scopemetadata

package
v0.0.0-...-c355e20 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 27, 2019 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Index

Constants

View Source
const (
	UserInfo        = userIndicator + "info"
	UserAccessCheck = userIndicator + "check-access"

	// UserListScopedProjects gives explicit permission to see the projects that this token can see.
	UserListScopedProjects = userIndicator + "list-scoped-projects"

	// UserListAllProjects gives explicit permission to see the projects a user can see.  This is often used to prime secondary ACL systems
	// unrelated to openshift and to display projects for selection in a secondary UI.
	UserListAllProjects = userIndicator + "list-projects"
)

these must agree with the scope authorizer, but it's an API we cannot realistically change

Variables

ScopeDescribers map prefixes to a function that handles that prefix

Functions

func ClusterRoleEvaluatorHandles

func ClusterRoleEvaluatorHandles(scope string) bool

func ClusterRoleEvaluatorParseScope

func ClusterRoleEvaluatorParseScope(scope string) (string, string, bool, error)

ClusterRoleEvaluatorParseScope parses the requested scope, determining the requested role name, namespace, and if access to escalating objects is required. It will return an error if it doesn't parse cleanly

func UserEvaluatorHandles

func UserEvaluatorHandles(scope string) bool

func ValidateScopeRestrictions

func ValidateScopeRestrictions(client *oauthv1.OAuthClient, scopes ...string) error

func ValidateScopes

func ValidateScopes(scopes []string, fldPath *field.Path) field.ErrorList

Types

type ClusterRoleEvaluator

type ClusterRoleEvaluator struct{}

role:<clusterrole name>:<namespace to allow the cluster role, * means all>

func (ClusterRoleEvaluator) Describe

func (e ClusterRoleEvaluator) Describe(scope string) (string, string, error)

func (ClusterRoleEvaluator) Handles

func (ClusterRoleEvaluator) Handles(scope string) bool

func (ClusterRoleEvaluator) Validate

func (e ClusterRoleEvaluator) Validate(scope string) error

type ScopeDescriber

type ScopeDescriber interface {
	// Handles returns true if this evaluator can evaluate this scope
	Handles(scope string) bool
	// Validate returns an error if the scope is malformed
	Validate(scope string) error
	// Describe returns a description, warning (typically used to warn about escalation dangers), or an error if the scope is malformed
	Describe(scope string) (description string, warning string, err error)
}

ScopeDescriber takes a scope and returns metadata about it

type UserEvaluator

type UserEvaluator struct{}

user:<scope name>

func (UserEvaluator) Describe

func (UserEvaluator) Describe(scope string) (string, string, error)

func (UserEvaluator) Handles

func (UserEvaluator) Handles(scope string) bool

func (UserEvaluator) Validate

func (e UserEvaluator) Validate(scope string) error

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL