponse added in v0.3.1 

type SubjectAccessReviewResponse struct {
	unversioned.TypeMeta

	// Namespace is the namespace used for the access review
	Namespace string
	// Allowed is required.  True if the action would be allowed, false otherwise.
	Allowed bool
	// Reason is optional.  It indicates why a request was allowed or denied.
	Reason string
}

SubjectAccessReviewResponse describes whether or not a user or group can perform an action

func (*SubjectAccessReviewResponse) GetObjectKind added in v1.1.3 

func (obj *SubjectAccessReviewResponse) GetObjectKind() unversioned.ObjectKind

type SubjectRulesReviewStatus 

type SubjectRulesReviewStatus struct {
	// Rules is the list of rules (no particular sort) that are allowed for the subject
	Rules []PolicyRule
	// EvaluationError can appear in combination with Rules.  It means some error happened during evaluation
	// that may have prevented additional rules from being populated.
	EvaluationError string
}

SubjectRulesReviewStatus is contains the result of a rules check

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.