Documentation
¶
Index ¶
- func BreakdownRule(rule authorizationapi.PolicyRule) []authorizationapi.PolicyRule
- func CompactRules(rules []authorizationapi.PolicyRule) ([]authorizationapi.PolicyRule, error)
- func ConfirmNoEscalation(ctx apirequest.Context, resource schema.GroupResource, name string, ...) error
- func Covers(ownerRules, servantRules []authorizationapi.PolicyRule) (bool, []authorizationapi.PolicyRule)
- func EscalationAllowed(ctx apirequest.Context) bool
- type AuthorizationRuleResolver
- type DefaultRuleResolver
- func (a *DefaultRuleResolver) GetRole(roleBinding authorizationinterfaces.RoleBinding) (authorizationinterfaces.Role, error)
- func (a *DefaultRuleResolver) GetRoleBindings(namespace string) ([]authorizationinterfaces.RoleBinding, error)
- func (a *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]authorizationapi.PolicyRule, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BreakdownRule ¶
func BreakdownRule(rule authorizationapi.PolicyRule) []authorizationapi.PolicyRule
BreakdownRule takes a rule and builds an equivalent list of rules that each have at most one verb, one resource, and one resource name
func CompactRules ¶
func CompactRules(rules []authorizationapi.PolicyRule) ([]authorizationapi.PolicyRule, error)
CompactRules combines rules that contain a single APIGroup/Resource, differ only by verb, and contain no other attributes. this is a fast check, and works well with the decomposed "missing rules" list from a Covers check.
func ConfirmNoEscalation ¶
func ConfirmNoEscalation(ctx apirequest.Context, resource schema.GroupResource, name string, ruleResolver, cachedRuleResolver AuthorizationRuleResolver, role authorizationinterfaces.Role) error
func Covers ¶
func Covers(ownerRules, servantRules []authorizationapi.PolicyRule) (bool, []authorizationapi.PolicyRule)
Covers determines whether or not the ownerRules cover the servantRules in terms of allowed actions. It returns whether or not the ownerRules cover and a list of the rules that the ownerRules do not cover.
func EscalationAllowed ¶
func EscalationAllowed(ctx apirequest.Context) bool
EscalationAllowed returns true if a particular user is allowed to escalate his powers
Types ¶
type AuthorizationRuleResolver ¶
type AuthorizationRuleResolver interface { GetRoleBindings(namespace string) ([]authorizationinterfaces.RoleBinding, error) GetRole(roleBinding authorizationinterfaces.RoleBinding) (authorizationinterfaces.Role, error) // RulesFor returns the list of rules that apply to a given user in a given namespace and error. If an error is returned, the slice of // PolicyRules may not be complete, but it contains all retrievable rules. This is done because policy rules are purely additive and policy determinations // can be made on the basis of those rules that are found. RulesFor(info user.Info, namespace string) ([]authorizationapi.PolicyRule, error) }
type DefaultRuleResolver ¶
type DefaultRuleResolver struct {
// contains filtered or unexported fields
}
func NewDefaultRuleResolver ¶
func NewDefaultRuleResolver(policyGetter authorizationlister.PolicyLister, bindingLister authorizationlister.PolicyBindingLister, clusterPolicyGetter authorizationlister.ClusterPolicyLister, clusterBindingLister authorizationlister.ClusterPolicyBindingLister) *DefaultRuleResolver
func (*DefaultRuleResolver) GetRole ¶
func (a *DefaultRuleResolver) GetRole(roleBinding authorizationinterfaces.RoleBinding) (authorizationinterfaces.Role, error)
func (*DefaultRuleResolver) GetRoleBindings ¶
func (a *DefaultRuleResolver) GetRoleBindings(namespace string) ([]authorizationinterfaces.RoleBinding, error)
func (*DefaultRuleResolver) RulesFor ¶
func (a *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]authorizationapi.PolicyRule, error)
RulesFor returns the list of rules that apply to a given user in a given namespace and error. If an error is returned, the slice of PolicyRules may not be complete, but it contains all retrievable rules. This is done because policy rules are purely additive and policy determinations can be made on the basis of those rules that are found.