-
Notifications
You must be signed in to change notification settings - Fork 4.7k
/
types.go
614 lines (503 loc) · 28.8 KB
/
types.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
package v1
import (
"fmt"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
kruntime "k8s.io/apimachinery/pkg/runtime"
kapi "k8s.io/kubernetes/pkg/api/v1"
)
// Authorization is calculated against
// 1. all deny RoleBinding PolicyRules in the master namespace - short circuit on match
// 2. all allow RoleBinding PolicyRules in the master namespace - short circuit on match
// 3. all deny RoleBinding PolicyRules in the namespace - short circuit on match
// 4. all allow RoleBinding PolicyRules in the namespace - short circuit on match
// 5. deny by default
// PolicyRule holds information that describes a policy rule, but does not contain information
// about who the rule applies to or which namespace the rule applies to.
type PolicyRule struct {
// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
// AttributeRestrictions will vary depending on what the Authorizer/AuthorizationAttributeBuilder pair supports.
// If the Authorizer does not recognize how to handle the AttributeRestrictions, the Authorizer should report an error.
AttributeRestrictions kruntime.RawExtension `json:"attributeRestrictions,omitempty" protobuf:"bytes,2,opt,name=attributeRestrictions"`
// APIGroups is the name of the APIGroup that contains the resources. If this field is empty, then both kubernetes and origin API groups are assumed.
// That means that if an action is requested against one of the enumerated resources in either the kubernetes or the origin API group, the request
// will be allowed
APIGroups []string `json:"apiGroups" protobuf:"bytes,3,rep,name=apiGroups"`
// Resources is a list of resources this rule applies to. ResourceAll represents all resources.
Resources []string `json:"resources" protobuf:"bytes,4,rep,name=resources"`
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,5,rep,name=resourceNames"`
// NonResourceURLsSlice is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
// This name is intentionally different than the internal type so that the DefaultConvert works nicely and because the ordering may be different.
NonResourceURLsSlice []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,6,rep,name=nonResourceURLs"`
}
// IsPersonalSubjectAccessReview is a marker for PolicyRule.AttributeRestrictions that denotes that subjectaccessreviews on self should be allowed
type IsPersonalSubjectAccessReview struct {
metav1.TypeMeta `json:",inline"`
}
// +genclient
// Role is a logical grouping of PolicyRules that can be referenced as a unit by RoleBindings.
type Role struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Rules holds all the PolicyRules for this Role
Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
}
// OptionalNames is an array that may also be left nil to distinguish between set and unset.
// +protobuf.nullable=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
type OptionalNames []string
func (t OptionalNames) String() string {
return fmt.Sprintf("%v", []string(t))
}
// +genclient
// RoleBinding references a Role, but not contain it. It can reference any Role in the same namespace or in the global namespace.
// It adds who information via (Users and Groups) OR Subjects and namespace information by which namespace it exists in.
// RoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
type RoleBinding struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// UserNames holds all the usernames directly bound to the role.
// This field should only be specified when supporting legacy clients and servers.
// See Subjects for further details.
// +k8s:conversion-gen=false
UserNames OptionalNames `json:"userNames" protobuf:"bytes,2,rep,name=userNames"`
// GroupNames holds all the groups directly bound to the role.
// This field should only be specified when supporting legacy clients and servers.
// See Subjects for further details.
// +k8s:conversion-gen=false
GroupNames OptionalNames `json:"groupNames" protobuf:"bytes,3,rep,name=groupNames"`
// Subjects hold object references to authorize with this rule.
// This field is ignored if UserNames or GroupNames are specified to support legacy clients and servers.
// Thus newer clients that do not need to support backwards compatibility should send
// only fully qualified Subjects and should omit the UserNames and GroupNames fields.
// Clients that need to support backwards compatibility can use this field to build the UserNames and GroupNames.
Subjects []kapi.ObjectReference `json:"subjects" protobuf:"bytes,4,rep,name=subjects"`
// RoleRef can only reference the current namespace and the global namespace.
// If the RoleRef cannot be resolved, the Authorizer must return an error.
// Since Policy is a singleton, this is sufficient knowledge to locate a role.
RoleRef kapi.ObjectReference `json:"roleRef" protobuf:"bytes,5,opt,name=roleRef"`
}
type NamedRoles []NamedRole
// +genclient
// Policy is a object that holds all the Roles for a particular namespace. There is at most
// one Policy document per namespace.
type Policy struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// LastModified is the last time that any part of the Policy was created, updated, or deleted
LastModified metav1.Time `json:"lastModified" protobuf:"bytes,2,opt,name=lastModified"`
// Roles holds all the Roles held by this Policy, mapped by Role.Name
Roles NamedRoles `json:"roles" protobuf:"bytes,3,rep,name=roles"`
}
type NamedRoleBindings []NamedRoleBinding
// +genclient
// PolicyBinding is a object that holds all the RoleBindings for a particular namespace. There is
// one PolicyBinding document per referenced Policy namespace
type PolicyBinding struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// LastModified is the last time that any part of the PolicyBinding was created, updated, or deleted
LastModified metav1.Time `json:"lastModified" protobuf:"bytes,2,opt,name=lastModified"`
// PolicyRef is a reference to the Policy that contains all the Roles that this PolicyBinding's RoleBindings may reference
PolicyRef kapi.ObjectReference `json:"policyRef" protobuf:"bytes,3,opt,name=policyRef"`
// RoleBindings holds all the RoleBindings held by this PolicyBinding, mapped by RoleBinding.Name
RoleBindings NamedRoleBindings `json:"roleBindings" protobuf:"bytes,4,rep,name=roleBindings"`
}
// NamedRole relates a Role with a name
type NamedRole struct {
// Name is the name of the role
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
// Role is the role being named
Role Role `json:"role" protobuf:"bytes,2,opt,name=role"`
}
// NamedRoleBinding relates a role binding with a name
type NamedRoleBinding struct {
// Name is the name of the role binding
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
// RoleBinding is the role binding being named
RoleBinding RoleBinding `json:"roleBinding" protobuf:"bytes,2,opt,name=roleBinding"`
}
// +genclient
// +genclient:onlyVerbs=create
// SelfSubjectRulesReview is a resource you can create to determine which actions you can perform in a namespace
type SelfSubjectRulesReview struct {
metav1.TypeMeta `json:",inline"`
// Spec adds information about how to conduct the check
Spec SelfSubjectRulesReviewSpec `json:"spec" protobuf:"bytes,1,opt,name=spec"`
// Status is completed by the server to tell which permissions you have
Status SubjectRulesReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
}
// SelfSubjectRulesReviewSpec adds information about how to conduct the check
type SelfSubjectRulesReviewSpec struct {
// Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups".
// Nil means "use the scopes on this request".
// +k8s:conversion-gen=false
Scopes OptionalScopes `json:"scopes" protobuf:"bytes,1,rep,name=scopes"`
}
// +genclient
// +genclient:onlyVerbs=create
// SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace
type SubjectRulesReview struct {
metav1.TypeMeta `json:",inline"`
// Spec adds information about how to conduct the check
Spec SubjectRulesReviewSpec `json:"spec" protobuf:"bytes,1,opt,name=spec"`
// Status is completed by the server to tell which permissions you have
Status SubjectRulesReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
}
// SubjectRulesReviewSpec adds information about how to conduct the check
type SubjectRulesReviewSpec struct {
// User is optional. At least one of User and Groups must be specified.
User string `json:"user" protobuf:"bytes,1,opt,name=user"`
// Groups is optional. Groups is the list of groups to which the User belongs. At least one of User and Groups must be specified.
Groups []string `json:"groups" protobuf:"bytes,2,rep,name=groups"`
// Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups".
Scopes OptionalScopes `json:"scopes" protobuf:"bytes,3,opt,name=scopes"`
}
// SubjectRulesReviewStatus is contains the result of a rules check
type SubjectRulesReviewStatus struct {
// Rules is the list of rules (no particular sort) that are allowed for the subject
Rules []PolicyRule `json:"rules" protobuf:"bytes,1,rep,name=rules"`
// EvaluationError can appear in combination with Rules. It means some error happened during evaluation
// that may have prevented additional rules from being populated.
EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,2,opt,name=evaluationError"`
}
// ResourceAccessReviewResponse describes who can perform the action
type ResourceAccessReviewResponse struct {
metav1.TypeMeta `json:",inline"`
// Namespace is the namespace used for the access review
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
// UsersSlice is the list of users who can perform the action
// +k8s:conversion-gen=false
UsersSlice []string `json:"users" protobuf:"bytes,2,rep,name=users"`
// GroupsSlice is the list of groups who can perform the action
// +k8s:conversion-gen=false
GroupsSlice []string `json:"groups" protobuf:"bytes,3,rep,name=groups"`
// EvaluationError is an indication that some error occurred during resolution, but partial results can still be returned.
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it. This is
// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
EvaluationError string `json:"evalutionError" protobuf:"bytes,4,opt,name=evalutionError"`
}
// +genclient
// +genclient:nonNamespaced
// +genclient:onlyVerbs=create
// ResourceAccessReview is a means to request a list of which users and groups are authorized to perform the
// action specified by spec
type ResourceAccessReview struct {
metav1.TypeMeta `json:",inline"`
// Action describes the action being tested.
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
}
// SubjectAccessReviewResponse describes whether or not a user or group can perform an action
type SubjectAccessReviewResponse struct {
metav1.TypeMeta `json:",inline"`
// Namespace is the namespace used for the access review
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
// Allowed is required. True if the action would be allowed, false otherwise.
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
// Reason is optional. It indicates why a request was allowed or denied.
Reason string `json:"reason,omitempty" protobuf:"bytes,3,opt,name=reason"`
// EvaluationError is an indication that some error occurred during the authorization check.
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it. This is
// most common when a bound role is missing, but enough roles are still present and bound to reason about the request.
EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,4,opt,name=evaluationError"`
}
// OptionalScopes is an array that may also be left nil to distinguish between set and unset.
// +protobuf.nullable=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
type OptionalScopes []string
func (t OptionalScopes) String() string {
return fmt.Sprintf("%v", []string(t))
}
// +genclient
// +genclient:nonNamespaced
// +genclient:onlyVerbs=create
// SubjectAccessReview is an object for requesting information about whether a user or group can perform an action
type SubjectAccessReview struct {
metav1.TypeMeta `json:",inline"`
// Action describes the action being tested.
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
// User is optional. If both User and Groups are empty, the current authenticated user is used.
User string `json:"user" protobuf:"bytes,2,opt,name=user"`
// GroupsSlice is optional. Groups is the list of groups to which the User belongs.
// +k8s:conversion-gen=false
GroupsSlice []string `json:"groups" protobuf:"bytes,3,rep,name=groups"`
// Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups".
// Nil for a self-SAR, means "use the scopes on this request".
// Nil for a regular SAR, means the same as empty.
// +k8s:conversion-gen=false
Scopes OptionalScopes `json:"scopes" protobuf:"bytes,4,rep,name=scopes"`
}
// +genclient
// +genclient:onlyVerbs=create
// LocalResourceAccessReview is a means to request a list of which users and groups are authorized to perform the action specified by spec in a particular namespace
type LocalResourceAccessReview struct {
metav1.TypeMeta `json:",inline"`
// Action describes the action being tested. The Namespace element is FORCED to the current namespace.
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
}
// +genclient
// +genclient:onlyVerbs=create
// LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
type LocalSubjectAccessReview struct {
metav1.TypeMeta `json:",inline"`
// Action describes the action being tested. The Namespace element is FORCED to the current namespace.
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
// User is optional. If both User and Groups are empty, the current authenticated user is used.
User string `json:"user" protobuf:"bytes,2,opt,name=user"`
// Groups is optional. Groups is the list of groups to which the User belongs.
// +k8s:conversion-gen=false
GroupsSlice []string `json:"groups" protobuf:"bytes,3,rep,name=groups"`
// Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups".
// Nil for a self-SAR, means "use the scopes on this request".
// Nil for a regular SAR, means the same as empty.
// +k8s:conversion-gen=false
Scopes OptionalScopes `json:"scopes" protobuf:"bytes,4,rep,name=scopes"`
}
// Action describes a request to the API server
type Action struct {
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
// Verb is one of: get, list, watch, create, update, delete
Verb string `json:"verb" protobuf:"bytes,2,opt,name=verb"`
// Group is the API group of the resource
// Serialized as resourceAPIGroup to avoid confusion with the 'groups' field when inlined
Group string `json:"resourceAPIGroup" protobuf:"bytes,3,opt,name=resourceAPIGroup"`
// Version is the API version of the resource
// Serialized as resourceAPIVersion to avoid confusion with TypeMeta.apiVersion and ObjectMeta.resourceVersion when inlined
Version string `json:"resourceAPIVersion" protobuf:"bytes,4,opt,name=resourceAPIVersion"`
// Resource is one of the existing resource types
Resource string `json:"resource" protobuf:"bytes,5,opt,name=resource"`
// ResourceName is the name of the resource being requested for a "get" or deleted for a "delete"
ResourceName string `json:"resourceName" protobuf:"bytes,6,opt,name=resourceName"`
// Path is the path of a non resource URL
Path string `json:"path" protobuf:"bytes,8,opt,name=path"`
// IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hieraarchy)
IsNonResourceURL bool `json:"isNonResourceURL" protobuf:"varint,9,opt,name=isNonResourceURL"`
// Content is the actual content of the request for create and update
Content kruntime.RawExtension `json:"content,omitempty" protobuf:"bytes,7,opt,name=content"`
}
// PolicyList is a collection of Policies
type PolicyList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of Policies
Items []Policy `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// PolicyBindingList is a collection of PolicyBindings
type PolicyBindingList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of PolicyBindings
Items []PolicyBinding `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// RoleBindingList is a collection of RoleBindings
type RoleBindingList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of RoleBindings
Items []RoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// RoleList is a collection of Roles
type RoleList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of Roles
Items []Role `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// +genclient
// +genclient:nonNamespaced
// ClusterRole is a logical grouping of PolicyRules that can be referenced as a unit by ClusterRoleBindings.
type ClusterRole struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Rules holds all the PolicyRules for this ClusterRole
Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
}
// +genclient
// +genclient:nonNamespaced
// ClusterRoleBinding references a ClusterRole, but not contain it. It can reference any ClusterRole in the same namespace or in the global namespace.
// It adds who information via (Users and Groups) OR Subjects and namespace information by which namespace it exists in.
// ClusterRoleBindings in a given namespace only have effect in that namespace (excepting the master namespace which has power in all namespaces).
type ClusterRoleBinding struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// UserNames holds all the usernames directly bound to the role.
// This field should only be specified when supporting legacy clients and servers.
// See Subjects for further details.
// +k8s:conversion-gen=false
UserNames OptionalNames `json:"userNames" protobuf:"bytes,2,rep,name=userNames"`
// GroupNames holds all the groups directly bound to the role.
// This field should only be specified when supporting legacy clients and servers.
// See Subjects for further details.
// +k8s:conversion-gen=false
GroupNames OptionalNames `json:"groupNames" protobuf:"bytes,3,rep,name=groupNames"`
// Subjects hold object references to authorize with this rule.
// This field is ignored if UserNames or GroupNames are specified to support legacy clients and servers.
// Thus newer clients that do not need to support backwards compatibility should send
// only fully qualified Subjects and should omit the UserNames and GroupNames fields.
// Clients that need to support backwards compatibility can use this field to build the UserNames and GroupNames.
Subjects []kapi.ObjectReference `json:"subjects" protobuf:"bytes,4,rep,name=subjects"`
// RoleRef can only reference the current namespace and the global namespace.
// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.
// Since Policy is a singleton, this is sufficient knowledge to locate a role.
RoleRef kapi.ObjectReference `json:"roleRef" protobuf:"bytes,5,opt,name=roleRef"`
}
type NamedClusterRoles []NamedClusterRole
// +genclient
// +genclient:nonNamespaced
// ClusterPolicy is a object that holds all the ClusterRoles for a particular namespace. There is at most
// one ClusterPolicy document per namespace.
type ClusterPolicy struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// LastModified is the last time that any part of the ClusterPolicy was created, updated, or deleted
LastModified metav1.Time `json:"lastModified" protobuf:"bytes,2,opt,name=lastModified"`
// Roles holds all the ClusterRoles held by this ClusterPolicy, mapped by ClusterRole.Name
Roles NamedClusterRoles `json:"roles" protobuf:"bytes,3,rep,name=roles"`
}
type NamedClusterRoleBindings []NamedClusterRoleBinding
// +genclient
// +genclient:nonNamespaced
// ClusterPolicyBinding is a object that holds all the ClusterRoleBindings for a particular namespace. There is
// one ClusterPolicyBinding document per referenced ClusterPolicy namespace
type ClusterPolicyBinding struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// LastModified is the last time that any part of the ClusterPolicyBinding was created, updated, or deleted
LastModified metav1.Time `json:"lastModified" protobuf:"bytes,2,opt,name=lastModified"`
// PolicyRef is a reference to the ClusterPolicy that contains all the ClusterRoles that this ClusterPolicyBinding's RoleBindings may reference
PolicyRef kapi.ObjectReference `json:"policyRef" protobuf:"bytes,3,opt,name=policyRef"`
// RoleBindings holds all the ClusterRoleBindings held by this ClusterPolicyBinding, mapped by ClusterRoleBinding.Name
RoleBindings NamedClusterRoleBindings `json:"roleBindings" protobuf:"bytes,4,rep,name=roleBindings"`
}
// NamedClusterRole relates a name with a cluster role
type NamedClusterRole struct {
// Name is the name of the cluster role
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
// Role is the cluster role being named
Role ClusterRole `json:"role" protobuf:"bytes,2,opt,name=role"`
}
// NamedClusterRoleBinding relates a name with a cluster role binding
type NamedClusterRoleBinding struct {
// Name is the name of the cluster role binding
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
// RoleBinding is the cluster role binding being named
RoleBinding ClusterRoleBinding `json:"roleBinding" protobuf:"bytes,2,opt,name=roleBinding"`
}
// ClusterPolicyList is a collection of ClusterPolicies
type ClusterPolicyList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of ClusterPolicies
Items []ClusterPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// ClusterPolicyBindingList is a collection of ClusterPolicyBindings
type ClusterPolicyBindingList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of ClusterPolicyBindings
Items []ClusterPolicyBinding `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// ClusterRoleBindingList is a collection of ClusterRoleBindings
type ClusterRoleBindingList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of ClusterRoleBindings
Items []ClusterRoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// ClusterRoleList is a collection of ClusterRoles
type ClusterRoleList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of ClusterRoles
Items []ClusterRole `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// +genclient
// RoleBindingRestriction is an object that can be matched against a subject
// (user, group, or service account) to determine whether rolebindings on that
// subject are allowed in the namespace to which the RoleBindingRestriction
// belongs. If any one of those RoleBindingRestriction objects matches
// a subject, rolebindings on that subject in the namespace are allowed.
type RoleBindingRestriction struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ObjectMeta `json:"metadata" protobuf:"bytes,1,opt,name=metadata"`
// Spec defines the matcher.
Spec RoleBindingRestrictionSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
}
// RoleBindingRestrictionSpec defines a rolebinding restriction. Exactly one
// field must be non-nil.
type RoleBindingRestrictionSpec struct {
// UserRestriction matches against user subjects.
UserRestriction *UserRestriction `json:"userrestriction" protobuf:"bytes,1,opt,name=userrestriction"`
// GroupRestriction matches against group subjects.
GroupRestriction *GroupRestriction `json:"grouprestriction" protobuf:"bytes,2,opt,name=grouprestriction"`
// ServiceAccountRestriction matches against service-account subjects.
ServiceAccountRestriction *ServiceAccountRestriction `json:"serviceaccountrestriction" protobuf:"bytes,3,opt,name=serviceaccountrestriction"`
}
// RoleBindingRestrictionList is a collection of RoleBindingRestriction objects.
type RoleBindingRestrictionList struct {
metav1.TypeMeta `json:",inline"`
// Standard object's metadata.
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of RoleBindingRestriction objects.
Items []RoleBindingRestriction `json:"items" protobuf:"bytes,2,rep,name=items"`
}
// UserRestriction matches a user either by a string match on the user name,
// a string match on the name of a group to which the user belongs, or a label
// selector applied to the user labels.
type UserRestriction struct {
// Users specifies a list of literal user names.
Users []string `json:"users" protobuf:"bytes,1,rep,name=users"`
// Groups specifies a list of literal group names.
Groups []string `json:"groups" protobuf:"bytes,2,rep,name=groups"`
// Selectors specifies a list of label selectors over user labels.
Selectors []metav1.LabelSelector `json:"labels" protobuf:"bytes,3,rep,name=labels"`
}
// GroupRestriction matches a group either by a string match on the group name
// or a label selector applied to group labels.
type GroupRestriction struct {
// Groups is a list of groups used to match against an individual user's
// groups. If the user is a member of one of the whitelisted groups, the user
// is allowed to be bound to a role.
Groups []string `json:"groups" protobuf:"bytes,1,rep,name=groups"`
// Selectors specifies a list of label selectors over group labels.
Selectors []metav1.LabelSelector `json:"labels" protobuf:"bytes,2,rep,name=labels"`
}
// ServiceAccountRestriction matches a service account by a string match on
// either the service-account name or the name of the service account's
// namespace.
type ServiceAccountRestriction struct {
// ServiceAccounts specifies a list of literal service-account names.
ServiceAccounts []ServiceAccountReference `json:"serviceaccounts" protobuf:"bytes,1,rep,name=serviceaccounts"`
// Namespaces specifies a list of literal namespace names.
Namespaces []string `json:"namespaces" protobuf:"bytes,2,rep,name=namespaces"`
}
// ServiceAccountReference specifies a service account and namespace by their
// names.
type ServiceAccountReference struct {
// Name is the name of the service account.
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
// Namespace is the namespace of the service account. Service accounts from
// inside the whitelisted namespaces are allowed to be bound to roles. If
// Namespace is empty, then the namespace of the RoleBindingRestriction in
// which the ServiceAccountReference is embedded is used.
Namespace string `json:"namespace" protobuf:"bytes,2,opt,name=namespace"`
}