1 /* 2 Copyright 2017 The Kubernetes Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 package v1beta1 18 19 import ( 20 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" 21 ) 22 23 // Authorization is calculated against 24 // 1. evaluation of ClusterRoleBindings - short circuit on match 25 // 2. evaluation of RoleBindings in the namespace requested - short circuit on match 26 // 3. deny by default 27 28 const ( 29 APIGroupAll = "*" 30 ResourceAll = "*" 31 VerbAll = "*" 32 NonResourceAll = "*" 33 34 GroupKind = "Group" 35 ServiceAccountKind = "ServiceAccount" 36 UserKind = "User" 37 38 // AutoUpdateAnnotationKey is the name of an annotation which prevents reconciliation if set to "false" 39 AutoUpdateAnnotationKey = "rbac.authorization.kubernetes.io/autoupdate" 40 ) 41 42 // Authorization is calculated against 43 // 1. evaluation of ClusterRoleBindings - short circuit on match 44 // 2. evaluation of RoleBindings in the namespace requested - short circuit on match 45 // 3. deny by default 46 47 // PolicyRule holds information that describes a policy rule, but does not contain information 48 // about who the rule applies to or which namespace the rule applies to. 49 type PolicyRule struct { 50 // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs. 51 // +listType=atomic 52 Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"` 53 54 // APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of 55 // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups. 56 // +optional 57 // +listType=atomic 58 APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"` 59 // Resources is a list of resources this rule applies to. '*' represents all resources in the specified apiGroups. 60 // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups. 61 // +optional 62 // +listType=atomic 63 Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` 64 // ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. 65 // +optional 66 // +listType=atomic 67 ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"` 68 69 // NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path 70 // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. 71 // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both. 72 // +optional 73 // +listType=atomic 74 NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,5,rep,name=nonResourceURLs"` 75 } 76 77 // Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, 78 // or a value for non-objects such as user and group names. 79 type Subject struct { 80 // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". 81 // If the Authorizer does not recognized the kind value, the Authorizer should report an error. 82 Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"` 83 // APIGroup holds the API group of the referenced subject. 84 // Defaults to "" for ServiceAccount subjects. 85 // Defaults to "rbac.authorization.k8s.io" for User and Group subjects. 86 // +optional 87 APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,2,opt.name=apiGroup"` 88 // Name of the object being referenced. 89 Name string `json:"name" protobuf:"bytes,3,opt,name=name"` 90 // Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty 91 // the Authorizer should report an error. 92 // +optional 93 Namespace string `json:"namespace,omitempty" protobuf:"bytes,4,opt,name=namespace"` 94 } 95 96 // RoleRef contains information that points to the role being used 97 type RoleRef struct { 98 // APIGroup is the group for the resource being referenced 99 APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"` 100 // Kind is the type of resource being referenced 101 Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"` 102 // Name is the name of resource being referenced 103 Name string `json:"name" protobuf:"bytes,3,opt,name=name"` 104 } 105 106 // +genclient 107 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 108 // +k8s:prerelease-lifecycle-gen:introduced=1.6 109 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 110 // +k8s:prerelease-lifecycle-gen:removed=1.22 111 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,Role 112 113 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. 114 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22. 115 type Role struct { 116 metav1.TypeMeta `json:",inline"` 117 // Standard object's metadata. 118 // +optional 119 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 120 121 // Rules holds all the PolicyRules for this Role 122 // +optional 123 // +listType=atomic 124 Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"` 125 } 126 127 // +genclient 128 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 129 // +k8s:prerelease-lifecycle-gen:introduced=1.6 130 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 131 // +k8s:prerelease-lifecycle-gen:removed=1.22 132 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleBinding 133 134 // RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. 135 // It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given 136 // namespace only have effect in that namespace. 137 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22. 138 type RoleBinding struct { 139 metav1.TypeMeta `json:",inline"` 140 // Standard object's metadata. 141 // +optional 142 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 143 144 // Subjects holds references to the objects the role applies to. 145 // +optional 146 // +listType=atomic 147 Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"` 148 149 // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. 150 // If the RoleRef cannot be resolved, the Authorizer must return an error. 151 RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"` 152 } 153 154 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 155 // +k8s:prerelease-lifecycle-gen:introduced=1.6 156 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 157 // +k8s:prerelease-lifecycle-gen:removed=1.22 158 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleBindingList 159 160 // RoleBindingList is a collection of RoleBindings 161 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22. 162 type RoleBindingList struct { 163 metav1.TypeMeta `json:",inline"` 164 // Standard object's metadata. 165 // +optional 166 metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 167 168 // Items is a list of RoleBindings 169 Items []RoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"` 170 } 171 172 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 173 // +k8s:prerelease-lifecycle-gen:introduced=1.6 174 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 175 // +k8s:prerelease-lifecycle-gen:removed=1.22 176 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,RoleList 177 178 // RoleList is a collection of Roles 179 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22. 180 type RoleList struct { 181 metav1.TypeMeta `json:",inline"` 182 // Standard object's metadata. 183 // +optional 184 metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 185 186 // Items is a list of Roles 187 Items []Role `json:"items" protobuf:"bytes,2,rep,name=items"` 188 } 189 190 // +genclient 191 // +genclient:nonNamespaced 192 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 193 // +k8s:prerelease-lifecycle-gen:introduced=1.6 194 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 195 // +k8s:prerelease-lifecycle-gen:removed=1.22 196 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRole 197 198 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. 199 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22. 200 type ClusterRole struct { 201 metav1.TypeMeta `json:",inline"` 202 // Standard object's metadata. 203 // +optional 204 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 205 206 // Rules holds all the PolicyRules for this ClusterRole 207 // +optional 208 // +listType=atomic 209 Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"` 210 // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. 211 // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be 212 // stomped by the controller. 213 // +optional 214 AggregationRule *AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"` 215 } 216 217 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole 218 type AggregationRule struct { 219 // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. 220 // If any of the selectors match, then the ClusterRole's permissions will be added 221 // +optional 222 // +listType=atomic 223 ClusterRoleSelectors []metav1.LabelSelector `json:"clusterRoleSelectors,omitempty" protobuf:"bytes,1,rep,name=clusterRoleSelectors"` 224 } 225 226 // +genclient 227 // +genclient:nonNamespaced 228 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 229 // +k8s:prerelease-lifecycle-gen:introduced=1.6 230 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 231 // +k8s:prerelease-lifecycle-gen:removed=1.22 232 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleBinding 233 234 // ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, 235 // and adds who information via Subject. 236 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22. 237 type ClusterRoleBinding struct { 238 metav1.TypeMeta `json:",inline"` 239 // Standard object's metadata. 240 // +optional 241 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 242 243 // Subjects holds references to the objects the role applies to. 244 // +optional 245 // +listType=atomic 246 Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"` 247 248 // RoleRef can only reference a ClusterRole in the global namespace. 249 // If the RoleRef cannot be resolved, the Authorizer must return an error. 250 RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"` 251 } 252 253 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 254 // +k8s:prerelease-lifecycle-gen:introduced=1.6 255 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 256 // +k8s:prerelease-lifecycle-gen:removed=1.22 257 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleBindingList 258 259 // ClusterRoleBindingList is a collection of ClusterRoleBindings. 260 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22. 261 type ClusterRoleBindingList struct { 262 metav1.TypeMeta `json:",inline"` 263 // Standard object's metadata. 264 // +optional 265 metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 266 267 // Items is a list of ClusterRoleBindings 268 Items []ClusterRoleBinding `json:"items" protobuf:"bytes,2,rep,name=items"` 269 } 270 271 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object 272 // +k8s:prerelease-lifecycle-gen:introduced=1.6 273 // +k8s:prerelease-lifecycle-gen:deprecated=1.17 274 // +k8s:prerelease-lifecycle-gen:removed=1.22 275 // +k8s:prerelease-lifecycle-gen:replacement=rbac.authorization.k8s.io,v1,ClusterRoleList 276 277 // ClusterRoleList is a collection of ClusterRoles. 278 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22. 279 type ClusterRoleList struct { 280 metav1.TypeMeta `json:",inline"` 281 // Standard object's metadata. 282 // +optional 283 metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` 284 285 // Items is a list of ClusterRoles 286 Items []ClusterRole `json:"items" protobuf:"bytes,2,rep,name=items"` 287 } 288