apiserverk8s.io/apiserver/pkg/authorization/authorizerfactory Index | Files

package authorizerfactory

import "k8s.io/apiserver/pkg/authorization/authorizerfactory"

Index

Functions

func NewAlwaysAllowAuthorizer

func NewAlwaysAllowAuthorizer() *alwaysAllowAuthorizer

func NewAlwaysDenyAuthorizer

func NewAlwaysDenyAuthorizer() *alwaysDenyAuthorizer

func NewDelegatingAuthorizerMetrics

func NewDelegatingAuthorizerMetrics() delegatingAuthorizerMetrics

func NewPrivilegedGroups

func NewPrivilegedGroups(groups ...string) *privilegedGroupAuthorizer

NewPrivilegedGroups is for use in loopback scenarios

func RegisterMetrics

func RegisterMetrics()

RegisterMetrics registers authorizer metrics.

Types

type DelegatingAuthorizerConfig

type DelegatingAuthorizerConfig struct {
	SubjectAccessReviewClient authorizationclient.AuthorizationV1Interface

	// Compiler is the CEL compiler to use for evaluating policies. If nil, a default compiler will be used.
	Compiler authorizationcel.Compiler

	// AllowCacheTTL is the length of time that a successful authorization response will be cached
	AllowCacheTTL time.Duration

	// DenyCacheTTL is the length of time that an unsuccessful authorization response will be cached.
	// You generally want more responsive, "deny, try again" flows.
	DenyCacheTTL time.Duration

	// WebhookRetryBackoff specifies the backoff parameters for the authorization webhook retry logic.
	// This allows us to configure the sleep time at each iteration and the maximum number of retries allowed
	// before we fail the webhook call in order to limit the fan out that ensues when the system is degraded.
	WebhookRetryBackoff *wait.Backoff
}

DelegatingAuthorizerConfig is the minimal configuration needed to create an authorizer built to delegate authorization to a kube API server

func (DelegatingAuthorizerConfig) New

Source Files

builtin.go delegating.go metrics.go

Version
v0.33.0 (latest)
Published
Apr 23, 2025
Platform
linux/amd64
Imports
13 packages
Last checked
1 hour ago

Tools for package owners.