basic

func (*NotAllowedError) Error ¶

func (e *NotAllowedError) Error() string

func (*SarValidator) CheckEscalation ¶

func (v *SarValidator) CheckEscalation(ctx context.Context, sa *workapiv1.ManifestWorkSubjectServiceAccount,
	gvr schema.GroupVersionResource, namespace, name string, obj *unstructured.Unstructured) error

CheckEscalation checks whether the sa is escalated to operate the gvr(RBAC) resources.

func (*SarValidator) CheckSubjectAccessReviews ¶

func (v *SarValidator) CheckSubjectAccessReviews(ctx context.Context, sa *workapiv1.ManifestWorkSubjectServiceAccount,
	gvr schema.GroupVersionResource, namespace, name string, ownedByTheWork bool) error

CheckSubjectAccessReviews checks if the sa has permission to operate the gvr resource by subjectAccessReview requests

func (*SarValidator) ExecutorBasicCheck ¶

func (v *SarValidator) ExecutorBasicCheck(executor *workapiv1.ManifestWorkExecutor) error

ExecutorBasicCheck do some basic checks for the executor

func (*SarValidator) Validate ¶

func (v *SarValidator) Validate(ctx context.Context, executor *workapiv1.ManifestWorkExecutor,
	gvr schema.GroupVersionResource, namespace, name string,
	ownedByTheWork bool, obj *unstructured.Unstructured) error

Validate checks whether the executor has permission to operate the specific gvr resource by sending sar requests to the api server.