1/*
2Copyright The Kubernetes Authors.
3
4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at
7
8 http://www.apache.org/licenses/LICENSE-2.0
9
10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/
16
17
18// This file was autogenerated by go-to-protobuf. Do not edit it manually!
19
20syntax = "proto2";
21
22package k8s.io.api.rbac.v1beta1;
23
24import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
25import "k8s.io/apimachinery/pkg/runtime/generated.proto";
26import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
27
28// Package-wide variables from generator "generated".
29option go_package = "k8s.io/api/rbac/v1beta1";
30
31// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
32message AggregationRule {
33 // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
34 // If any of the selectors match, then the ClusterRole's permissions will be added
35 // +optional
36 // +listType=atomic
37 repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
38}
39
40// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
41// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
42message ClusterRole {
43 // Standard object's metadata.
44 // +optional
45 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
46
47 // Rules holds all the PolicyRules for this ClusterRole
48 // +optional
49 // +listType=atomic
50 repeated PolicyRule rules = 2;
51
52 // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
53 // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
54 // stomped by the controller.
55 // +optional
56 optional AggregationRule aggregationRule = 3;
57}
58
59// ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace,
60// and adds who information via Subject.
61// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
62message ClusterRoleBinding {
63 // Standard object's metadata.
64 // +optional
65 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
66
67 // Subjects holds references to the objects the role applies to.
68 // +optional
69 // +listType=atomic
70 repeated Subject subjects = 2;
71
72 // RoleRef can only reference a ClusterRole in the global namespace.
73 // If the RoleRef cannot be resolved, the Authorizer must return an error.
74 optional RoleRef roleRef = 3;
75}
76
77// ClusterRoleBindingList is a collection of ClusterRoleBindings.
78// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22.
79message ClusterRoleBindingList {
80 // Standard object's metadata.
81 // +optional
82 optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
83
84 // Items is a list of ClusterRoleBindings
85 repeated ClusterRoleBinding items = 2;
86}
87
88// ClusterRoleList is a collection of ClusterRoles.
89// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22.
90message ClusterRoleList {
91 // Standard object's metadata.
92 // +optional
93 optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
94
95 // Items is a list of ClusterRoles
96 repeated ClusterRole items = 2;
97}
98
99// PolicyRule holds information that describes a policy rule, but does not contain information
100// about who the rule applies to or which namespace the rule applies to.
101message PolicyRule {
102 // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
103 // +listType=atomic
104 repeated string verbs = 1;
105
106 // APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
107 // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
108 // +optional
109 // +listType=atomic
110 repeated string apiGroups = 2;
111
112 // Resources is a list of resources this rule applies to. '*' represents all resources in the specified apiGroups.
113 // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.
114 // +optional
115 // +listType=atomic
116 repeated string resources = 3;
117
118 // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
119 // +optional
120 // +listType=atomic
121 repeated string resourceNames = 4;
122
123 // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
124 // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
125 // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
126 // +optional
127 // +listType=atomic
128 repeated string nonResourceURLs = 5;
129}
130
131// Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
132// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
133message Role {
134 // Standard object's metadata.
135 // +optional
136 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
137
138 // Rules holds all the PolicyRules for this Role
139 // +optional
140 // +listType=atomic
141 repeated PolicyRule rules = 2;
142}
143
144// RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace.
145// It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given
146// namespace only have effect in that namespace.
147// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
148message RoleBinding {
149 // Standard object's metadata.
150 // +optional
151 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
152
153 // Subjects holds references to the objects the role applies to.
154 // +optional
155 // +listType=atomic
156 repeated Subject subjects = 2;
157
158 // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
159 // If the RoleRef cannot be resolved, the Authorizer must return an error.
160 optional RoleRef roleRef = 3;
161}
162
163// RoleBindingList is a collection of RoleBindings
164// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22.
165message RoleBindingList {
166 // Standard object's metadata.
167 // +optional
168 optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
169
170 // Items is a list of RoleBindings
171 repeated RoleBinding items = 2;
172}
173
174// RoleList is a collection of Roles
175// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
176message RoleList {
177 // Standard object's metadata.
178 // +optional
179 optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
180
181 // Items is a list of Roles
182 repeated Role items = 2;
183}
184
185// RoleRef contains information that points to the role being used
186message RoleRef {
187 // APIGroup is the group for the resource being referenced
188 optional string apiGroup = 1;
189
190 // Kind is the type of resource being referenced
191 optional string kind = 2;
192
193 // Name is the name of resource being referenced
194 optional string name = 3;
195}
196
197// Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
198// or a value for non-objects such as user and group names.
199message Subject {
200 // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
201 // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
202 optional string kind = 1;
203
204 // APIGroup holds the API group of the referenced subject.
205 // Defaults to "" for ServiceAccount subjects.
206 // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
207 // +optional
208 optional string apiGroup = 2;
209
210 // Name of the object being referenced.
211 optional string name = 3;
212
213 // Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
214 // the Authorizer should report an error.
215 // +optional
216 optional string namespace = 4;
217}
218
View as plain text