Documentation
¶
Index ¶
- Constants
- func IsPersonalAccessReview(a Action) (bool, error)
- type Action
- type AuthorizationAttributeBuilder
- type Authorizer
- type DefaultAuthorizationAttributes
- func (a DefaultAuthorizationAttributes) GetAPIGroup() string
- func (a DefaultAuthorizationAttributes) GetAPIVersion() string
- func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}
- func (a DefaultAuthorizationAttributes) GetResource() string
- func (a DefaultAuthorizationAttributes) GetResourceName() string
- func (a DefaultAuthorizationAttributes) GetURL() string
- func (a DefaultAuthorizationAttributes) GetVerb() string
- func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool
- func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)
- type ForbiddenMessageMaker
- type ForbiddenMessageResolver
- type MessageContext
- type RequestInfoResolver
Constants ¶
View Source
const DefaultProjectRequestForbidden = "You may not request a new project via this API."
Variables ¶
This section is empty.
Functions ¶
func IsPersonalAccessReview ¶ added in v0.4.2
Types ¶
type Action ¶
type Action interface { GetVerb() string GetAPIVersion() string GetAPIGroup() string // GetResource returns the resource type. If IsNonResourceURL() is true, then GetResource() is "". GetResource() string GetResourceName() string // GetRequestAttributes is of type interface{} because different verbs and different Authorizer/AuthorizationAttributeBuilder pairs may have different contract requirements. GetRequestAttributes() interface{} // IsNonResourceURL returns true if this is not an action performed against the resource API IsNonResourceURL() bool // GetURL returns the URL path being requested, including the leading '/' GetURL() string }
type AuthorizationAttributeBuilder ¶
type AuthorizationAttributeBuilder interface {
GetAttributes(request *http.Request) (Action, error)
}
func NewAuthorizationAttributeBuilder ¶
func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver RequestInfoResolver) AuthorizationAttributeBuilder
type Authorizer ¶
type Authorizer interface { Authorize(ctx kapi.Context, a Action) (allowed bool, reason string, err error) GetAllowedSubjects(ctx kapi.Context, attributes Action) (sets.String, sets.String, error) }
func NewAuthorizer ¶
func NewAuthorizer(ruleResolver rulevalidation.AuthorizationRuleResolver, forbiddenMessageMaker ForbiddenMessageMaker) Authorizer
type DefaultAuthorizationAttributes ¶ added in v0.3.1
type DefaultAuthorizationAttributes struct { Verb string APIVersion string APIGroup string Resource string ResourceName string RequestAttributes interface{} NonResourceURL bool URL string }
func CoerceToDefaultAuthorizationAttributes ¶
func CoerceToDefaultAuthorizationAttributes(passedAttributes Action) *DefaultAuthorizationAttributes
TODO this may or may not be the behavior we want for managing rules. As a for instance, a verb might be specified that our attributes builder will never satisfy. For now, I think gets us close. Maybe a warning message of some kind?
func ToDefaultAuthorizationAttributes ¶ added in v1.0.5
func ToDefaultAuthorizationAttributes(in authorizationapi.Action) DefaultAuthorizationAttributes
ToDefaultAuthorizationAttributes coerces Action to DefaultAuthorizationAttributes. Namespace is not included because the authorizer takes that information on the context
func (DefaultAuthorizationAttributes) GetAPIGroup ¶ added in v1.0.7
func (a DefaultAuthorizationAttributes) GetAPIGroup() string
func (DefaultAuthorizationAttributes) GetAPIVersion ¶ added in v0.4.4
func (a DefaultAuthorizationAttributes) GetAPIVersion() string
func (DefaultAuthorizationAttributes) GetRequestAttributes ¶ added in v0.3.1
func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}
func (DefaultAuthorizationAttributes) GetResource ¶ added in v0.3.1
func (a DefaultAuthorizationAttributes) GetResource() string
func (DefaultAuthorizationAttributes) GetResourceName ¶ added in v0.3.1
func (a DefaultAuthorizationAttributes) GetResourceName() string
func (DefaultAuthorizationAttributes) GetURL ¶ added in v0.3.2
func (a DefaultAuthorizationAttributes) GetURL() string
func (DefaultAuthorizationAttributes) GetVerb ¶ added in v0.3.1
func (a DefaultAuthorizationAttributes) GetVerb() string
func (DefaultAuthorizationAttributes) IsNonResourceURL ¶ added in v0.3.2
func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool
func (DefaultAuthorizationAttributes) RuleMatches ¶ added in v0.3.1
func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)
type ForbiddenMessageMaker ¶ added in v0.5.3
type ForbiddenMessageMaker interface {
MakeMessage(ctx MessageContext) (string, error)
}
ForbiddenMessageMaker creates a forbidden message from a MessageContext
type ForbiddenMessageResolver ¶ added in v0.5.3
type ForbiddenMessageResolver struct {
// contains filtered or unexported fields
}
func NewForbiddenMessageResolver ¶ added in v0.5.3
func NewForbiddenMessageResolver(projectRequestForbiddenTemplate string) *ForbiddenMessageResolver
func (*ForbiddenMessageResolver) MakeMessage ¶ added in v0.5.3
func (m *ForbiddenMessageResolver) MakeMessage(ctx MessageContext) (string, error)
type MessageContext ¶ added in v0.5.3
MessageContext contains sufficient information to create a forbidden message. It is bundled in this one object to make it easy and obvious how to build a golang template
type RequestInfoResolver ¶ added in v1.2.0
type RequestInfoResolver interface {
GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error)
}
func NewBrowserSafeRequestInfoResolver ¶ added in v1.2.0
func NewBrowserSafeRequestInfoResolver(contextMapper kapi.RequestContextMapper, authenticatedGroups sets.String, infoResolver RequestInfoResolver) RequestInfoResolver
Source Files
¶
Click to show internal directories.
Click to hide internal directories.