filter

Documentation

Index

• Variables
• func CheckClustersTenant(ctx context.Context, tenantID string, clusterNames []string, ...) (string, bool)
• func ConvertTKEAttributes(ctx context.Context, attr authorizer.Attributes) authorizer.Attributes
• func ExtractClusterNames(ctx context.Context, req *http.Request, resource string) []string
• func ForbiddenResponse(ctx context.Context, tkeAttributes authorizer.Attributes, ...)
• func UnprotectedAuthorized(attributes authorizer.Attributes) authorizer.Decision
• func WithInspectors(handler http.Handler, inspectors []Inspector, c *genericapiserver.Config) http.Handler
• func WithTKEAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer, ...) http.Handler
• type Inspector
  • func NewClusterInspector(platformClient platformv1.PlatformV1Interface, privilegedUsername string) Inspector

Variables

var (
	AllowClusterNotFoundActions = sets.NewString(createClusterAction, updateProjectAction)
)

Functions

func CheckClustersTenant

func CheckClustersTenant(ctx context.Context, tenantID string, clusterNames []string,
	platformClient platformv1.PlatformV1Interface, verb string) (string, bool)

func ConvertTKEAttributes

func ConvertTKEAttributes(ctx context.Context, attr authorizer.Attributes) authorizer.Attributes

ConvertTKEAttributes converts attributes parsed by apiserver compatible with casbin enforcer

func ExtractClusterNames

func ExtractClusterNames(ctx context.Context, req *http.Request, resource string) []string

func ForbiddenResponse

func ForbiddenResponse(ctx context.Context, tkeAttributes authorizer.Attributes,
	w http.ResponseWriter, req *http.Request, ae *auditapi.Event, s runtime.NegotiatedSerializer, reason string)

func UnprotectedAuthorized

func UnprotectedAuthorized(attributes authorizer.Attributes) authorizer.Decision

UnprotectedAuthorized checks a request attribute has privileged to pass authorization.

func WithInspectors

func WithInspectors(handler http.Handler, inspectors []Inspector, c *genericapiserver.Config) http.Handler

func WithTKEAuthorization

func WithTKEAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer, ignoreAuthPathPrefixes []string) http.Handler

WithTKEAuthorization passes all tke-auth authorized requests on to handler, and returns a forbidden error otherwise.

Types

type Inspector

type Inspector interface {
	Inspect(handler http.Handler, c *genericapiserver.Config) http.Handler
}

func NewClusterInspector

func NewClusterInspector(platformClient platformv1.PlatformV1Interface, privilegedUsername string) Inspector