Skip to content

Commit 5c988da

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #33953 from windsonsea/patch-1
[zh] sync 1.24 ref-k8s-api /authorization-resources/self-subject-.md
2 parents b3ddc91 + b0bb201 commit 5c988da

File tree

3 files changed

+777
-0
lines changed

3 files changed

+777
-0
lines changed

‎content/zh/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1.md

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
---
2+
api_metadata:
3+
apiVersion: "authorization.k8s.io/v1"
4+
import: "k8s.io/api/authorization/v1"
5+
kind: "SelfSubjectAccessReview"
6+
content_type: "api_reference"
7+
description: "SelfSubjectAccessReview 检查当前用户是否可以执行某操作。"
8+
title: "SelfSubjectAccessReview"
9+
weight: 2
10+
---
11+
<!--
12+
api_metadata:
13+
apiVersion: "authorization.k8s.io/v1"
14+
import: "k8s.io/api/authorization/v1"
15+
kind: "SelfSubjectAccessReview"
16+
content_type: "api_reference"
17+
description: "SelfSubjectAccessReview checks whether or the current user can perform an action."
18+
title: "SelfSubjectAccessReview"
19+
weight: 2
20+
-->
21+
`apiVersion: authorization.k8s.io/v1`
22+
23+
`import "k8s.io/api/authorization/v1"`
24+
25+
## SelfSubjectAccessReview {#SelfSubjectAccessReview}
26+
<!--
27+
SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an action
28+
-->
29+
SelfSubjectAccessReview 检查当前用户是否可以执行某操作。
30+
不填写 spec.namespace 表示 “在所有命名空间中”。
31+
Self 是一个特殊情况，因为用户应始终能够检查自己是否可以执行某操作。
32+
33+
<hr>
34+
35+
- **apiVersion**: authorization.k8s.io/v1
36+
37+
- **kind**: SelfSubjectAccessReview
38+
39+
<!--
40+
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
41+
Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
42+
- **spec** (<a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReviewSpec" >}}">SelfSubjectAccessReviewSpec</a>), required
43+
Spec holds information about the request being evaluated. user and groups must be empty
44+
Status is filled in by the server and indicates whether the request is allowed or not
45+
-->
46+
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
47+
48+
标准的列表元数据。
49+
更多信息：https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
50+
51+
- **spec** (<a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReviewSpec" >}}">SelfSubjectAccessReviewSpec</a>)，必需
52+
53+
spec 包含有关正在评估的请求的信息。
54+
user 和 group 必须为空。
55+
56+
- **status** (<a href="{{< ref "../authorization-resources/subject-access-review-v1#SubjectAccessReviewStatus" >}}">SubjectAccessReviewStatus</a>)
57+
58+
status 由服务器填写，表示请求是否被允许。
59+
60+
## SelfSubjectAccessReviewSpec {#SelfSubjectAccessReviewSpec}
61+
<!--
62+
SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set
63+
-->
64+
SelfSubjectAccessReviewSpec 是访问请求的描述。
65+
resourceAuthorizationAttributes 和 nonResourceAuthorizationAttributes 二者必须设置其一，并且只能设置其一。
66+
67+
<hr>
68+
<!--
69+
- **nonResourceAttributes** (NonResourceAttributes)
70+
NonResourceAttributes describes information for a non-resource access request
71+
<a name="NonResourceAttributes"></a>
72+
*NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface*
73+
- **nonResourceAttributes.path** (string)
74+
Path is the URL path of the request
75+
- **nonResourceAttributes.verb** (string)
76+
Verb is the standard HTTP verb
77+
-->
78+
79+
- **nonResourceAttributes** (NonResourceAttributes)
80+
81+
nonResourceAttributes 描述非资源访问请求的信息。
82+
83+
<a name="NonResourceAttributes"></a>
84+
**nonResourceAttributes 包括提供给 Authorizer 接口进行非资源请求鉴权时所用的属性。**
85+
86+
- **nonResourceAttributes.path** (string)
87+
88+
path 是请求的 URL 路径。
89+
90+
- **nonResourceAttributes.verb** (string)
91+
92+
verb 是标准的 HTTP 动作。
93+
<!--
94+
- **resourceAttributes** (ResourceAttributes)
95+
ResourceAuthorizationAttributes describes information for a resource access request
96+
97+
<a name="ResourceAttributes"></a>
98+
*ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface*
99+
100+
- **resourceAttributes.group** (string)
101+
Group is the API Group of the Resource. "*" means all.
102+
103+
- **resourceAttributes.name** (string)
104+
Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
105+
-->
106+
- **resourceAttributes** (ResourceAttributes)
107+
108+
resourceAuthorizationAttributes 描述资源访问请求的信息。
109+
110+
<a name="ResourceAttributes"></a>
111+
**resourceAttributes 包括提供给 Authorizer 接口进行资源请求鉴权时所用的属性。**
112+
113+
- **resourceAttributes.group** (string)
114+
115+
group 是资源的 API 组。
116+
"*" 表示所有组。
117+
118+
- **resourceAttributes.name** (string)
119+
120+
name 是 "get" 正在请求或 "delete" 已删除的资源的名称。
121+
""（空字符串）表示所有资源。
122+
<!--
123+
- **resourceAttributes.namespace** (string)
124+
Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
125+
126+
- **resourceAttributes.resource** (string)
127+
Resource is one of the existing resource types. "*" means all.
128+
-->
129+
- **resourceAttributes.namespace** (string)
130+
131+
namespace 是正在请求的操作的命名空间。
132+
目前，无命名空间和所有命名空间之间没有区别。
133+
对于 LocalSubjectAccessReviews，默认为 ""（空字符串）。
134+
对于集群范围的资源，默认为 ""（空字符串）。
135+
对于来自 SubjectAccessReview 或 SelfSubjectAccessReview 的命名空间范围的资源，""（空字符串）表示 "all"（所有资源）。
136+
137+
- **resourceAttributes.resource** (string)
138+
139+
resource 是现有的资源类别之一。
140+
"*" 表示所有资源类别。
141+
<!--
142+
- **resourceAttributes.subresource** (string)
143+
Subresource is one of the existing resource types. "" means none.
144+
145+
- **resourceAttributes.verb** (string)
146+
Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
147+
148+
- **resourceAttributes.version** (string)
149+
Version is the API Version of the Resource. "*" means all.
150+
-->
151+
- **resourceAttributes.subresource** (string)
152+
153+
subresource 是现有的资源类型之一。
154+
"" 表示无。
155+
156+
- **resourceAttributes.verb** (string)
157+
158+
verb 是 kubernetes 资源 API 动作，例如 get、list、watch、create、update、delete、proxy。
159+
"*" 表示所有动作。
160+
161+
- **resourceAttributes.version** (string)
162+
163+
version 是资源的 API 版本。
164+
"*" 表示所有版本。
165+
<!--
166+
## Operations {#Operations}
167+
168+
<hr>
169+
170+
### `create` create a SelfSubjectAccessReview
171+
172+
#### HTTP Request
173+
-->
174+
## 操作 {#Operations}
175+
176+
<hr>
177+
178+
### `create` 创建 SelfSubjectAccessReview
179+
180+
#### HTTP 请求
181+
182+
POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews
183+
<!--
184+
#### Parameters
185+
186+
- **body**: <a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReview" >}}">SelfSubjectAccessReview</a>, required
187+
188+
- **dryRun** (*in query*): string
189+
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
190+
191+
- **fieldManager** (*in query*): string
192+
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
193+
194+
- **fieldValidation** (*in query*): string
195+
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
196+
197+
- **pretty** (*in query*): string
198+
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
199+
-->
200+
#### 参数
201+
202+
- **body**: <a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReview" >}}">SelfSubjectAccessReview</a>，必需
203+
204+
- **dryRun** (**查询参数**): string
205+
206+
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
207+
208+
- **fieldManager** (**查询参数**): string
209+
210+
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
211+
212+
- **fieldValidation** (**查询参数**): string
213+
214+
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
215+
216+
- **pretty** (**查询参数**): string
217+
218+
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
219+
<!--
220+
#### Response
221+
-->
222+
#### 响应
223+
224+
200 (<a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReview" >}}">SelfSubjectAccessReview</a>): OK
225+
226+
201 (<a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReview" >}}">SelfSubjectAccessReview</a>): Created
227+
228+
202 (<a href="{{< ref "../authorization-resources/self-subject-access-review-v1#SelfSubjectAccessReview" >}}">SelfSubjectAccessReview</a>): Accepted
229+
230+
401: Unauthorized

0 commit comments

Comments
 (0)