Documentation
¶
Index ¶
- Constants
- Variables
- func OwnerRoleBindingsIndexFunc(obj any) (result []string, err error)
- func ReflectionRoleBindingsIndexFunc(obj any) ([]string, error)
- type CapsuleConfiguration
- type GlobalProxySettingsReconciler
- type ProxySettingReconciler
- type RoleBindingReflector
- func (r *RoleBindingReflector) GetUserNamespacesForResource(ctx context.Context, username string, groups []string, ...) ([]string, error)
- func (r *RoleBindingReflector) GetUserNamespacesFromRequest(req request.Request) ([]string, error)
- func (r *RoleBindingReflector) GetUserTenantNamesForResource(ctx context.Context, username string, groups []string, ...) ([]string, error)
- func (r *RoleBindingReflector) Start(ctx context.Context) error
Constants ¶
View Source
const (
RoleBindingReflectionLabel = "reflection.proxy.projectcapsule.dev/enabled"
)
Variables ¶
View Source
var CapsuleUserGroups sets.Set[string]
View Source
var CapsuleUsers sets.Set[string]
Functions ¶
func ReflectionRoleBindingsIndexFunc ¶ added in v0.13.9
Types ¶
type CapsuleConfiguration ¶
type CapsuleConfiguration struct {
Client client.Client
CapsuleConfigurationName string
DeprecatedCapsuleUserGroups []string
}
func (*CapsuleConfiguration) SetupWithManager ¶
type GlobalProxySettingsReconciler ¶ added in v0.13.2
type GlobalProxySettingsReconciler struct {
Client client.Client
// contains filtered or unexported fields
}
GlobalProxySettingsReconciler reconciles GlobalProxySettings objects and keeps status.observedGeneration in sync with metadata.generation.
func (*GlobalProxySettingsReconciler) SetupWithManager ¶ added in v0.13.2
func (r *GlobalProxySettingsReconciler) SetupWithManager(mgr ctrl.Manager) error
type ProxySettingReconciler ¶ added in v0.13.2
type ProxySettingReconciler struct {
Client client.Client
// contains filtered or unexported fields
}
ProxySettingReconciler reconciles ProxySetting objects and keeps status.observedGeneration in sync with metadata.generation.
func (*ProxySettingReconciler) SetupWithManager ¶ added in v0.13.2
func (r *ProxySettingReconciler) SetupWithManager(mgr ctrl.Manager) error
type RoleBindingReflector ¶
type RoleBindingReflector struct {
// contains filtered or unexported fields
}
func NewRoleBindingReflector ¶
func (*RoleBindingReflector) GetUserNamespacesForResource ¶ added in v0.13.9
func (r *RoleBindingReflector) GetUserNamespacesForResource(ctx context.Context, username string, groups []string, verb, apiGroup, resource string) ([]string, error)
GetUserNamespacesForResource returns namespaces where the request subject is bound to a namespaced Role granting the requested verb on the API resource. Policy rules use Kubernetes RBAC matching semantics for '*' in verbs, API groups, and resources. Both namespaced Roles and ClusterRoles referenced by a namespaced RoleBinding are supported.
func (*RoleBindingReflector) GetUserNamespacesFromRequest ¶
func (r *RoleBindingReflector) GetUserNamespacesFromRequest(req request.Request) ([]string, error)
func (*RoleBindingReflector) GetUserTenantNamesForResource ¶ added in v0.13.9
func (r *RoleBindingReflector) GetUserTenantNamesForResource(ctx context.Context, username string, groups []string, verb, apiGroup, resource string) ([]string, error)
GetUserTenantNamesForResource resolves reflected RBAC permissions directly to tenant selector values using the cached Namespace objects.
Source Files
Click to show internal directories.
Click to hide internal directories.