k8s.io/kubernetes@v1.29.3/pkg/apis/abac/v0/conversion.go (about)

     1  /*
     2  Copyright 2015 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package v0
    18  
    19  import (
    20  	"k8s.io/apimachinery/pkg/conversion"
    21  	"k8s.io/kubernetes/pkg/apis/abac"
    22  )
    23  
    24  // allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated,
    25  // but we don't want a client library (which must include types), depending on a server library
    26  const allAuthenticated = "system:authenticated"
    27  
    28  func Convert_v0_Policy_To_abac_Policy(in *Policy, out *abac.Policy, s conversion.Scope) error {
    29  	out.Spec.User = in.User
    30  	out.Spec.Group = in.Group
    31  	out.Spec.Namespace = in.Namespace
    32  	out.Spec.Resource = in.Resource
    33  	out.Spec.Readonly = in.Readonly
    34  
    35  	// In v0, unspecified user and group matches all authenticated subjects
    36  	if len(in.User) == 0 && len(in.Group) == 0 {
    37  		out.Spec.Group = allAuthenticated
    38  	}
    39  	// In v0, user or group of * matches all authenticated subjects
    40  	if in.User == "*" || in.Group == "*" {
    41  		out.Spec.Group = allAuthenticated
    42  		out.Spec.User = ""
    43  	}
    44  
    45  	// In v0, leaving namespace empty matches all namespaces
    46  	if len(in.Namespace) == 0 {
    47  		out.Spec.Namespace = "*"
    48  	}
    49  	// In v0, leaving resource empty matches all resources
    50  	if len(in.Resource) == 0 {
    51  		out.Spec.Resource = "*"
    52  	}
    53  	// Any rule in v0 should match all API groups
    54  	out.Spec.APIGroup = "*"
    55  
    56  	// In v0, leaving namespace and resource blank allows non-resource paths
    57  	if len(in.Namespace) == 0 && len(in.Resource) == 0 {
    58  		out.Spec.NonResourcePath = "*"
    59  	}
    60  
    61  	return nil
    62  }