Matteo Scandolo | a428586 | 2020-12-01 18:10:10 -0800 | [diff] [blame^] | 1 | /* |
| 2 | Copyright The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | |
| 18 | // This file was autogenerated by go-to-protobuf. Do not edit it manually! |
| 19 | |
| 20 | syntax = 'proto2'; |
| 21 | |
| 22 | package k8s.io.api.rbac.v1beta1; |
| 23 | |
| 24 | import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto"; |
| 25 | import "k8s.io/apimachinery/pkg/runtime/generated.proto"; |
| 26 | import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto"; |
| 27 | |
| 28 | // Package-wide variables from generator "generated". |
| 29 | option go_package = "v1beta1"; |
| 30 | |
| 31 | // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole |
| 32 | message AggregationRule { |
| 33 | // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. |
| 34 | // If any of the selectors match, then the ClusterRole's permissions will be added |
| 35 | // +optional |
| 36 | repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1; |
| 37 | } |
| 38 | |
| 39 | // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. |
| 40 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22. |
| 41 | message ClusterRole { |
| 42 | // Standard object's metadata. |
| 43 | // +optional |
| 44 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 45 | |
| 46 | // Rules holds all the PolicyRules for this ClusterRole |
| 47 | // +optional |
| 48 | repeated PolicyRule rules = 2; |
| 49 | |
| 50 | // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. |
| 51 | // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be |
| 52 | // stomped by the controller. |
| 53 | // +optional |
| 54 | optional AggregationRule aggregationRule = 3; |
| 55 | } |
| 56 | |
| 57 | // ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, |
| 58 | // and adds who information via Subject. |
| 59 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22. |
| 60 | message ClusterRoleBinding { |
| 61 | // Standard object's metadata. |
| 62 | // +optional |
| 63 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 64 | |
| 65 | // Subjects holds references to the objects the role applies to. |
| 66 | // +optional |
| 67 | repeated Subject subjects = 2; |
| 68 | |
| 69 | // RoleRef can only reference a ClusterRole in the global namespace. |
| 70 | // If the RoleRef cannot be resolved, the Authorizer must return an error. |
| 71 | optional RoleRef roleRef = 3; |
| 72 | } |
| 73 | |
| 74 | // ClusterRoleBindingList is a collection of ClusterRoleBindings. |
| 75 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22. |
| 76 | message ClusterRoleBindingList { |
| 77 | // Standard object's metadata. |
| 78 | // +optional |
| 79 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 80 | |
| 81 | // Items is a list of ClusterRoleBindings |
| 82 | repeated ClusterRoleBinding items = 2; |
| 83 | } |
| 84 | |
| 85 | // ClusterRoleList is a collection of ClusterRoles. |
| 86 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22. |
| 87 | message ClusterRoleList { |
| 88 | // Standard object's metadata. |
| 89 | // +optional |
| 90 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 91 | |
| 92 | // Items is a list of ClusterRoles |
| 93 | repeated ClusterRole items = 2; |
| 94 | } |
| 95 | |
| 96 | // PolicyRule holds information that describes a policy rule, but does not contain information |
| 97 | // about who the rule applies to or which namespace the rule applies to. |
| 98 | message PolicyRule { |
| 99 | // Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds. |
| 100 | repeated string verbs = 1; |
| 101 | |
| 102 | // APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of |
| 103 | // the enumerated resources in any API group will be allowed. |
| 104 | // +optional |
| 105 | repeated string apiGroups = 2; |
| 106 | |
| 107 | // Resources is a list of resources this rule applies to. '*' represents all resources in the specified apiGroups. |
| 108 | // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups. |
| 109 | // +optional |
| 110 | repeated string resources = 3; |
| 111 | |
| 112 | // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. |
| 113 | // +optional |
| 114 | repeated string resourceNames = 4; |
| 115 | |
| 116 | // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path |
| 117 | // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. |
| 118 | // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both. |
| 119 | // +optional |
| 120 | repeated string nonResourceURLs = 5; |
| 121 | } |
| 122 | |
| 123 | // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. |
| 124 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22. |
| 125 | message Role { |
| 126 | // Standard object's metadata. |
| 127 | // +optional |
| 128 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 129 | |
| 130 | // Rules holds all the PolicyRules for this Role |
| 131 | // +optional |
| 132 | repeated PolicyRule rules = 2; |
| 133 | } |
| 134 | |
| 135 | // RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. |
| 136 | // It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given |
| 137 | // namespace only have effect in that namespace. |
| 138 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22. |
| 139 | message RoleBinding { |
| 140 | // Standard object's metadata. |
| 141 | // +optional |
| 142 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 143 | |
| 144 | // Subjects holds references to the objects the role applies to. |
| 145 | // +optional |
| 146 | repeated Subject subjects = 2; |
| 147 | |
| 148 | // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. |
| 149 | // If the RoleRef cannot be resolved, the Authorizer must return an error. |
| 150 | optional RoleRef roleRef = 3; |
| 151 | } |
| 152 | |
| 153 | // RoleBindingList is a collection of RoleBindings |
| 154 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22. |
| 155 | message RoleBindingList { |
| 156 | // Standard object's metadata. |
| 157 | // +optional |
| 158 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 159 | |
| 160 | // Items is a list of RoleBindings |
| 161 | repeated RoleBinding items = 2; |
| 162 | } |
| 163 | |
| 164 | // RoleList is a collection of Roles |
| 165 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22. |
| 166 | message RoleList { |
| 167 | // Standard object's metadata. |
| 168 | // +optional |
| 169 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 170 | |
| 171 | // Items is a list of Roles |
| 172 | repeated Role items = 2; |
| 173 | } |
| 174 | |
| 175 | // RoleRef contains information that points to the role being used |
| 176 | message RoleRef { |
| 177 | // APIGroup is the group for the resource being referenced |
| 178 | optional string apiGroup = 1; |
| 179 | |
| 180 | // Kind is the type of resource being referenced |
| 181 | optional string kind = 2; |
| 182 | |
| 183 | // Name is the name of resource being referenced |
| 184 | optional string name = 3; |
| 185 | } |
| 186 | |
| 187 | // Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, |
| 188 | // or a value for non-objects such as user and group names. |
| 189 | message Subject { |
| 190 | // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". |
| 191 | // If the Authorizer does not recognized the kind value, the Authorizer should report an error. |
| 192 | optional string kind = 1; |
| 193 | |
| 194 | // APIGroup holds the API group of the referenced subject. |
| 195 | // Defaults to "" for ServiceAccount subjects. |
| 196 | // Defaults to "rbac.authorization.k8s.io" for User and Group subjects. |
| 197 | // +optional |
| 198 | optional string apiGroup = 2; |
| 199 | |
| 200 | // Name of the object being referenced. |
| 201 | optional string name = 3; |
| 202 | |
| 203 | // Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty |
| 204 | // the Authorizer should report an error. |
| 205 | // +optional |
| 206 | optional string namespace = 4; |
| 207 | } |
| 208 | |