PolicyRulesWithSubjects

io.k8s.api.flowcontrol.v1.PolicyRulesWithSubjects source ↗

PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.

nonResourceRules[]NonResourcePolicyRule`nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.
nonResourceURLs[]string required`nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example:
  • "/healthz" is legal
  • "/hea*" is illegal
  • "/hea" is legal but matches nothing
  • "/hea/*" also matches nothing
  • "/healthz/*" matches all per-component health checks.
"*" matches all non-resource urls. if it is present, it must be the only entry. Required.
verbs[]string required`verbs` is a list of matching verbs and may not be empty. "*" matches all verbs. If it is present, it must be the only entry. Required.
resourceRules[]ResourcePolicyRule`resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
apiGroups[]string required`apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.
clusterScopeboolean`clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.
namespaces[]string`namespaces` is a list of target namespaces that restricts matches. A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains "*". Note that "*" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.
resources[]string required`resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource. For example, [ "services", "nodes/status" ]. This list may not be empty. "*" matches all resources and, if present, must be the only entry. Required.
verbs[]string required`verbs` is a list of matching verbs and may not be empty. "*" matches all verbs and, if present, must be the only entry. Required.
subjects[]Subject requiredsubjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.
groupGroupSubject`group` matches based on user group name.
namestring requiredname is the user group that matches, or "*" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.
kindstring required`kind` indicates which one of the other fields is non-empty. Required
serviceAccountServiceAccountSubject`serviceAccount` matches ServiceAccounts.
namestring required`name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. Required.
namespacestring required`namespace` is the namespace of matching ServiceAccount objects. Required.
userUserSubject`user` matches based on username.
namestring required`name` is the username that matches, or "*" to match all usernames. Required.