@@ -48,3 +48,122 @@ type AdmissionPluginConfiguration struct {
4848 // +optional
4949 Configuration * runtime.Unknown `json:"configuration"`
5050}
51+
52+ // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
53+
54+ type AuthorizationConfiguration struct {
55+ metav1.TypeMeta
56+
57+ // Authorizers is an ordered list of authorizers to
58+ // authorize requests against.
59+ // This is similar to the --authorization-modes kube-apiserver flag
60+ // Must be at least one.
61+ Authorizers []AuthorizerConfiguration `json:"authorizers"`
62+ }
63+
64+ const (
65+ TypeWebhook AuthorizerType = "Webhook"
66+ FailurePolicyNoOpinion string = "NoOpinion"
67+ FailurePolicyDeny string = "Deny"
68+ AuthorizationWebhookConnectionInfoTypeKubeConfigFile string = "KubeConfigFile"
69+ AuthorizationWebhookConnectionInfoTypeInCluster string = "InClusterConfig"
70+ )
71+
72+ type AuthorizerType string
73+
74+ type AuthorizerConfiguration struct {
75+ // Type refers to the type of the authorizer
76+ // "Webhook" is supported in the generic API server
77+ // Other API servers may support additional authorizer
78+ // types like Node, RBAC, ABAC, etc.
79+ Type string `json:"type"`
80+
81+ // Name used to describe the webhook
82+ // This is explicitly used in monitoring machinery for metrics
83+ // Note: Names must be DNS1123 labels like `myauthorizername` or
84+ // subdomains like `myauthorizer.example.domain`
85+ // Required, with no default
86+ Name string `json:"name"`
87+
88+ // Webhook defines the configuration for a Webhook authorizer
89+ // Must be defined when Type=Webhook
90+ // Must not be defined when Type!=Webhook
91+ Webhook * WebhookConfiguration `json:"webhook,omitempty"`
92+ }
93+
94+ type WebhookConfiguration struct {
95+ // The duration to cache 'authorized' responses from the webhook
96+ // authorizer.
97+ // Same as setting `--authorization-webhook-cache-authorized-ttl` flag
98+ // Default: 5m0s
99+ AuthorizedTTL metav1.Duration `json:"authorizedTTL"`
100+ // The duration to cache 'unauthorized' responses from the webhook
101+ // authorizer.
102+ // Same as setting `--authorization-webhook-cache-unauthorized-ttl` flag
103+ // Default: 30s
104+ UnauthorizedTTL metav1.Duration `json:"unauthorizedTTL"`
105+ // Timeout for the webhook request
106+ // Maximum allowed value is 30s.
107+ // Required, no default value.
108+ Timeout metav1.Duration `json:"timeout"`
109+ // The API version of the authorization.k8s.io SubjectAccessReview to
110+ // send to and expect from the webhook.
111+ // Same as setting `--authorization-webhook-version` flag
112+ // Valid values: v1beta1, v1
113+ // Required, no default value
114+ SubjectAccessReviewVersion string `json:"subjectAccessReviewVersion"`
115+ // MatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview
116+ // version the CEL expressions are evaluated against
117+ // Valid values: v1
118+ // Required, no default value
119+ MatchConditionSubjectAccessReviewVersion string `json:"matchConditionSubjectAccessReviewVersion"`
120+ // Controls the authorization decision when a webhook request fails to
121+ // complete or returns a malformed response or errors evaluating
122+ // matchConditions.
123+ // Valid values:
124+ // - NoOpinion: continue to subsequent authorizers to see if one of
125+ // them allows the request
126+ // - Deny: reject the request without consulting subsequent authorizers
127+ // Required, with no default.
128+ FailurePolicy string `json:"failurePolicy"`
129+
130+ // ConnectionInfo defines how we talk to the webhook
131+ ConnectionInfo WebhookConnectionInfo `json:"connectionInfo"`
132+
133+ // matchConditions is a list of conditions that must be met for a request to be sent to this
134+ // webhook. An empty list of matchConditions matches all requests.
135+ // There are a maximum of 64 match conditions allowed.
136+ //
137+ // The exact matching logic is (in order):
138+ // 1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped.
139+ // 2. If ALL matchConditions evaluate to TRUE, then the webhook is called.
140+ // 3. If at least one matchCondition evaluates to an error (but none are FALSE):
141+ // - If failurePolicy=Deny, then the webhook rejects the request
142+ // - If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped
143+ MatchConditions []WebhookMatchCondition `json:"matchConditions"`
144+ }
145+
146+ type WebhookConnectionInfo struct {
147+ // Controls how the webhook should communicate with the server.
148+ // Valid values:
149+ // - KubeConfigFile: use the file specified in kubeConfigFile to locate the
150+ // server.
151+ // - InClusterConfig: use the in-cluster configuration to call the
152+ // SubjectAccessReview API hosted by kube-apiserver. This mode is not
153+ // allowed for kube-apiserver.
154+ Type string `json:"type"`
155+
156+ // Path to KubeConfigFile for connection info
157+ // Required, if connectionInfo.Type is KubeConfig
158+ KubeConfigFile * string `json:"kubeConfigFile"`
159+ }
160+
161+ type WebhookMatchCondition struct {
162+ // expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
163+ // CEL expressions have access to the contents of the SubjectAccessReview in v1 version.
164+ // If version specified by subjectAccessReviewVersion in the request variable is v1beta1,
165+ // the contents would be converted to the v1 version before evaluating the CEL expression.
166+ //
167+ // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
168+ Expression string `json:"expression"`
169+ }
0 commit comments