Matteo Scandolo | a428586 | 2020-12-01 18:10:10 -0800 | [diff] [blame] | 1 | /* |
| 2 | Copyright 2017 The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package v1 |
| 18 | |
| 19 | import ( |
| 20 | "fmt" |
| 21 | |
| 22 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 23 | ) |
| 24 | |
| 25 | // +genclient |
| 26 | // +genclient:nonNamespaced |
| 27 | // +genclient:onlyVerbs=create |
| 28 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 29 | |
| 30 | // SubjectAccessReview checks whether or not a user or group can perform an action. |
| 31 | type SubjectAccessReview struct { |
| 32 | metav1.TypeMeta `json:",inline"` |
| 33 | // +optional |
| 34 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 35 | |
| 36 | // Spec holds information about the request being evaluated |
| 37 | Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 38 | |
| 39 | // Status is filled in by the server and indicates whether the request is allowed or not |
| 40 | // +optional |
| 41 | Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 42 | } |
| 43 | |
| 44 | // +genclient |
| 45 | // +genclient:nonNamespaced |
| 46 | // +genclient:onlyVerbs=create |
| 47 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 48 | |
| 49 | // SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a |
| 50 | // spec.namespace means "in all namespaces". Self is a special case, because users should always be able |
| 51 | // to check whether they can perform an action |
| 52 | type SelfSubjectAccessReview struct { |
| 53 | metav1.TypeMeta `json:",inline"` |
| 54 | // +optional |
| 55 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 56 | |
| 57 | // Spec holds information about the request being evaluated. user and groups must be empty |
| 58 | Spec SelfSubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 59 | |
| 60 | // Status is filled in by the server and indicates whether the request is allowed or not |
| 61 | // +optional |
| 62 | Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 63 | } |
| 64 | |
| 65 | // +genclient |
| 66 | // +genclient:onlyVerbs=create |
| 67 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 68 | |
| 69 | // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. |
| 70 | // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions |
| 71 | // checking. |
| 72 | type LocalSubjectAccessReview struct { |
| 73 | metav1.TypeMeta `json:",inline"` |
| 74 | // +optional |
| 75 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 76 | |
| 77 | // Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace |
| 78 | // you made the request against. If empty, it is defaulted. |
| 79 | Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 80 | |
| 81 | // Status is filled in by the server and indicates whether the request is allowed or not |
| 82 | // +optional |
| 83 | Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 84 | } |
| 85 | |
| 86 | // ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface |
| 87 | type ResourceAttributes struct { |
| 88 | // Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces |
| 89 | // "" (empty) is defaulted for LocalSubjectAccessReviews |
| 90 | // "" (empty) is empty for cluster-scoped resources |
| 91 | // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview |
| 92 | // +optional |
| 93 | Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"` |
| 94 | // Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all. |
| 95 | // +optional |
| 96 | Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"` |
| 97 | // Group is the API Group of the Resource. "*" means all. |
| 98 | // +optional |
| 99 | Group string `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"` |
| 100 | // Version is the API Version of the Resource. "*" means all. |
| 101 | // +optional |
| 102 | Version string `json:"version,omitempty" protobuf:"bytes,4,opt,name=version"` |
| 103 | // Resource is one of the existing resource types. "*" means all. |
| 104 | // +optional |
| 105 | Resource string `json:"resource,omitempty" protobuf:"bytes,5,opt,name=resource"` |
| 106 | // Subresource is one of the existing resource types. "" means none. |
| 107 | // +optional |
| 108 | Subresource string `json:"subresource,omitempty" protobuf:"bytes,6,opt,name=subresource"` |
| 109 | // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all. |
| 110 | // +optional |
| 111 | Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"` |
| 112 | } |
| 113 | |
| 114 | // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface |
| 115 | type NonResourceAttributes struct { |
| 116 | // Path is the URL path of the request |
| 117 | // +optional |
| 118 | Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"` |
| 119 | // Verb is the standard HTTP verb |
| 120 | // +optional |
| 121 | Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"` |
| 122 | } |
| 123 | |
| 124 | // SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes |
| 125 | // and NonResourceAuthorizationAttributes must be set |
| 126 | type SubjectAccessReviewSpec struct { |
| 127 | // ResourceAuthorizationAttributes describes information for a resource access request |
| 128 | // +optional |
| 129 | ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"` |
| 130 | // NonResourceAttributes describes information for a non-resource access request |
| 131 | // +optional |
| 132 | NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"` |
| 133 | |
| 134 | // User is the user you're testing for. |
| 135 | // If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups |
| 136 | // +optional |
| 137 | User string `json:"user,omitempty" protobuf:"bytes,3,opt,name=user"` |
| 138 | // Groups is the groups you're testing for. |
| 139 | // +optional |
| 140 | Groups []string `json:"groups,omitempty" protobuf:"bytes,4,rep,name=groups"` |
| 141 | // Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer |
| 142 | // it needs a reflection here. |
| 143 | // +optional |
| 144 | Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,5,rep,name=extra"` |
| 145 | // UID information about the requesting user. |
| 146 | // +optional |
| 147 | UID string `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid"` |
| 148 | } |
| 149 | |
| 150 | // ExtraValue masks the value so protobuf can generate |
| 151 | // +protobuf.nullable=true |
| 152 | // +protobuf.options.(gogoproto.goproto_stringer)=false |
| 153 | type ExtraValue []string |
| 154 | |
| 155 | func (t ExtraValue) String() string { |
| 156 | return fmt.Sprintf("%v", []string(t)) |
| 157 | } |
| 158 | |
| 159 | // SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes |
| 160 | // and NonResourceAuthorizationAttributes must be set |
| 161 | type SelfSubjectAccessReviewSpec struct { |
| 162 | // ResourceAuthorizationAttributes describes information for a resource access request |
| 163 | // +optional |
| 164 | ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"` |
| 165 | // NonResourceAttributes describes information for a non-resource access request |
| 166 | // +optional |
| 167 | NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"` |
| 168 | } |
| 169 | |
| 170 | // SubjectAccessReviewStatus |
| 171 | type SubjectAccessReviewStatus struct { |
| 172 | // Allowed is required. True if the action would be allowed, false otherwise. |
| 173 | Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"` |
| 174 | // Denied is optional. True if the action would be denied, otherwise |
| 175 | // false. If both allowed is false and denied is false, then the |
| 176 | // authorizer has no opinion on whether to authorize the action. Denied |
| 177 | // may not be true if Allowed is true. |
| 178 | // +optional |
| 179 | Denied bool `json:"denied,omitempty" protobuf:"varint,4,opt,name=denied"` |
| 180 | // Reason is optional. It indicates why a request was allowed or denied. |
| 181 | // +optional |
| 182 | Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"` |
| 183 | // EvaluationError is an indication that some error occurred during the authorization check. |
| 184 | // It is entirely possible to get an error and be able to continue determine authorization status in spite of it. |
| 185 | // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request. |
| 186 | // +optional |
| 187 | EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,3,opt,name=evaluationError"` |
| 188 | } |
| 189 | |
| 190 | // +genclient |
| 191 | // +genclient:nonNamespaced |
| 192 | // +genclient:onlyVerbs=create |
| 193 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 194 | |
| 195 | // SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. |
| 196 | // The returned list of actions may be incomplete depending on the server's authorization mode, |
| 197 | // and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, |
| 198 | // or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to |
| 199 | // drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. |
| 200 | // SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server. |
| 201 | type SelfSubjectRulesReview struct { |
| 202 | metav1.TypeMeta `json:",inline"` |
| 203 | // +optional |
| 204 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 205 | |
| 206 | // Spec holds information about the request being evaluated. |
| 207 | Spec SelfSubjectRulesReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 208 | |
| 209 | // Status is filled in by the server and indicates the set of actions a user can perform. |
| 210 | // +optional |
| 211 | Status SubjectRulesReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 212 | } |
| 213 | |
| 214 | type SelfSubjectRulesReviewSpec struct { |
| 215 | // Namespace to evaluate rules for. Required. |
| 216 | Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"` |
| 217 | } |
| 218 | |
| 219 | // SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on |
| 220 | // the set of authorizers the server is configured with and any errors experienced during evaluation. |
| 221 | // Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, |
| 222 | // even if that list is incomplete. |
| 223 | type SubjectRulesReviewStatus struct { |
| 224 | // ResourceRules is the list of actions the subject is allowed to perform on resources. |
| 225 | // The list ordering isn't significant, may contain duplicates, and possibly be incomplete. |
| 226 | ResourceRules []ResourceRule `json:"resourceRules" protobuf:"bytes,1,rep,name=resourceRules"` |
| 227 | // NonResourceRules is the list of actions the subject is allowed to perform on non-resources. |
| 228 | // The list ordering isn't significant, may contain duplicates, and possibly be incomplete. |
| 229 | NonResourceRules []NonResourceRule `json:"nonResourceRules" protobuf:"bytes,2,rep,name=nonResourceRules"` |
| 230 | // Incomplete is true when the rules returned by this call are incomplete. This is most commonly |
| 231 | // encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation. |
| 232 | Incomplete bool `json:"incomplete" protobuf:"bytes,3,rep,name=incomplete"` |
| 233 | // EvaluationError can appear in combination with Rules. It indicates an error occurred during |
| 234 | // rule evaluation, such as an authorizer that doesn't support rule evaluation, and that |
| 235 | // ResourceRules and/or NonResourceRules may be incomplete. |
| 236 | // +optional |
| 237 | EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,4,opt,name=evaluationError"` |
| 238 | } |
| 239 | |
| 240 | // ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, |
| 241 | // may contain duplicates, and possibly be incomplete. |
| 242 | type ResourceRule struct { |
| 243 | // Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all. |
| 244 | Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"` |
| 245 | |
| 246 | // APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of |
| 247 | // the enumerated resources in any API group will be allowed. "*" means all. |
| 248 | // +optional |
| 249 | APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"` |
| 250 | // Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups. |
| 251 | // "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups. |
| 252 | // +optional |
| 253 | Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` |
| 254 | // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all. |
| 255 | // +optional |
| 256 | ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"` |
| 257 | } |
| 258 | |
| 259 | // NonResourceRule holds information that describes a rule for the non-resource |
| 260 | type NonResourceRule struct { |
| 261 | // Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all. |
| 262 | Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"` |
| 263 | |
| 264 | // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, |
| 265 | // final step in the path. "*" means all. |
| 266 | // +optional |
| 267 | NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,2,rep,name=nonResourceURLs"` |
| 268 | } |