Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add selfsubjectaccessreview API #31271

Merged
merged 2 commits into from
Sep 8, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 110 additions & 23 deletions api/swagger-spec/authorization.k8s.io_v1beta1.json
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,51 @@
"description": ""
},
"apis": [
{
"path": "/apis/authorization.k8s.io/v1beta1/selfsubjectaccessreviews",
"description": "API at /apis/authorization.k8s.io/v1beta1",
"operations": [
{
"type": "v1beta1.SelfSubjectAccessReview",
"method": "POST",
"summary": "create a SelfSubjectAccessReview",
"nickname": "createSelfSubjectAccessReview",
"parameters": [
{
"type": "string",
"paramType": "query",
"name": "pretty",
"description": "If 'true', then the output is pretty printed.",
"required": false,
"allowMultiple": false
},
{
"type": "v1beta1.SelfSubjectAccessReview",
"paramType": "body",
"name": "body",
"description": "",
"required": true,
"allowMultiple": false
}
],
"responseMessages": [
{
"code": 200,
"message": "OK",
"responseModel": "v1beta1.SelfSubjectAccessReview"
}
],
"produces": [
"application/json",
"application/yaml",
"application/vnd.kubernetes.protobuf"
],
"consumes": [
"*/*"
]
}
]
},
{
"path": "/apis/authorization.k8s.io/v1beta1/subjectaccessreviews",
"description": "API at /apis/authorization.k8s.io/v1beta1",
Expand Down Expand Up @@ -78,9 +123,9 @@
}
],
"models": {
"v1beta1.SubjectAccessReview": {
"id": "v1beta1.SubjectAccessReview",
"description": "SubjectAccessReview checks whether or not a user or group can perform an action.",
"v1beta1.SelfSubjectAccessReview": {
"id": "v1beta1.SelfSubjectAccessReview",
"description": "SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means \"in all namespaces\". Self is a special case, because users should always be able to check whether they can perform an action",
"required": [
"spec"
],
Expand All @@ -97,8 +142,8 @@
"$ref": "v1.ObjectMeta"
},
"spec": {
"$ref": "v1beta1.SubjectAccessReviewSpec",
"description": "Spec holds information about the request being evaluated"
"$ref": "v1beta1.SelfSubjectAccessReviewSpec",
"description": "Spec holds information about the request being evaluated. user and groups must be empty"
},
"status": {
"$ref": "v1beta1.SubjectAccessReviewStatus",
Expand Down Expand Up @@ -214,9 +259,9 @@
}
}
},
"v1beta1.SubjectAccessReviewSpec": {
"id": "v1beta1.SubjectAccessReviewSpec",
"description": "SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
"v1beta1.SelfSubjectAccessReviewSpec": {
"id": "v1beta1.SelfSubjectAccessReviewSpec",
"description": "SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
"properties": {
"resourceAttributes": {
"$ref": "v1beta1.ResourceAttributes",
Expand All @@ -225,21 +270,6 @@
"nonResourceAttributes": {
"$ref": "v1beta1.NonResourceAttributes",
"description": "NonResourceAttributes describes information for a non-resource access request"
},
"user": {
"type": "string",
"description": "User is the user you're testing for. If you specify \"User\" but not \"Group\", then is it interpreted as \"What if User were not a member of any groups"
},
"group": {
"type": "array",
"items": {
"type": "string"
},
"description": "Groups is the groups you're testing for."
},
"extra": {
"type": "object",
"description": "Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here."
}
}
},
Expand Down Expand Up @@ -312,6 +342,63 @@
}
}
},
"v1beta1.SubjectAccessReview": {
"id": "v1beta1.SubjectAccessReview",
"description": "SubjectAccessReview checks whether or not a user or group can perform an action.",
"required": [
"spec"
],
"properties": {
"kind": {
"type": "string",
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds"
},
"apiVersion": {
"type": "string",
"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#resources"
},
"metadata": {
"$ref": "v1.ObjectMeta"
},
"spec": {
"$ref": "v1beta1.SubjectAccessReviewSpec",
"description": "Spec holds information about the request being evaluated"
},
"status": {
"$ref": "v1beta1.SubjectAccessReviewStatus",
"description": "Status is filled in by the server and indicates whether the request is allowed or not"
}
}
},
"v1beta1.SubjectAccessReviewSpec": {
"id": "v1beta1.SubjectAccessReviewSpec",
"description": "SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
"properties": {
"resourceAttributes": {
"$ref": "v1beta1.ResourceAttributes",
"description": "ResourceAuthorizationAttributes describes information for a resource access request"
},
"nonResourceAttributes": {
"$ref": "v1beta1.NonResourceAttributes",
"description": "NonResourceAttributes describes information for a non-resource access request"
},
"user": {
"type": "string",
"description": "User is the user you're testing for. If you specify \"User\" but not \"Group\", then is it interpreted as \"What if User were not a member of any groups"
},
"group": {
"type": "array",
"items": {
"type": "string"
},
"description": "Groups is the groups you're testing for."
},
"extra": {
"type": "object",
"description": "Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here."
}
}
},
"unversioned.APIResourceList": {
"id": "unversioned.APIResourceList",
"description": "APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.",
Expand Down
4 changes: 4 additions & 0 deletions pkg/apis/authorization/types.go
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,10 @@ type SubjectAccessReview struct {
Status SubjectAccessReviewStatus
}

// +genclient=true
// +nonNamespaced=true
// +noMethods=true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I couldn't find documentation on what +noMethods accomplishes. Does it limit the actions generated to "Create"?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I couldn't find documentation on what +noMethods accomplishes. Does it limit the actions generated to "Create"?

It prevents the client generator from generating methods. Since this isn't a normal resource, it doesn't have types for things like SelfSubjectAccessReviewList (no get method), so the default generator fails.

It means you have to manually create the Create methods in the generated_expansion.go file.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It means you have to manually create the Create methods in the generated_expansion.go file.

Nice. Does that not get overridden as soon as someone else regenerates? (not to get too off topic)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. Does that not get overridden as soon as someone else regenerates? (not to get too off topic)

No, it is preserved.


// SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a
// spec.namespace means "in all namespaces". Self is a special case, because users should always be able
// to check whether they can perform an action
Expand Down
4 changes: 4 additions & 0 deletions pkg/apis/authorization/v1beta1/types.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@ type SubjectAccessReview struct {
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

// +genclient=true
// +nonNamespaced=true
// +noMethods=true

// SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a
// spec.namespace means "in all namespaces". Self is a special case, because users should always be able
// to check whether they can perform an action
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import (

type AuthorizationInterface interface {
GetRESTClient() *restclient.RESTClient
SelfSubjectAccessReviewsGetter
SubjectAccessReviewsGetter
}

Expand All @@ -32,6 +33,10 @@ type AuthorizationClient struct {
*restclient.RESTClient
}

func (c *AuthorizationClient) SelfSubjectAccessReviews() SelfSubjectAccessReviewInterface {
return newSelfSubjectAccessReviews(c)
}

func (c *AuthorizationClient) SubjectAccessReviews() SubjectAccessReviewInterface {
return newSubjectAccessReviews(c)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ type FakeAuthorization struct {
*core.Fake
}

func (c *FakeAuthorization) SelfSubjectAccessReviews() unversioned.SelfSubjectAccessReviewInterface {
return &FakeSelfSubjectAccessReviews{c}
}

func (c *FakeAuthorization) SubjectAccessReviews() unversioned.SubjectAccessReviewInterface {
return &FakeSubjectAccessReviews{c}
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,8 @@ func (c *FakeSubjectAccessReviews) Create(sar *authorizationapi.SubjectAccessRev
obj, err := c.Fake.Invokes(core.NewRootCreateAction(authorizationapi.SchemeGroupVersion.WithResource("subjectaccessreviews"), sar), &authorizationapi.SubjectAccessReview{})
return obj.(*authorizationapi.SubjectAccessReview), err
}

func (c *FakeSelfSubjectAccessReviews) Create(sar *authorizationapi.SelfSubjectAccessReview) (result *authorizationapi.SelfSubjectAccessReview, err error) {
obj, err := c.Fake.Invokes(core.NewRootCreateAction(authorizationapi.SchemeGroupVersion.WithResource("selfsubjectaccessreviews"), sar), &authorizationapi.SelfSubjectAccessReview{})
return obj.(*authorizationapi.SelfSubjectAccessReview), err
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
/*
Copyright 2016 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package fake

// FakeSelfSubjectAccessReviews implements SelfSubjectAccessReviewInterface
type FakeSelfSubjectAccessReviews struct {
Fake *FakeAuthorization
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
/*
Copyright 2016 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package unversioned

// SelfSubjectAccessReviewsGetter has a method to return a SelfSubjectAccessReviewInterface.
// A group's client should implement this interface.
type SelfSubjectAccessReviewsGetter interface {
SelfSubjectAccessReviews() SelfSubjectAccessReviewInterface
}

// SelfSubjectAccessReviewInterface has methods to work with SelfSubjectAccessReview resources.
type SelfSubjectAccessReviewInterface interface {
SelfSubjectAccessReviewExpansion
}

// selfSubjectAccessReviews implements SelfSubjectAccessReviewInterface
type selfSubjectAccessReviews struct {
client *AuthorizationClient
}

// newSelfSubjectAccessReviews returns a SelfSubjectAccessReviews
func newSelfSubjectAccessReviews(c *AuthorizationClient) *selfSubjectAccessReviews {
return &selfSubjectAccessReviews{
client: c,
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
/*
Copyright 2016 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package unversioned

import (
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
)

type SelfSubjectAccessReviewExpansion interface {
Create(sar *authorizationapi.SelfSubjectAccessReview) (result *authorizationapi.SelfSubjectAccessReview, err error)
}

func (c *selfSubjectAccessReviews) Create(sar *authorizationapi.SelfSubjectAccessReview) (result *authorizationapi.SelfSubjectAccessReview, err error) {
result = &authorizationapi.SelfSubjectAccessReview{}
err = c.client.Post().
Resource("selfsubjectaccessreviews").
Body(sar).
Do().
Into(result)
return
}
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ import (
authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
)

// The PodExpansion interface allows manually adding extra methods to the PodInterface.
type SubjectAccessReviewExpansion interface {
Create(sar *authorizationapi.SubjectAccessReview) (result *authorizationapi.SubjectAccessReview, err error)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (

type AuthorizationInterface interface {
GetRESTClient() *restclient.RESTClient
SelfSubjectAccessReviewsGetter
SubjectAccessReviewsGetter
}

Expand All @@ -33,6 +34,10 @@ type AuthorizationClient struct {
*restclient.RESTClient
}

func (c *AuthorizationClient) SelfSubjectAccessReviews() SelfSubjectAccessReviewInterface {
return newSelfSubjectAccessReviews(c)
}

func (c *AuthorizationClient) SubjectAccessReviews() SubjectAccessReviewInterface {
return newSubjectAccessReviews(c)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ type FakeAuthorization struct {
*core.Fake
}

func (c *FakeAuthorization) SelfSubjectAccessReviews() v1beta1.SelfSubjectAccessReviewInterface {
return &FakeSelfSubjectAccessReviews{c}
}

func (c *FakeAuthorization) SubjectAccessReviews() v1beta1.SubjectAccessReviewInterface {
return &FakeSubjectAccessReviews{c}
}
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
/*
Copyright 2016 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package fake

// FakeSelfSubjectAccessReviews implements SelfSubjectAccessReviewInterface
type FakeSelfSubjectAccessReviews struct {
Fake *FakeAuthorization
}
Loading