Documentation
¶
Index ¶
- func AllowGroupMembershipAddition(ctx context.Context, cli client.Client, namespace string, ...) error
- func IdentityMetadataMutator(required, current metav1.Object) error
- func ProjectNamespace(ctx context.Context, cli client.Client, organizationID ids.OrganizationID, ...) (*corev1.Namespace, error)
- func RoleDisplayName(role *unikornv1.Role) string
- func SetIdentityMetadata(ctx context.Context, meta *metav1.ObjectMeta) error
- func SetIdentityMetadataOrganizationScope(ctx context.Context, meta *metav1.ObjectMeta, ...) error
- func SetIdentityMetadataProjectScope(ctx context.Context, meta *metav1.ObjectMeta, ...) error
- type Client
- func (c *Client) CheckQuotaConsistency(ctx context.Context, organizationID ids.OrganizationID, quota *unikornv1.Quota, ...) error
- func (c *Client) GetAllocations(ctx context.Context, organizationID ids.OrganizationID) (*unikornv1.AllocationList, error)
- func (c *Client) GetQuota(ctx context.Context, organizationID ids.OrganizationID) (*unikornv1.Quota, bool, error)
- func (c *Client) ProjectNamespace(ctx context.Context, organizationID ids.OrganizationID, ...) (*corev1.Namespace, error)
- type IssuerValue
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowGroupMembershipAddition ¶ added in v1.19.2
func AllowGroupMembershipAddition(ctx context.Context, cli client.Client, namespace string, organizationID ids.OrganizationID, group *unikornv1.Group) error
AllowGroupMembershipAddition returns nil if the calling principal may add a member to the given group. Adding a member confers the group's roles, so the caller must be able to grant every role the group carries.
A role reference that does not resolve refuses the addition rather than being skipped. Role IDs are derived from the role name, so a role that is deleted and later re-applied comes back with the same ID and immediately re-binds to every group still referencing it; a member added during the gap would then hold a role nobody was ever asked to grant, and for a service account that authority rides a long-lived token. Refusing also keeps this consistent with ACL construction, which treats the same dangling reference as a consistency failure rather than an empty permission set.
Only additions go through here. Removing a member, and deleting a principal (which strips its memberships as cleanup), take authority away rather than handing it out, so neither is gated. Dropping a dangling role from a group is likewise allowed — role removals are not grant-checked at all, as validateRoleIDs in pkg/handler/groups explains. The asymmetry is deliberate: skipping an unresolvable role errs towards less authority on a removal and towards more on an addition, so only the removal side is safe to skip.
func IdentityMetadataMutator ¶ added in v1.4.0
IdentityMetadataMutator is called on an update and preserves identity information.
func ProjectNamespace ¶ added in v1.5.0
func ProjectNamespace(ctx context.Context, cli client.Client, organizationID ids.OrganizationID, projectID ids.ProjectID) (*corev1.Namespace, error)
ProjectNamespace is shared by higher order services.
func RoleDisplayName ¶ added in v1.19.2
RoleDisplayName returns the name a caller knows a role by, for use in errors that have to say which role blocked a write. Roles are stored under a generated ID, so the human name lives in a label; fall back to the ID when the label is absent.
func SetIdentityMetadata ¶ added in v1.4.0
func SetIdentityMetadata(ctx context.Context, meta *metav1.ObjectMeta) error
SetIdentityMetadata sets identity specific metadata on a resource during generation.
This sets attribution only (creator and principal scope). For resources that also carry placement labels prefer SetIdentityMetadataOrganizationScope or SetIdentityMetadataProjectScope, which set the placement organization/project from typed IDs in the same call.
func SetIdentityMetadataOrganizationScope ¶ added in v1.17.7
func SetIdentityMetadataOrganizationScope(ctx context.Context, meta *metav1.ObjectMeta, organizationID ids.OrganizationID) error
SetIdentityMetadataOrganizationScope stamps the organization placement label from a typed ID and then sets the identity attribution metadata (see SetIdentityMetadata).
Prefer this over conversion.NewObjectMetadata(...).WithOrganization(organizationID.String()): core's builder is necessarily string-based (core cannot import pkg/ids without a circular dependency), so calling it forces a .String() at the call site. This keeps the typed ID to the lowest layer and stamps placement plus attribution scope in a single call.
func SetIdentityMetadataProjectScope ¶ added in v1.17.7
func SetIdentityMetadataProjectScope(ctx context.Context, meta *metav1.ObjectMeta, organizationID ids.OrganizationID, projectID ids.ProjectID) error
SetIdentityMetadataProjectScope stamps the organization and project placement labels from typed IDs and then sets the identity attribution metadata (see SetIdentityMetadata).
Prefer this over conversion.NewObjectMetadata(...).WithOrganization(...).WithProject(...) for the same reason as SetIdentityMetadataOrganizationScope: it keeps the typed IDs to the lowest layer rather than forcing .String() at the call site.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client wraps up control plane related management handling.
func (*Client) CheckQuotaConsistency ¶
func (c *Client) CheckQuotaConsistency(ctx context.Context, organizationID ids.OrganizationID, quota *unikornv1.Quota, allocation *unikornv1.Allocation) error
CheckQuotaConsistency by default loads up the organization's quota and all allocations and checks that the total of alloocations does not exceed the quota. If you pass in a quota argument, i.e. when updating the quotas, this will override the read from the organization. If you pass in an allocation, i.e. when creating or updating an allocation, this will be unioned with the organization's allocations, overriding an existing one if it exists.
func (*Client) GetAllocations ¶
func (c *Client) GetAllocations(ctx context.Context, organizationID ids.OrganizationID) (*unikornv1.AllocationList, error)
type IssuerValue ¶ added in v1.11.0
type IssuerValue struct {
// URL is the OAuth2/OIDC issuer URL (e.g., "https://identity.example.com")
// This is used when minting tokens and populating subject records.
URL string
// Hostname is just the hostname part (e.g., "identity.example.com")
// This is used for audience claims and other non-issuer uses.
Hostname string
}
IssuerValue is a value that can be used with pflag.Var, so as to set an issuer URL and hostname with the same argument.
func (*IssuerValue) Set ¶ added in v1.11.0
func (v *IssuerValue) Set(value string) error
func (*IssuerValue) String ¶ added in v1.11.0
func (v *IssuerValue) String() string
func (*IssuerValue) Type ¶ added in v1.11.0
func (*IssuerValue) Type() string
Source Files
Directories