kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Move request attrs section out of ABAC section, add "extra" and subresource fields.

pull/946/head
Jimmy Cuadra 2016-08-03 13:51:53 -07:00
parent ce198ad723
commit ad328a9f2c
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
docs/admin/authorization.md
View File

@ -33,24 +33,22 @@ If multiple modes are provided the set is unioned, and only a single authorizer
will always allow. will always allow.
## ABAC Mode ## Request Attributes
### Request Attributes
A request has the following attributes that can be considered for authorization: A request has the following attributes that can be considered for authorization:
- user (the user-string which a user was authenticated as). - user (the user-string which a user was authenticated as).
- group (the list of group names the authenticated user is a member of). - group (the list of group names the authenticated user is a member of).
- "extra" (a map of arbitrary string keys to string values, provided by the authentication layer)
- whether the request is for an API resource. - whether the request is for an API resource.
- the request path. - the request path.
- allows authorizing access to miscellaneous non-resource endpoints like `/api` or `/healthz` (see [kubectl](#kubectl)). - allows authorizing access to miscellaneous non-resource endpoints like `/api` or `/healthz` (see [kubectl](#kubectl)).
- the request verb. - the request verb.
- API verbs `get`, `list`, `create`, `update`, `watch`, `delete`, and `deletecollection` are used for resource requests - API verbs `get`, `list`, `create`, `update`, `watch`, `delete`, and `deletecollection` are used for resource requests
- HTTP verbs `get`, `post`, `put`, and `delete` are used for non-resource - HTTP verbs `get`, `post`, `put`, and `delete` are used for non-resource requests
requests
- what resource is being accessed (for resource requests only) - what resource is being accessed (for resource requests only)
- the namespace of the object being accessed (for namespaced resource requests - what subresource is being accessed (for resource requests only)
only) - the namespace of the object being accessed (for namespaced resource requests only)
- the API group being accessed (for resource requests only) - the API group being accessed (for resource requests only)
The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources: The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:
@ -63,8 +61,8 @@ PUT | update
PATCH | patch PATCH | patch
DELETE | delete (for individual resources), deletecollection (for collections) DELETE | delete (for individual resources), deletecollection (for collections)
We anticipate adding more attributes to allow finer grained access control and
to assist in policy management. ## ABAC Mode
### Policy File Format ### Policy File Format