authorizer

package
v0.37.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 23, 2026 License: Apache-2.0 Imports: 15 Imported by: 2,483

Documentation

Index

Constants

View Source 
const MaxConditionsPerMap = 128

MaxConditionsPerMap is the maximum number of conditions allowed in a single ConditionsMap.

Variables

View Source 
var ErrorConditionEvaluationNotSupported = errors.New("condition evaluation not supported")

ErrorConditionEvaluationNotSupported is returned by authorizer implementations that do not support condition evaluation.

Functions

This section is empty.

Types

type AdmissionOperation added in v0.37.0 

type AdmissionOperation string

AdmissionOperation represents the admission operation, for example CREATE, UPDATE, DELETE. The constants are defined in k8s.io/apiserver/pkg/admission, but the type is defined here, because this package is more generic than the admission package (thus avoiding import cycles)

type Attributes 

type Attributes interface {
	// GetUser returns the user.Info object to authorize
	GetUser() user.Info

	// GetVerb returns the kube verb associated with API requests (this includes get, list, watch, create, update, patch, delete, deletecollection, and proxy),
	// or the lowercased HTTP verb associated with non-API requests (this includes get, put, post, patch, and delete)
	GetVerb() string

	// When IsReadOnly() == true, the request has no side effects, other than
	// caching, logging, and other incidentals.
	IsReadOnly() bool

	// The namespace of the object, if a request is for a REST object.
	GetNamespace() string

	// The kind of object, if a request is for a REST object.
	GetResource() string

	// GetSubresource returns the subresource being requested, if present
	GetSubresource() string

	// GetName returns the name of the object as parsed off the request.  This will not be present for all request types, but
	// will be present for: get, update, delete
	GetName() string

	// The group of the resource, if a request is for a REST object.
	GetAPIGroup() string

	// GetAPIVersion returns the version of the group requested, if a request is for a REST object.
	GetAPIVersion() string

	// IsResourceRequest returns true for requests to API resources, like /api/v1/nodes,
	// and false for non-resource endpoints like /api, /healthz
	IsResourceRequest() bool

	// GetPath returns the path of the request
	GetPath() string

	// ParseFieldSelector is lazy, thread-safe, and stores the parsed result and error.
	// It returns an error if the field selector cannot be parsed.
	// The returned requirements must be treated as readonly and not modified.
	GetFieldSelector() (fields.Requirements, error)

	// ParseLabelSelector is lazy, thread-safe, and stores the parsed result and error.
	// It returns an error if the label selector cannot be parsed.
	// The returned requirements must be treated as readonly and not modified.
	GetLabelSelector() (labels.Requirements, error)
}

Attributes is an interface used by an Authorizer to get information about a request's metadata, that is used to compute an unconditional or conditional authorization decision.

type AttributesRecord 

type AttributesRecord struct {
	User            user.Info
	Verb            string
	Namespace       string
	APIGroup        string
	APIVersion      string
	Resource        string
	Subresource     string
	Name            string
	ResourceRequest bool
	Path            string

	FieldSelectorRequirements fields.Requirements
	FieldSelectorParsingErr   error
	LabelSelectorRequirements labels.Requirements
	LabelSelectorParsingErr   error
}

AttributesRecord implements Attributes interface.

func (AttributesRecord) GetAPIGroup 

func (a AttributesRecord) GetAPIGroup() string

func (AttributesRecord) GetAPIVersion 

func (a AttributesRecord) GetAPIVersion() string

func (AttributesRecord) GetFieldSelector added in v0.31.0 

func (a AttributesRecord) GetFieldSelector() (fields.Requirements, error)

func (AttributesRecord) GetLabelSelector added in v0.31.0 

func (a AttributesRecord) GetLabelSelector() (labels.Requirements, error)

func (AttributesRecord) GetName 

func (a AttributesRecord) GetName() string

func (AttributesRecord) GetNamespace 

func (a AttributesRecord) GetNamespace() string

func (AttributesRecord) GetPath 

func (a AttributesRecord) GetPath() string

func (AttributesRecord) GetResource 

func (a AttributesRecord) GetResource() string

func (AttributesRecord) GetSubresource 

func (a AttributesRecord) GetSubresource() string

func (AttributesRecord) GetUser 

func (a AttributesRecord) GetUser() user.Info

func (AttributesRecord) GetVerb 

func (a AttributesRecord) GetVerb() string

func (AttributesRecord) IsReadOnly 

func (a AttributesRecord) IsReadOnly() bool

func (AttributesRecord) IsResourceRequest 

func (a AttributesRecord) IsResourceRequest() bool

type Authorizer 

type Authorizer interface {
	UnconditionalAuthorizer

	// ConditionsAwareAuthorize returns an unconditional, conditional, or unioned
	// decision, where the error and reason is part of the Decision struct.
	//
	// An authorizer who is not conditions-aware MUST implement this function as
	// "return authorizer.ConditionsAwareDecisionFromParts(self.Authorize(ctx, a))",
	// such that conditions-aware callers to this authorizer get the same output
	// as if they called Authorize. Callers are only expected to call one of
	// Authorize or ConditionsAwareAuthorize, not both.
	ConditionsAwareAuthorize(ctx context.Context, a Attributes) ConditionsAwareDecision

	// EvaluateConditions evaluates a conditional or unioned ConditionsAwareDecision against previously-unknown data.
	//
	// An authorizer who does not support conditions should fail closed and
	// return authorizer.DecisionDeny, "", authorizer.ErrorConditionEvaluationNotSupported
	//
	// The context should only be used for timeouts/cancellation/tracing, and should not influence the
	// evaluation outcome. Only the given decision and data may infuence the outcome. data must be non-nil.
	EvaluateConditions(ctx context.Context, decision ConditionsAwareDecision, data ConditionsData) (authorized Decision, reason string, err error)
}

Authorizer makes an authorization decision based on information gained by making zero or more calls to methods of the Attributes interface. It might return an error together with any decision. It is up to the caller to decide whether that error is critical or not.

The kube-apiserver WithAuthorization filter ignores errors when the decision is Allow, but returns response code 500 if an error is returned with a Deny or NoOpinion (instead of the usual 403).

Any authorizer must implement this interface, but when passing a handle to an authorizer, one might choose whether to pass the Authorizer or smaller UnconditionalAuthorizer interface, depending on whether the receiver should be able to perform conditional authorization or not.

type AuthorizerFunc 

type AuthorizerFunc func(ctx context.Context, a Attributes) (Decision, string, error)

func (AuthorizerFunc) Authorize 

func (f AuthorizerFunc) Authorize(ctx context.Context, a Attributes) (Decision, string, error)

func (AuthorizerFunc) ConditionsAwareAuthorize added in v0.37.0 

func (f AuthorizerFunc) ConditionsAwareAuthorize(ctx context.Context, a Attributes) ConditionsAwareDecision

func (AuthorizerFunc) EvaluateConditions added in v0.37.0 

func (f AuthorizerFunc) EvaluateConditions(_ context.Context, _ ConditionsAwareDecision, _ ConditionsData) (Decision, string, error)

type Condition added in v0.37.0 

type Condition interface {
	// GetID uniquely identifies this condition within the scope of the authorizer
	// that authored it. Validated as a Kubernetes label key.
	// Any domain of form *.k8s.io or *.kubernetes.io is reserved for Kubernetes use.
	// Required.
	GetID() string

	// GetType describes the type of the condition, if there are multiple possibilities.
	// Should be formatted as a Kubernetes label key.
	// Any domain of form *.k8s.io or *.kubernetes.io is reserved for Kubernetes use.
	// Optional. Can be omitted if the authorizer already knows how to evaluate the condition.
	GetType() string

	// GetCondition returns a string encoding of the condition to be evaluated.
	// It is a pure, deterministic function from ConditionsData to a boolean (or error).
	// Might or might not be human-readable.
	// Optional, if the ID alone is enough for the authorizer to know how to evaluate the condition.
	GetCondition() string

	// GetDescription is an optional human-friendly description that can be shown
	// as an error message or for debugging. Optional.
	GetDescription() string

	// Evaluate evaluates the condition to a boolean, returns an error, or returns "unevaluatable".
	// If an authorizer already has a pre-compiled condition, this avoids one serialization roundtrip,
	// with potentially expensive deserialization/parsing. However, if the condition underwent a
	// serialize/deserialize roundtrip (e.g. when the caller is an aggregated API server), the authorizer
	// might have to evaluate the condition from its serialized form using evaluateFunc in
	// ConditionsMap.Evaluate.
	// Evaluate must be safe to call repeatedly and concurrently.
	//
	// The context should only be used for timeouts/cancellation/tracing, and should not influence the
	// evaluation outcome. Only the condition itself and data can infuence the outcome.
	Evaluate(ctx context.Context, data ConditionsData) ConditionEvaluationResult
}

Condition represents one authorization condition that is part of a ConditionsMap. The effect of a condition is defined by whether it is part of the Deny/NoOpinion/Allow conditions list in the ConditionsMap.

A Condition must be immutable and thread-safe.

type ConditionEvaluationResult added in v0.37.0 

type ConditionEvaluationResult struct {
	// contains filtered or unexported fields
}

ConditionEvaluationResult is an enum type with four variants: - true and false: Evaluation was successful, and evaluated to this value - error: The condition could be evaluated, but errored during eval. - unevaluatable: The condition cannot readily be evaluated. This is the struct zero value.

func ConditionEvaluationResultBoolean added in v0.37.0 

func ConditionEvaluationResultBoolean(evalResult bool) ConditionEvaluationResult

ConditionEvaluationResultBoolean constructs an evaluation result with a boolean value.

func ConditionEvaluationResultError added in v0.37.0 

func ConditionEvaluationResultError(err error) ConditionEvaluationResult

ConditionEvaluationResultError indicates that the condition could be evaluated, but failed.

func ConditionsEvaluationResultUnevaluatable added in v0.37.0 

func ConditionsEvaluationResultUnevaluatable() ConditionEvaluationResult

ConditionsEvaluationResultUnevaluatable indicates direct conditions evaluation is not possible.

func (ConditionEvaluationResult) Error added in v0.37.0 

func (r ConditionEvaluationResult) Error() error

Error returns the evaluation error, if any.

func (ConditionEvaluationResult) IsError added in v0.37.0 

func (r ConditionEvaluationResult) IsError() bool

IsError indicates whether conditions evaluation failed.

func (ConditionEvaluationResult) IsFalse added in v0.37.0 

func (r ConditionEvaluationResult) IsFalse() bool

IsFalse indicates that the conditions evaluation was successful, but evaluated to false, and it not thus taken into account.

func (ConditionEvaluationResult) IsTrue added in v0.37.0 

func (r ConditionEvaluationResult) IsTrue() bool

IsTrue indicates that the conditions evaluation was successful, and evaluated to true, which means it influences the ConditionsMap decision.

func (ConditionEvaluationResult) IsUnevaluatable added in v0.37.0 

func (r ConditionEvaluationResult) IsUnevaluatable() bool

IsUnevaluatable is true whenever none of the other variants is, that is, the zero value.

type ConditionsAwareDecision added in v0.37.0 

type ConditionsAwareDecision struct {
	// contains filtered or unexported fields
}

ConditionsAwareDecision models an authorization decision that is conditions-aware. It is an enum type of the following five variants: - Allow: unconditional Allow. - Deny: unconditional Deny. - NoOpinion: unconditional NoOpinion. - Conditional: conditional on some previously-unseen data. - Union: an ordered list of sub-decisions, which forms a tree of decisions.

The zero value (ConditionsAwareDecision{}) is equivalent to ConditionsAwareDecisionDeny(). A ConditionsAwareDecision is passed by value. Important: A ConditionsAwareDecision is immutable after construction.

func ConditionsAwareDecisionAllow added in v0.37.0 

func ConditionsAwareDecisionAllow(reason string, err error) ConditionsAwareDecision

ConditionsAwareDecisionAllow constructs an Allow decision with the given reason and error.

func ConditionsAwareDecisionConditionsMap added in v0.37.0 

func ConditionsAwareDecisionConditionsMap(denyConditions []Condition, noOpinionConditions []Condition, allowConditions []Condition) ConditionsAwareDecision

ConditionsAwareDecisionConditionsMap creates a ConditionsMap decision. The conditions are grouped by their effects: Deny, NoOpinion and Allow, that function as follows:

  • Deny: If a Deny condition evaluates to true, the ConditionsMap necessarily evaluates to Deny. In this case, no further authorizers are consulted.
  • NoOpinion: If a NoOpinion condition evaluates to true, the given authorizer's ConditionsMap cannot evaluate to Allow anymore, but necessarily Deny or NoOpinion, depending on whether there are any true Deny conditions. However, later authorizers in the chain can still Allow or Deny. It is effectively a softer deny that just overrides the authorizer's own allow policies.
  • Allow: If any Allow condition evaluates to true, the ConditionsMap evaluates to Allow, unless any Deny/NoOpinion condition also evaluates to true (in which case the Deny/NoOpinion conditions have precedence).

All conditions must be non-nil, this function panics if any condition is nil.

func ConditionsAwareDecisionDeny added in v0.37.0 

func ConditionsAwareDecisionDeny(reason string, err error) ConditionsAwareDecision

ConditionsAwareDecisionDeny constructs a Deny decision with the given reason and error.

func ConditionsAwareDecisionFromParts added in v0.37.0 

func ConditionsAwareDecisionFromParts(unconditional Decision, reason string, err error) ConditionsAwareDecision

ConditionsAwareDecisionFromParts is meant to be used by conditions-unaware Authorizer implementations in order to implement ConditionsAwareAuthorize as: "return authorizer.ConditionsAwareDecisionFromParts(self.Authorize(ctx, a))"

func ConditionsAwareDecisionNoOpinion added in v0.37.0 

func ConditionsAwareDecisionNoOpinion(reason string, err error) ConditionsAwareDecision

ConditionsAwareDecisionNoOpinion constructs a NoOpinion decision with the given reason and error.

func PartiallyEvaluateConditionsAwareDecision added in v0.37.0 

func PartiallyEvaluateConditionsAwareDecision(ctx context.Context, unevaluatedDecision ConditionsAwareDecision, data ConditionsData, evaluateConditionFn MaybeEvaluateConditionFunc) ConditionsAwareDecision

PartiallyEvaluateConditionsAwareDecision evaluates the ConditionsAwareDecision primarily using any conditions' own Evaluate() function, and secondarily/optionally using evaluateConditionFn, if set. If evaluateConditionFn is non-nil and never returns ConditionsEvaluationResultUnevaluatable, the returned decision is guaranteed to be Allow/Deny/NoOpinion. However, this method can also be used to evaluate a subset of the conditions (e.g. for builtin conditions evaluators that only support a certain conditions type), returning ConditionsEvaluationResultUnevaluatable for conditions that the evaluator does not recognize. In the latter case, a partially evaluated ConditionsAwareDecision is returned. When evaluating a ConditionsMap, only the first matching (true) condition short-circuits the process, in order for the evaluation to be as efficient as possible.

func (ConditionsAwareDecision) ConditionsMap added in v0.37.0 

func (d ConditionsAwareDecision) ConditionsMap() ConditionsMap

ConditionsMap returns the ConditionsMap, which is non-empty if and only if IsConditionsMap is true.

func (ConditionsAwareDecision) ContainsUnconditionalAllowOrDeny added in v0.37.0 

func (d ConditionsAwareDecision) ContainsUnconditionalAllowOrDeny() bool

ContainsUnconditionalAllowOrDeny returns true whether there union contains at least one Allow or Deny decision within the tree of decisions.

func (ConditionsAwareDecision) Error added in v0.37.0 

func (d ConditionsAwareDecision) Error() error

Error returns the error supplied when constructing an unconditional decision. Error is nil for conditional decisions.

func (ConditionsAwareDecision) FailureDecision added in v0.37.0 

func (d ConditionsAwareDecision) FailureDecision() Decision

FailureDecision returns either a Deny or NoOpinion decision that the caller can use if the caller encounters an unrecoverable error while processing a ConditionsAwareDecision. If this decision is or could evaluate to Deny this function returns DecisionDeny to the caller, in order to fail closed as a conservative approximation. Otherwise, NoOpinion is returned.

func (ConditionsAwareDecision) IsAllow added in v0.37.0 

func (d ConditionsAwareDecision) IsAllow() bool

IsAllow returns true if the decision is an unconditional Allow.

func (ConditionsAwareDecision) IsConditionsMap added in v0.37.0 

func (d ConditionsAwareDecision) IsConditionsMap() bool

IsConditionsMap returns true if the decision is a conditional response with a map of conditions to evaluate.

func (ConditionsAwareDecision) IsDeny added in v0.37.0 

func (d ConditionsAwareDecision) IsDeny() bool

IsDeny returns true if the decision is an unconditional Deny.

func (ConditionsAwareDecision) IsNoOpinion added in v0.37.0 

func (d ConditionsAwareDecision) IsNoOpinion() bool

IsNoOpinion returns true if the decision is an unconditional NoOpinion.

func (ConditionsAwareDecision) IsUnconditional added in v0.37.0 

func (d ConditionsAwareDecision) IsUnconditional() bool

IsUnconditional is true if d is Allow, Deny or NoOpinion.

func (ConditionsAwareDecision) IsUnion added in v0.37.0 

func (d ConditionsAwareDecision) IsUnion() bool

IsUnion returns true if the decision consists of other sub-decisions unioned together in a tree-like structure.

func (ConditionsAwareDecision) PossibleDecisions added in v0.37.0 

func (d ConditionsAwareDecision) PossibleDecisions() sets.Set[Decision]

PossibleDecisions details what are the possible decision outcomes of this ConditionsAwareDecision. The return value is a subset of {Allow, Deny, NoOpinion}, but never the empty set. If the set only contains a single value, it means the decision is unconditional.

func (ConditionsAwareDecision) Reason added in v0.37.0 

func (d ConditionsAwareDecision) Reason() string

Reason returns the reason supplied when constructing an unconditional decision. Reason is an empty string for conditional decisions.

func (ConditionsAwareDecision) String added in v0.37.0 

func (d ConditionsAwareDecision) String() string

String returns a human-readable representation of the decision.

func (ConditionsAwareDecision) UnionedDecisions added in v0.37.0 

func (d ConditionsAwareDecision) UnionedDecisions() iter.Seq2[string, ConditionsAwareDecision]

UnionedDecisions returns an iterator for unioned sub-decisions. This iterator is non-empty if and only if IsUnion() == true. Sub-decisions iteration order is preserved.

type ConditionsAwareDecisionUnion added in v0.37.0 

type ConditionsAwareDecisionUnion struct {
	// contains filtered or unexported fields
}

ConditionsAwareDecisionUnion is a builder struct for a Union-typed ConditionsAwareDecision. ConditionsAwareDecisionUnion is not thread-safe.

func (*ConditionsAwareDecisionUnion) Add added in v0.37.0 

func (unionMap *ConditionsAwareDecisionUnion) Add(conditionalAuthorizerName string, d ConditionsAwareDecision)

Add adds a named sub-decision to the current Union ConditionsAwareDecision builder. Add is a no-op if ContainsUnconditionalAllowOrDeny() is true, as adding decisions after an Allow or Deny will never change the final evaluated outcome. An error might be returned if the name is empty or a duplicate, the bool signifies whether the Add was a no-op. Add is not thread-safe.

func (*ConditionsAwareDecisionUnion) ContainsUnconditionalAllowOrDeny added in v0.37.0 

func (unionMap *ConditionsAwareDecisionUnion) ContainsUnconditionalAllowOrDeny() bool

ContainsUnconditionalAllowOrDeny returns true whether there union contains at least one Allow or Deny decision within the unioned decisions. ContainsUnconditionalAllowOrDeny is not thread-safe.

func (*ConditionsAwareDecisionUnion) FailureDecision added in v0.37.0 

func (unionMap *ConditionsAwareDecisionUnion) FailureDecision() Decision

FailureDecision returns either a Deny or NoOpinion decision that the caller can use if the caller encounters an unrecoverable error while processing a ConditionsAwareDecision. If this decision is or could evaluate to Deny this function returns DecisionDeny to the caller, in order to fail closed as a conservative approximation. Otherwise, NoOpinion is returned. FailureDecision is not thread-safe.

func (*ConditionsAwareDecisionUnion) PossibleDecisions added in v0.37.0 

func (unionMap *ConditionsAwareDecisionUnion) PossibleDecisions() sets.Set[Decision]

PossibleDecisions details what are the possible decision outcomes of this ConditionsAwareDecisionUnion. The return value is a subset of {Allow, Deny, NoOpinion}, but never the empty set. PossibleDecisions is not thread-safe.

func (*ConditionsAwareDecisionUnion) ToDecision added in v0.37.0 

func (unionMap *ConditionsAwareDecisionUnion) ToDecision() ConditionsAwareDecision

ConditionsAwareDecisionUnion unions some amount of decisions together into a tree structure, where Allow/Deny/NoOpinion/ConditionsMap decisions are leafs, and Union decisions are internal tree nodes. ToDecision is not thread-safe.

type ConditionsData added in v0.37.0 

type ConditionsData interface {
	// GetName returns the name of the object as presented in the request. On a CREATE operation, the client
	// may omit name and rely on the server to generate the name. If that is the case, this method will return
	// the empty string
	GetName() string
	// GetNamespace is the namespace associated with the request (if any)
	GetNamespace() string
	// GetResource is the name of the resource being requested. This is not the kind. For example: pods
	GetResource() schema.GroupVersionResource
	// GetSubresource is the name of the subresource being requested. This is a different resource, scoped to the parent resource, but it may have a different kind.
	// For instance, /pods has the resource "pods" and the kind "Pod", while /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod"
	// (because status operates on pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource "binding", and kind "Binding".
	GetSubresource() string
	// GetOperation is the operation being performed
	GetOperation() AdmissionOperation
	// GetOperationOptions is the options for the operation being performed
	GetOperationOptions() runtime.Object
	// IsDryRun indicates that modifications will definitely not be persisted for this request. This is to prevent
	// admission controllers with side effects and a method of reconciliation from being overwhelmed.
	// However, a value of false for this does not mean that the modification will be persisted, because it
	// could still be rejected by a subsequent validation step.
	IsDryRun() bool
	// GetObject is the object from the incoming request. Only populated for CREATE and UPDATE requests.
	GetObject() runtime.Object
	// GetOldObject is the existing object in storage. Only populated for UPDATE and DELETE requests.
	GetOldObject() runtime.Object
	// GetKind is the type of object being manipulated. For example: Pod
	GetKind() schema.GroupVersionKind
	// GetUserInfo is information about the requesting user
	GetUserInfo() user.Info
}

ConditionsData represents the data available for conditions to evaluate against. This is by design a subset of admission.Attributes.

type ConditionsMap added in v0.37.0 

type ConditionsMap struct {
	// contains filtered or unexported fields
}

ConditionsMap is a map of conditions, where each condition has a map-unique ID, is a function from ConditionsData -> bool and has Allow/Deny/NoOpinion effect. It must be constructed through ConditionsAwareDecisionConditionsMap. During construction, all conditions are validated.

func (ConditionsMap) AllowConditions added in v0.37.0 

func (c ConditionsMap) AllowConditions() iter.Seq[Condition]

AllowConditions returns the Allow conditions in this map. The conditions are returned in the same order as they were supplied to ConditionsAwareDecisionConditionsMap.

func (ConditionsMap) DenyConditions added in v0.37.0 

func (c ConditionsMap) DenyConditions() iter.Seq[Condition]

DenyConditions returns the Deny conditions in this map. The conditions are returned in the same order as they were supplied to ConditionsAwareDecisionConditionsMap.

func (ConditionsMap) Evaluate added in v0.37.0 

func (c ConditionsMap) Evaluate(ctx context.Context, data ConditionsData, evaluateConditionFn EvaluateConditionFunc) (Decision, string, error)

Evaluate evaluates the ConditionsMap primarily using the Conditions' own Evaluate() function, and secondarily using evaluateConditionFn, if set. The first matching (true) condition short-circuits the process, in order for the evaluation to be as efficient as possible.

func (ConditionsMap) FailureDecision added in v0.37.0 

func (c ConditionsMap) FailureDecision() Decision

FailureDecision returns either a Deny or NoOpinion decision that the caller can use if the caller encounters an unrecoverable error while processing a ConditionsAwareDecision. If this decision is or could evaluate to Deny this function returns DecisionDeny to the caller, in order to fail closed as a conservative approximation. Otherwise, NoOpinion is returned.

func (ConditionsMap) Length added in v0.37.0 

func (c ConditionsMap) Length() int

Length returns the number of elements in the map.

func (ConditionsMap) NoOpinionConditions added in v0.37.0 

func (c ConditionsMap) NoOpinionConditions() iter.Seq[Condition]

NoOpinionConditions returns the NoOpinion conditions in this map. The conditions are returned in the same order as they were supplied to ConditionsAwareDecisionConditionsMap.

func (ConditionsMap) PossibleDecisions added in v0.37.0 

func (c ConditionsMap) PossibleDecisions() sets.Set[Decision]

PossibleDecisions details what are the possible decision outcomes of this ConditionsAwareDecision. The return value is a subset of {Allow, Deny, NoOpinion}, but never the empty set. If the set only contains a single value, it means the decision is unconditional.

type Decision 

type Decision int

Decision represents an final, unconditional authorization decision. The zero value (0) of Decision is DecisionDeny. 

const (
	// DecisionDeny means that an authorizer decided to deny the action.
	DecisionDeny Decision = iota
	// DecisionAllow means that an authorizer decided to allow the action.
	DecisionAllow
	// DecisionNoOpinion means that an authorizer has no opinion on whether
	// to allow or deny an action. If there are multiple unioned authorizers,
	// this means that the request can thus get allowed by some later authorizer.
	DecisionNoOpinion
)

func (Decision) String added in v0.35.0 

func (d Decision) String() string

type DefaultNonResourceRuleInfo 

type DefaultNonResourceRuleInfo struct {
	Verbs           []string
	NonResourceURLs []string
}

DefaultNonResourceRuleInfo holds information that describes a rule for the non-resource

func (*DefaultNonResourceRuleInfo) GetNonResourceURLs 

func (i *DefaultNonResourceRuleInfo) GetNonResourceURLs() []string

func (*DefaultNonResourceRuleInfo) GetVerbs 

func (i *DefaultNonResourceRuleInfo) GetVerbs() []string

type DefaultResourceRuleInfo 

type DefaultResourceRuleInfo struct {
	Verbs         []string
	APIGroups     []string
	Resources     []string
	ResourceNames []string
}

DefaultResourceRuleInfo holds information that describes a rule for the resource

func (*DefaultResourceRuleInfo) GetAPIGroups 

func (i *DefaultResourceRuleInfo) GetAPIGroups() []string

func (*DefaultResourceRuleInfo) GetResourceNames 

func (i *DefaultResourceRuleInfo) GetResourceNames() []string

func (*DefaultResourceRuleInfo) GetResources 

func (i *DefaultResourceRuleInfo) GetResources() []string

func (*DefaultResourceRuleInfo) GetVerbs 

func (i *DefaultResourceRuleInfo) GetVerbs() []string

type EvaluateConditionFunc added in v0.37.0 

type EvaluateConditionFunc func(ctx context.Context, condition Condition, data ConditionsData) (bool, error)

EvaluateConditionFunc is a function that is able to concretely evaluate a condition to a boolean or error.

type GenericCondition added in v0.37.0 

type GenericCondition struct {
	ID           string
	Condition    string
	Type         string
	Description  string
	EvaluateFunc func(ctx context.Context, data ConditionsData) ConditionEvaluationResult
}

GenericCondition is a generic implementation of the Condition interface, with optional support for fast in-process conditions evaluation, by setting EvaluateFunc non-nil.

func (GenericCondition) Evaluate added in v0.37.0 

func (c GenericCondition) Evaluate(ctx context.Context, data ConditionsData) ConditionEvaluationResult

func (GenericCondition) GetCondition added in v0.37.0 

func (c GenericCondition) GetCondition() string

func (GenericCondition) GetDescription added in v0.37.0 

func (c GenericCondition) GetDescription() string

func (GenericCondition) GetID added in v0.37.0 

func (c GenericCondition) GetID() string

func (GenericCondition) GetType added in v0.37.0 

func (c GenericCondition) GetType() string

type MaybeEvaluateConditionFunc added in v0.37.0 

type MaybeEvaluateConditionFunc func(ctx context.Context, condition Condition, data ConditionsData) ConditionEvaluationResult

MaybeEvaluateConditionFunc allows potentially evaluating a condition, returning Unevaluatable if a truth value or error cannot be assigned.

type NonResourceRuleInfo 

type NonResourceRuleInfo interface {
	// GetVerbs returns a list of kubernetes resource API verbs.
	GetVerbs() []string
	// GetNonResourceURLs return a set of partial urls that a user should have access to.
	GetNonResourceURLs() []string
}

type RequestAttributesGetter 

type RequestAttributesGetter interface {
	GetRequestAttributes(user.Info, *http.Request) Attributes
}

RequestAttributesGetter provides a function that extracts Attributes from an http.Request

type ResourceRuleInfo 

type ResourceRuleInfo interface {
	// GetVerbs returns a list of kubernetes resource API verbs.
	GetVerbs() []string
	// GetAPIGroups return the names of the APIGroup that contains the resources.
	GetAPIGroups() []string
	// GetResources return a list of resources the rule applies to.
	GetResources() []string
	// GetResourceNames return a white list of names that the rule applies to.
	GetResourceNames() []string
}

type RuleResolver 

type RuleResolver interface {
	// RulesFor get the list of cluster wide rules, the list of rules in the specific namespace, incomplete status and errors.
	RulesFor(ctx context.Context, user user.Info, namespace string) ([]ResourceRuleInfo, []NonResourceRuleInfo, bool, error)
}

RuleResolver provides a mechanism for resolving the list of rules that apply to a given user within a namespace.

type UnconditionalAuthorizer added in v0.37.0 

type UnconditionalAuthorizer interface {
	Authorize(ctx context.Context, a Attributes) (authorized Decision, reason string, err error)
}

UnconditionalAuthorizer is a downscoped variant of Authorizer, which only gives the caller the ability to call the conditions-unaware Authorize method.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.