Matteo Scandolo | a428586 | 2020-12-01 18:10:10 -0800 | [diff] [blame^] | 1 | /* |
| 2 | Copyright 2017 The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package v1beta1 |
| 18 | |
| 19 | import ( |
| 20 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 21 | ) |
| 22 | |
| 23 | // Authorization is calculated against |
| 24 | // 1. evaluation of ClusterRoleBindings - short circuit on match |
| 25 | // 2. evaluation of RoleBindings in the namespace requested - short circuit on match |
| 26 | // 3. deny by default |
| 27 | |
| 28 | const ( |
| 29 | APIGroupAll = "*" |
| 30 | ResourceAll = "*" |
| 31 | VerbAll = "*" |
| 32 | NonResourceAll = "*" |
| 33 | |
| 34 | GroupKind = "Group" |
| 35 | ServiceAccountKind = "ServiceAccount" |
| 36 | UserKind = "User" |
| 37 | |
| 38 | // AutoUpdateAnnotationKey is the name of an annotation which prevents reconciliation if set to "false" |
| 39 | AutoUpdateAnnotationKey = "rbac.authorization.kubernetes.io/autoupdate" |
| 40 | ) |
| 41 | |
| 42 | // Authorization is calculated against |
| 43 | // 1. evaluation of ClusterRoleBindings - short circuit on match |
| 44 | // 2. evaluation of RoleBindings in the namespace requested - short circuit on match |
| 45 | // 3. deny by default |
| 46 | |
| 47 | // PolicyRule holds information that describes a policy rule, but does not contain information |
| 48 | // about who the rule applies to or which namespace the rule applies to. |
| 49 | type PolicyRule struct { |
| 50 | // Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds. |
| 51 | Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"` |
| 52 | |
| 53 | // APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of |
| 54 | // the enumerated resources in any API group will be allowed. |
| 55 | // +optional |
| 56 | APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"` |
| 57 | // Resources is a list of resources this rule applies to. '*' represents all resources in the specified apiGroups. |
| 58 | // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups. |
| 59 | // +optional |
| 60 | Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` |
| 61 | // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. |
| 62 | // +optional |
| 63 | ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"` |
| 64 | |
| 65 | // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path |
| 66 | // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. |
| 67 | // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both. |
| 68 | // +optional |
| 69 | NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,5,rep,name=nonResourceURLs"` |
| 70 | } |
| 71 | |
| 72 | // Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, |
| 73 | // or a value for non-objects such as user and group names. |
| 74 | type Subject struct { |
| 75 | // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". |
| 76 | // If the Authorizer does not recognized the kind value, the Authorizer should report an error. |
| 77 | Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"` |
| 78 | // APIGroup holds the API group of the referenced subject. |
| 79 | // Defaults to "" for ServiceAccount subjects. |
| 80 | // Defaults to "rbac.authorization.k8s.io" for User and Group subjects. |
| 81 | // +optional |
| 82 | APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,2,opt.name=apiGroup"` |
| 83 | // Name of the object being referenced. |
| 84 | Name string `json:"name" protobuf:"bytes,3,opt,name=name"` |
| 85 | // Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty |
| 86 | // the Authorizer should report an error. |
| 87 | // +optional |
| 88 | Namespace string `json:"namespace,omitempty" protobuf:"bytes,4,opt,name=namespace"` |
| 89 | } |
| 90 | |
| 91 | // RoleRef contains information that points to the role being used |
| 92 | type RoleRef struct { |
| 93 | // APIGroup is the group for the resource being referenced |
| 94 | APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"` |
| 95 | // Kind is the type of resource being referenced |
| 96 | Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"` |
| 97 | // Name is the name of resource being referenced |
| 98 | Name string `json:"name" protobuf:"bytes,3,opt,name=name"` |
| 99 | } |
| 100 | |
| 101 | // +genclient |
| 102 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 103 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 104 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 105 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 106 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,Role |
| 107 | |
| 108 | // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. |
| 109 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22. |
| 110 | type Role struct { |
| 111 | metav1.TypeMeta `json:",inline"` |
| 112 | // Standard object's metadata. |
| 113 | // +optional |
| 114 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 115 | |
| 116 | // Rules holds all the PolicyRules for this Role |
| 117 | // +optional |
| 118 | Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"` |
| 119 | } |
| 120 | |
| 121 | // +genclient |
| 122 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 123 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 124 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 125 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 126 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleBinding |
| 127 | |
| 128 | // RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. |
| 129 | // It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given |
| 130 | // namespace only have effect in that namespace. |
| 131 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22. |
| 132 | type RoleBinding struct { |
| 133 | metav1.TypeMeta `json:",inline"` |
| 134 | // Standard object's metadata. |
| 135 | // +optional |
| 136 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 137 | |
| 138 | // Subjects holds references to the objects the role applies to. |
| 139 | // +optional |
| 140 | Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"` |
| 141 | |
| 142 | // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. |
| 143 | // If the RoleRef cannot be resolved, the Authorizer must return an error. |
| 144 | RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"` |
| 145 | } |
| 146 | |
| 147 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 148 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 149 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 150 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 151 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleBindingList |
| 152 | |
| 153 | // RoleBindingList is a collection of RoleBindings |
| 154 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22. |
| 155 | type RoleBindingList struct { |
| 156 | metav1.TypeMeta `json:",inline"` |
| 157 | // Standard object's metadata. |
| 158 | // +optional |
| 159 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 160 | |
| 161 | // Items is a list of RoleBindings |
| 162 | Items []RoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 163 | } |
| 164 | |
| 165 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 166 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 167 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 168 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 169 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleList |
| 170 | |
| 171 | // RoleList is a collection of Roles |
| 172 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22. |
| 173 | type RoleList struct { |
| 174 | metav1.TypeMeta `json:",inline"` |
| 175 | // Standard object's metadata. |
| 176 | // +optional |
| 177 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 178 | |
| 179 | // Items is a list of Roles |
| 180 | Items []Role `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 181 | } |
| 182 | |
| 183 | // +genclient |
| 184 | // +genclient:nonNamespaced |
| 185 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 186 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 187 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 188 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 189 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRole |
| 190 | |
| 191 | // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. |
| 192 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22. |
| 193 | type ClusterRole struct { |
| 194 | metav1.TypeMeta `json:",inline"` |
| 195 | // Standard object's metadata. |
| 196 | // +optional |
| 197 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 198 | |
| 199 | // Rules holds all the PolicyRules for this ClusterRole |
| 200 | // +optional |
| 201 | Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"` |
| 202 | // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. |
| 203 | // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be |
| 204 | // stomped by the controller. |
| 205 | // +optional |
| 206 | AggregationRule *AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"` |
| 207 | } |
| 208 | |
| 209 | // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole |
| 210 | type AggregationRule struct { |
| 211 | // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. |
| 212 | // If any of the selectors match, then the ClusterRole's permissions will be added |
| 213 | // +optional |
| 214 | ClusterRoleSelectors []metav1.LabelSelector `json:"clusterRoleSelectors,omitempty" protobuf:"bytes,1,rep,name=clusterRoleSelectors"` |
| 215 | } |
| 216 | |
| 217 | // +genclient |
| 218 | // +genclient:nonNamespaced |
| 219 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 220 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 221 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 222 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 223 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleBinding |
| 224 | |
| 225 | // ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, |
| 226 | // and adds who information via Subject. |
| 227 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22. |
| 228 | type ClusterRoleBinding struct { |
| 229 | metav1.TypeMeta `json:",inline"` |
| 230 | // Standard object's metadata. |
| 231 | // +optional |
| 232 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 233 | |
| 234 | // Subjects holds references to the objects the role applies to. |
| 235 | // +optional |
| 236 | Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"` |
| 237 | |
| 238 | // RoleRef can only reference a ClusterRole in the global namespace. |
| 239 | // If the RoleRef cannot be resolved, the Authorizer must return an error. |
| 240 | RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"` |
| 241 | } |
| 242 | |
| 243 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 244 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 245 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 246 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 247 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleBindingList |
| 248 | |
| 249 | // ClusterRoleBindingList is a collection of ClusterRoleBindings. |
| 250 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22. |
| 251 | type ClusterRoleBindingList struct { |
| 252 | metav1.TypeMeta `json:",inline"` |
| 253 | // Standard object's metadata. |
| 254 | // +optional |
| 255 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 256 | |
| 257 | // Items is a list of ClusterRoleBindings |
| 258 | Items []ClusterRoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 259 | } |
| 260 | |
| 261 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 262 | // +k8s:prerelease-lifecycle-gen:introduced=1.6 |
| 263 | // +k8s:prerelease-lifecycle-gen:deprecated=1.17 |
| 264 | // +k8s:prerelease-lifecycle-gen:removed=1.22 |
| 265 | // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleList |
| 266 | |
| 267 | // ClusterRoleList is a collection of ClusterRoles. |
| 268 | // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22. |
| 269 | type ClusterRoleList struct { |
| 270 | metav1.TypeMeta `json:",inline"` |
| 271 | // Standard object's metadata. |
| 272 | // +optional |
| 273 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 274 | |
| 275 | // Items is a list of ClusterRoles |
| 276 | Items []ClusterRole `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 277 | } |