avionix.kube.authorization

class avionix.kube.authorization.LocalSubjectAccessReview(metadata, spec, api_version=None)
Parameters
class avionix.kube.authorization.NonResourceAttributes(path, verb)
Parameters

  • path (str) – Path is the URL path of the request

  • verb (str) – Verb is the standard HTTP verb

class avionix.kube.authorization.NonResourceRule(non_resource_urls, verbs)
Parameters

  • non_resource_urls (List[str]) – NonResourceURLs is a set of partial urls that a user should have access to. s are allowed, but only as the full, final step in the path. “” means all.

  • verbs (List[str]) – Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. “*” means all.

class avionix.kube.authorization.ResourceAttributes(name, group, resource, subresource, verb, version, namespace=None)
Parameters

  • name (str) – Name is the name of the resource being requested for a “get” or deleted for a “delete”. “” (empty) means all.

  • group (str) – Group is the API Group of the Resource. “*” means all.

  • resource (str) – Resource is one of the existing resource types. “*” means all.

  • subresource (str) – Subresource is one of the existing resource types. “” means none.

  • verb (str) – Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. “*” means all.

  • version (str) – Version is the API Version of the Resource. “*” means all.

  • namespace (Optional[str]) – Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces “” (empty) is defaulted for LocalSubjectAccessReviews “” (empty) is empty for cluster-scoped resources “” (empty) means “all” for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview

class avionix.kube.authorization.ResourceRule(api_groups, resource_names, resources, verbs)
Parameters

  • api_groups (List[str]) – APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. “*” means all.

  • resource_names (List[str]) – ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. “*” means all.

  • resources (List[str]) – Resources is a list of resources this rule applies to. “*” means all in the specified apiGroups. “*/foo” represents the subresource ‘foo’ for all resources in the specified apiGroups.

  • verbs (List[str]) – Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. “*” means all.

class avionix.kube.authorization.SelfSubjectAccessReview(metadata, spec, api_version=None)
Parameters
class avionix.kube.authorization.SelfSubjectAccessReviewSpec(non_resource_attributes, resource_attributes)
Parameters

  • non_resource_attributes (NonResourceAttributes) – NonResourceAttributes describes information for a non-resource access request

  • resource_attributes (ResourceAttributes) – ResourceAuthorizationAttributes describes information for a resource access request

class avionix.kube.authorization.SelfSubjectRulesReview(metadata, spec, api_version=None)
Parameters
class avionix.kube.authorization.SelfSubjectRulesReviewSpec(namespace=None)
Parameters

namespace (Optional[str]) – Namespace to evaluate rules for. Required.

class avionix.kube.authorization.SubjectAccessReview(metadata, spec, api_version=None)
Parameters
class avionix.kube.authorization.SubjectAccessReviewSpec(extra, groups, non_resource_attributes, resource_attributes, user, uid=None)
Parameters

  • extra (dict) – Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.

  • groups (List[str]) – Groups is the groups you’re testing for.

  • non_resource_attributes (NonResourceAttributes) – NonResourceAttributes describes information for a non-resource access request

  • resource_attributes (ResourceAttributes) – ResourceAuthorizationAttributes describes information for a resource access request

  • user (str) – User is the user you’re testing for. If you specify “User” but not “Groups”, then is it interpreted as “What if User were not a member of any groups

  • uid (Optional[str]) – UID information about the requesting user.