k8s_io_api_authorization_v1

type ExtraValue struct {
	Items []string `protobuf:"bytes,1,rep,name=items" json:"items,omitempty"`
}

type LocalSubjectAccessReview struct {
	// +optional
	Metadata *v1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata" json:"metadata,omitempty"`
	// Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
	// you made the request against.  If empty, it is defaulted.
	Spec *SubjectAccessReviewSpec `protobuf:"bytes,2,opt,name=spec" json:"spec,omitempty"`
	// Status is filled in by the server and indicates whether the request is allowed or not
	// +optional
	Status *SubjectAccessReviewStatus `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"`
}

type NonResourceAttributes struct {
	// Path is the URL path of the request
	// +optional
	Path string `protobuf:"bytes,1,opt,name=path" json:"path"`
	// Verb is the standard HTTP verb
	// +optional
	Verb string `protobuf:"bytes,2,opt,name=verb" json:"verb"`
}

type NonResourceRule struct {
	// Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.
	Verbs []string `protobuf:"bytes,1,rep,name=verbs" json:"verbs,omitempty"`
	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,
	// final step in the path.  "*" means all.
	// +optional
	NonResourceURLs []string `protobuf:"bytes,2,rep,name=nonResourceURLs" json:"nonResourceURLs,omitempty"`
}

type ResourceAttributes struct {
	// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
	// "" (empty) is defaulted for LocalSubjectAccessReviews
	// "" (empty) is empty for cluster-scoped resources
	// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
	// +optional
	Namespace string `protobuf:"bytes,1,opt,name=namespace" json:"namespace"`
	// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
	// +optional
	Verb string `protobuf:"bytes,2,opt,name=verb" json:"verb"`
	// Group is the API Group of the Resource.  "*" means all.
	// +optional
	Group string `protobuf:"bytes,3,opt,name=group" json:"group"`
	// Version is the API Version of the Resource.  "*" means all.
	// +optional
	Version string `protobuf:"bytes,4,opt,name=version" json:"version"`
	// Resource is one of the existing resource types.  "*" means all.
	// +optional
	Resource string `protobuf:"bytes,5,opt,name=resource" json:"resource"`
	// Subresource is one of the existing resource types.  "" means none.
	// +optional
	Subresource string `protobuf:"bytes,6,opt,name=subresource" json:"subresource"`
	// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
	// +optional
	Name string `protobuf:"bytes,7,opt,name=name" json:"name"`
}

type ResourceRule struct {
	// Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy.  "*" means all.
	Verbs []string `protobuf:"bytes,1,rep,name=verbs" json:"verbs,omitempty"`
	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
	// the enumerated resources in any API group will be allowed.  "*" means all.
	// +optional
	ApiGroups []string `protobuf:"bytes,2,rep,name=apiGroups" json:"apiGroups,omitempty"`
	// Resources is a list of resources this rule applies to.  "*" means all in the specified apiGroups.
	//  "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
	// +optional
	Resources []string `protobuf:"bytes,3,rep,name=resources" json:"resources,omitempty"`
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.  "*" means all.
	// +optional
	ResourceNames []string `protobuf:"bytes,4,rep,name=resourceNames" json:"resourceNames,omitempty"`
}

type SelfSubjectAccessReview struct {
	// +optional
	Metadata *v1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata" json:"metadata,omitempty"`
	// Spec holds information about the request being evaluated.  user and groups must be empty
	Spec *SelfSubjectAccessReviewSpec `protobuf:"bytes,2,opt,name=spec" json:"spec,omitempty"`
	// Status is filled in by the server and indicates whether the request is allowed or not
	// +optional
	Status *SubjectAccessReviewStatus `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"`
}

type SelfSubjectAccessReviewSpec struct {
	// ResourceAuthorizationAttributes describes information for a resource access request
	// +optional
	ResourceAttributes *ResourceAttributes `protobuf:"bytes,1,opt,name=resourceAttributes" json:"resourceAttributes,omitempty"`
	// NonResourceAttributes describes information for a non-resource access request
	// +optional
	NonResourceAttributes *NonResourceAttributes `protobuf:"bytes,2,opt,name=nonResourceAttributes" json:"nonResourceAttributes,omitempty"`
}

type SelfSubjectRulesReview struct {
	// +optional
	Metadata *v1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata" json:"metadata,omitempty"`
	// Spec holds information about the request being evaluated.
	Spec *SelfSubjectRulesReviewSpec `protobuf:"bytes,2,opt,name=spec" json:"spec,omitempty"`
	// Status is filled in by the server and indicates the set of actions a user can perform.
	// +optional
	Status *SubjectRulesReviewStatus `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"`
}

type SelfSubjectRulesReviewSpec struct {
	// Namespace to evaluate rules for. Required.
	Namespace string `protobuf:"bytes,1,opt,name=namespace" json:"namespace"`
}

type SubjectAccessReview struct {
	// +optional
	Metadata *v1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata" json:"metadata,omitempty"`
	// Spec holds information about the request being evaluated
	Spec *SubjectAccessReviewSpec `protobuf:"bytes,2,opt,name=spec" json:"spec,omitempty"`
	// Status is filled in by the server and indicates whether the request is allowed or not
	// +optional
	Status *SubjectAccessReviewStatus `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"`
}

type SubjectAccessReviewSpec struct {
	// ResourceAuthorizationAttributes describes information for a resource access request
	// +optional
	ResourceAttributes *ResourceAttributes `protobuf:"bytes,1,opt,name=resourceAttributes" json:"resourceAttributes,omitempty"`
	// NonResourceAttributes describes information for a non-resource access request
	// +optional
	NonResourceAttributes *NonResourceAttributes `protobuf:"bytes,2,opt,name=nonResourceAttributes" json:"nonResourceAttributes,omitempty"`
	// User is the user you're testing for.
	// If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
	// +optional
	User string `protobuf:"bytes,3,opt,name=user" json:"user"`
	// Groups is the groups you're testing for.
	// +optional
	Groups []string `protobuf:"bytes,4,rep,name=groups" json:"groups,omitempty"`
	// Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
	// it needs a reflection here.
	// +optional
	Extra map[string]*ExtraValue `` /* 130-byte string literal not displayed */
	// UID information about the requesting user.
	// +optional
	Uid string `protobuf:"bytes,6,opt,name=uid" json:"uid"`
}

type SubjectAccessReviewStatus struct {
	// Allowed is required. True if the action would be allowed, false otherwise.
	Allowed bool `protobuf:"varint,1,opt,name=allowed" json:"allowed"`
	// Denied is optional. True if the action would be denied, otherwise
	// false. If both allowed is false and denied is false, then the
	// authorizer has no opinion on whether to authorize the action. Denied
	// may not be true if Allowed is true.
	// +optional
	Denied bool `protobuf:"varint,4,opt,name=denied" json:"denied"`
	// Reason is optional.  It indicates why a request was allowed or denied.
	// +optional
	Reason string `protobuf:"bytes,2,opt,name=reason" json:"reason"`
	// EvaluationError is an indication that some error occurred during the authorization check.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
	// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
	// +optional
	EvaluationError string `protobuf:"bytes,3,opt,name=evaluationError" json:"evaluationError"`
}

type SubjectRulesReviewStatus struct {
	// ResourceRules is the list of actions the subject is allowed to perform on resources.
	// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
	ResourceRules []*ResourceRule `protobuf:"bytes,1,rep,name=resourceRules" json:"resourceRules,omitempty"`
	// NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
	// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
	NonResourceRules []*NonResourceRule `protobuf:"bytes,2,rep,name=nonResourceRules" json:"nonResourceRules,omitempty"`
	// Incomplete is true when the rules returned by this call are incomplete. This is most commonly
	// encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
	Incomplete bool `protobuf:"varint,3,opt,name=incomplete" json:"incomplete"`
	// EvaluationError can appear in combination with Rules. It indicates an error occurred during
	// rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
	// ResourceRules and/or NonResourceRules may be incomplete.
	// +optional
	EvaluationError string `protobuf:"bytes,4,opt,name=evaluationError" json:"evaluationError"`
}