Documentation
¶
Overview ¶
Package auth provides mechanisms for enforcing authorization to Project resources in OpenShift
Index ¶
- func NewUserProjectWatcher(user user.Info, visibleNamespaces sets.String, ...) *userProjectWatcher
- type AuthorizationCache
- func (ac *AuthorizationCache) AddWatcher(watcher CacheWatcher)
- func (ac *AuthorizationCache) GetClusterRoleLister() SyncedClusterRoleLister
- func (ac *AuthorizationCache) List(userInfo user.Info) (*kapi.NamespaceList, error)
- func (ac *AuthorizationCache) ReadyForAccess() bool
- func (ac *AuthorizationCache) RemoveWatcher(watcher CacheWatcher)
- func (ac *AuthorizationCache) Run(period time.Duration)
- type CacheWatcher
- type LastSyncResourceVersioner
- type Lister
- type Review
- type Reviewer
- type SyncedClusterRoleBindingLister
- type SyncedClusterRoleLister
- type SyncedRoleBindingLister
- type SyncedRoleLister
- type WatchableCache
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewUserProjectWatcher ¶
func NewUserProjectWatcher(user user.Info, visibleNamespaces sets.String, projectCache *projectcache.ProjectCache, authCache WatchableCache, includeAllExistingProjects bool) *userProjectWatcher
Types ¶
type AuthorizationCache ¶
type AuthorizationCache struct {
// contains filtered or unexported fields
}
AuthorizationCache maintains a cache on the set of namespaces a user or group can access.
func NewAuthorizationCache ¶
func NewAuthorizationCache( namespaces cache.SharedIndexInformer, reviewer Reviewer, informers rbacinformers.Interface, ) *AuthorizationCache
NewAuthorizationCache creates a new AuthorizationCache
func (*AuthorizationCache) AddWatcher ¶
func (ac *AuthorizationCache) AddWatcher(watcher CacheWatcher)
func (*AuthorizationCache) GetClusterRoleLister ¶ added in v3.7.0
func (ac *AuthorizationCache) GetClusterRoleLister() SyncedClusterRoleLister
func (*AuthorizationCache) List ¶
func (ac *AuthorizationCache) List(userInfo user.Info) (*kapi.NamespaceList, error)
List returns the set of namespace names the user has access to view
func (*AuthorizationCache) ReadyForAccess ¶
func (ac *AuthorizationCache) ReadyForAccess() bool
func (*AuthorizationCache) RemoveWatcher ¶
func (ac *AuthorizationCache) RemoveWatcher(watcher CacheWatcher)
func (*AuthorizationCache) Run ¶
func (ac *AuthorizationCache) Run(period time.Duration)
Run begins watching and synchronizing the cache
type CacheWatcher ¶
type CacheWatcher interface { // GroupMembershipChanged is called serially for all changes for all watchers. This method MUST NOT BLOCK. // The serial nature makes reasoning about the code easy, but if you block in this method you will doom all watchers. GroupMembershipChanged(namespaceName string, users, groups sets.String) }
type LastSyncResourceVersioner ¶
type LastSyncResourceVersioner interface {
LastSyncResourceVersion() string
}
LastSyncResourceVersioner is any object that can divulge a LastSyncResourceVersion
type Lister ¶
type Lister interface { // List returns the list of Namespace items that the user can access List(user user.Info) (*kapi.NamespaceList, error) }
Lister enforces ability to enumerate a resource based on role
type Reviewer ¶
Reviewer performs access reviews for a project by name
func NewAuthorizerReviewer ¶
func NewAuthorizerReviewer(policyChecker rbac.SubjectLocator) Reviewer
type SyncedClusterRoleBindingLister ¶ added in v3.7.0
type SyncedClusterRoleBindingLister interface { rbaclisters.ClusterRoleBindingLister LastSyncResourceVersioner }
type SyncedClusterRoleLister ¶ added in v3.7.0
type SyncedClusterRoleLister interface { rbaclisters.ClusterRoleLister LastSyncResourceVersioner }
type SyncedRoleBindingLister ¶ added in v3.7.0
type SyncedRoleBindingLister interface { rbaclisters.RoleBindingLister LastSyncResourceVersioner }
type SyncedRoleLister ¶ added in v3.7.0
type SyncedRoleLister interface { rbaclisters.RoleLister LastSyncResourceVersioner }
type WatchableCache ¶
type WatchableCache interface { // RemoveWatcher removes a watcher RemoveWatcher(CacheWatcher) // List returns the set of namespace names the user has access to view List(userInfo user.Info) (*kapi.NamespaceList, error) }
Click to show internal directories.
Click to hide internal directories.