Skip to content

Commit f7e0ecc

Browse files
deads2kdeads2k
committed
add other user rules review
1 parent a400f5a commit f7e0ecc

File tree

22 files changed

+601
-7261
lines changed

22 files changed

+601
-7261
lines changed

‎api/swagger-spec/oapi-v1.json

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18944,6 +18944,104 @@
1894418944
}
1894518945
]
1894618946
},
18947+
{
18948+
"path": "/oapi/v1/namespaces/{namespace}/subjectrulesreviews",
18949+
"description": "OpenShift REST API, version v1",
18950+
"operations": [
18951+
{
18952+
"type": "v1.SubjectRulesReview",
18953+
"method": "POST",
18954+
"summary": "create a SubjectRulesReview",
18955+
"nickname": "createNamespacedSubjectRulesReview",
18956+
"parameters": [
18957+
{
18958+
"type": "string",
18959+
"paramType": "query",
18960+
"name": "pretty",
18961+
"description": "If 'true', then the output is pretty printed.",
18962+
"required": false,
18963+
"allowMultiple": false
18964+
},
18965+
{
18966+
"type": "v1.SubjectRulesReview",
18967+
"paramType": "body",
18968+
"name": "body",
18969+
"description": "",
18970+
"required": true,
18971+
"allowMultiple": false
18972+
},
18973+
{
18974+
"type": "string",
18975+
"paramType": "path",
18976+
"name": "namespace",
18977+
"description": "object name and auth scope, such as for teams and projects",
18978+
"required": true,
18979+
"allowMultiple": false
18980+
}
18981+
],
18982+
"responseMessages": [
18983+
{
18984+
"code": 200,
18985+
"message": "OK",
18986+
"responseModel": "v1.SubjectRulesReview"
18987+
}
18988+
],
18989+
"produces": [
18990+
"application/json",
18991+
"application/yaml",
18992+
"application/vnd.kubernetes.protobuf"
18993+
],
18994+
"consumes": [
18995+
"*/*"
18996+
]
18997+
}
18998+
]
18999+
},
19000+
{
19001+
"path": "/oapi/v1/subjectrulesreviews",
19002+
"description": "OpenShift REST API, version v1",
19003+
"operations": [
19004+
{
19005+
"type": "v1.SubjectRulesReview",
19006+
"method": "POST",
19007+
"summary": "create a SubjectRulesReview",
19008+
"nickname": "createNamespacedSubjectRulesReview",
19009+
"parameters": [
19010+
{
19011+
"type": "string",
19012+
"paramType": "query",
19013+
"name": "pretty",
19014+
"description": "If 'true', then the output is pretty printed.",
19015+
"required": false,
19016+
"allowMultiple": false
19017+
},
19018+
{
19019+
"type": "v1.SubjectRulesReview",
19020+
"paramType": "body",
19021+
"name": "body",
19022+
"description": "",
19023+
"required": true,
19024+
"allowMultiple": false
19025+
}
19026+
],
19027+
"responseMessages": [
19028+
{
19029+
"code": 200,
19030+
"message": "OK",
19031+
"responseModel": "v1.SubjectRulesReview"
19032+
}
19033+
],
19034+
"produces": [
19035+
"application/json",
19036+
"application/yaml",
19037+
"application/vnd.kubernetes.protobuf"
19038+
],
19039+
"consumes": [
19040+
"*/*"
19041+
]
19042+
}
19043+
]
19044+
},
1894719045
{
1894819046
"path": "/oapi/v1/namespaces/{namespace}/templates",
1894919047
"description": "OpenShift REST API, version v1",
@@ -26937,6 +27035,60 @@
2693727035
}
2693827036
}
2693927037
},
27038+
"v1.SubjectRulesReview": {
27039+
"id": "v1.SubjectRulesReview",
27040+
"description": "SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace",
27041+
"required": [
27042+
"spec"
27043+
],
27044+
"properties": {
27045+
"kind": {
27046+
"type": "string",
27047+
"description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds"
27048+
},
27049+
"apiVersion": {
27050+
"type": "string",
27051+
"description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources"
27052+
},
27053+
"spec": {
27054+
"$ref": "v1.SubjectRulesReviewSpec",
27055+
"description": "Spec adds information about how to conduct the check"
27056+
},
27057+
"status": {
27058+
"$ref": "v1.SubjectRulesReviewStatus",
27059+
"description": "Status is completed by the server to tell which permissions you have"
27060+
}
27061+
}
27062+
},
27063+
"v1.SubjectRulesReviewSpec": {
27064+
"id": "v1.SubjectRulesReviewSpec",
27065+
"description": "SubjectRulesReviewSpec adds information about how to conduct the check",
27066+
"required": [
27067+
"user",
27068+
"groups",
27069+
"scopes"
27070+
],
27071+
"properties": {
27072+
"user": {
27073+
"type": "string",
27074+
"description": "User is optional. At least one of User and Groups must be specified."
27075+
},
27076+
"groups": {
27077+
"type": "array",
27078+
"items": {
27079+
"type": "string"
27080+
},
27081+
"description": "Groups is optional. Groups is the list of groups to which the User belongs. At least one of User and Groups must be specified."
27082+
},
27083+
"scopes": {
27084+
"type": "array",
27085+
"items": {
27086+
"type": "string"
27087+
},
27088+
"description": "Scopes to use for the evaluation. Empty means \"use the unscoped (full) permissions of the user/groups\"."
27089+
}
27090+
}
27091+
},
2694027092
"v1.TemplateList": {
2694127093
"id": "v1.TemplateList",
2694227094
"description": "TemplateList is a list of Template objects.",

‎pkg/authorization/api/register.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ func addKnownTypes(scheme *runtime.Scheme) error {
3939
&RoleList{},
4040

4141
&SelfSubjectRulesReview{},
42+
&SubjectRulesReview{},
4243
&ResourceAccessReview{},
4344
&SubjectAccessReview{},
4445
&LocalResourceAccessReview{},

‎pkg/authorization/api/types.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,27 @@ type SelfSubjectRulesReviewSpec struct {
159159
Scopes []string
160160
}
161161

162+
// SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace
163+
type SubjectRulesReview struct {
164+
unversioned.TypeMeta
165+
166+
// Spec adds information about how to conduct the check
167+
Spec SubjectRulesReviewSpec
168+
169+
// Status is completed by the server to tell which permissions you have
170+
Status SubjectRulesReviewStatus
171+
}
172+
173+
// SubjectRulesReviewSpec adds information about how to conduct the check
174+
type SubjectRulesReviewSpec struct {
175+
// User is optional. At least one of User and Groups must be specified.
176+
User string
177+
// Groups is optional. Groups is the list of groups to which the User belongs. At least one of User and Groups must be specified.
178+
Groups []string
179+
// Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups".
180+
Scopes []string
181+
}
182+
162183
// SubjectRulesReviewStatus is contains the result of a rules check
163184
type SubjectRulesReviewStatus struct {
164185
// Rules is the list of rules (no particular sort) that are allowed for the subject

0 commit comments

Comments
 (0)