users

func GetServiceAccountFullName ¶

func GetServiceAccountFullName(ref meta.NamespacedRFC1123ObjectReferenceWithNamespace) string

GetServiceAccountFullName return the full qualified name for the serviceaccount.

func GetServiceAccountGroups ¶

func GetServiceAccountGroups(namespace string) []string

GetServiceAccountGroups returns all groups associated with a ServiceAccount.

func HasIgnoredGroup ¶

func HasIgnoredGroup(userGroups []string, ignoredGroups []string) bool

func ImpersonatedKubernetesClientForServiceAccount ¶

func ImpersonatedKubernetesClientForServiceAccount(
	base *rest.Config,
	scheme *runtime.Scheme,
	reference meta.NamespacedRFC1123ObjectReferenceWithNamespace,
) (client.Client, error)

ImpersonatedKubernetesClientForServiceAccount returns a controller-runtime client.Client that impersonates a given ServiceAccount.

func IsAdminUser ¶

func IsAdminUser(req admission.Request, administrators rbac.UserListSpec) bool

func IsCapsuleUser ¶

func IsCapsuleUser(
	ctx context.Context,
	c client.Client,
	cfg configuration.Configuration,
	user string,
	groups []string,
) bool

func IsCommonOwner ¶

func IsCommonOwner(
	ctx context.Context,
	c client.Reader,
	cfg configuration.Configuration,
	tnt *capsulev1beta2.Tenant,
	userInfo authenticationv1.UserInfo,
) (bool, error)

func IsControllerServiceAccount ¶

func IsControllerServiceAccount(username string) bool

func IsTenantOwner ¶

func IsTenantOwner(
	ctx context.Context,
	c client.Reader,
	cfg configuration.Configuration,
	tnt *capsulev1beta2.Tenant,
	userInfo authenticationv1.UserInfo,
) (bool, error)

func IsTenantOwnerByStatus ¶

func IsTenantOwnerByStatus(
	tnt *capsulev1beta2.Tenant,
	user AdmissionUser,
) bool

func ResolveServiceAccountActor ¶

func ResolveServiceAccountActor(
	ctx context.Context,
	c client.Reader,
	ns *corev1.Namespace,
	username string,
	cfg configuration.Configuration,
) (tnt *capsulev1beta2.Tenant, err error)

This function resolves the tenant based on the serviceaccount given via username if a serviceaccount is in a tenant namespace they will return the tenant.

func ServiceAccountGroups ¶

func ServiceAccountGroups(namespace string) []string

func ServiceAccountUserInfo ¶

func ServiceAccountUserInfo(namespace, name string) authenticationv1.UserInfo

func ServiceAccountUsername ¶

func ServiceAccountUsername(namespace, name string) string