@@ -18,51 +18,45 @@ package v0
18
18
19
19
import (
20
20
"k8s.io/apimachinery/pkg/conversion"
21
- "k8s.io/apimachinery/pkg/runtime"
22
- api "k8s.io/kubernetes/pkg/apis/abac"
21
+ "k8s.io/kubernetes/pkg/apis/abac"
23
22
)
24
23
25
24
// allAuthenticated matches k8s.io/apiserver/pkg/authentication/user.AllAuthenticated,
26
25
// but we don't want a client library (which must include types), depending on a server library
27
26
const allAuthenticated = "system:authenticated"
28
27
29
- func addConversionFuncs (scheme * runtime.Scheme ) error {
30
- return scheme .AddConversionFuncs (
31
- func (in * Policy , out * api.Policy , s conversion.Scope ) error {
32
- // Begin by copying all fields
33
- out .Spec .User = in .User
34
- out .Spec .Group = in .Group
35
- out .Spec .Namespace = in .Namespace
36
- out .Spec .Resource = in .Resource
37
- out .Spec .Readonly = in .Readonly
38
-
39
- // In v0, unspecified user and group matches all authenticated subjects
40
- if len (in .User ) == 0 && len (in .Group ) == 0 {
41
- out .Spec .Group = allAuthenticated
42
- }
43
- // In v0, user or group of * matches all authenticated subjects
44
- if in .User == "*" || in .Group == "*" {
45
- out .Spec .Group = allAuthenticated
46
- out .Spec .User = ""
47
- }
48
-
49
- // In v0, leaving namespace empty matches all namespaces
50
- if len (in .Namespace ) == 0 {
51
- out .Spec .Namespace = "*"
52
- }
53
- // In v0, leaving resource empty matches all resources
54
- if len (in .Resource ) == 0 {
55
- out .Spec .Resource = "*"
56
- }
57
- // Any rule in v0 should match all API groups
58
- out .Spec .APIGroup = "*"
59
-
60
- // In v0, leaving namespace and resource blank allows non-resource paths
61
- if len (in .Namespace ) == 0 && len (in .Resource ) == 0 {
62
- out .Spec .NonResourcePath = "*"
63
- }
64
-
65
- return nil
66
- },
67
- )
28
+ func Convert_v0_Policy_To_abac_Policy (in * Policy , out * abac.Policy , s conversion.Scope ) error {
29
+ out .Spec .User = in .User
30
+ out .Spec .Group = in .Group
31
+ out .Spec .Namespace = in .Namespace
32
+ out .Spec .Resource = in .Resource
33
+ out .Spec .Readonly = in .Readonly
34
+
35
+ // In v0, unspecified user and group matches all authenticated subjects
36
+ if len (in .User ) == 0 && len (in .Group ) == 0 {
37
+ out .Spec .Group = allAuthenticated
38
+ }
39
+ // In v0, user or group of * matches all authenticated subjects
40
+ if in .User == "*" || in .Group == "*" {
41
+ out .Spec .Group = allAuthenticated
42
+ out .Spec .User = ""
43
+ }
44
+
45
+ // In v0, leaving namespace empty matches all namespaces
46
+ if len (in .Namespace ) == 0 {
47
+ out .Spec .Namespace = "*"
48
+ }
49
+ // In v0, leaving resource empty matches all resources
50
+ if len (in .Resource ) == 0 {
51
+ out .Spec .Resource = "*"
52
+ }
53
+ // Any rule in v0 should match all API groups
54
+ out .Spec .APIGroup = "*"
55
+
56
+ // In v0, leaving namespace and resource blank allows non-resource paths
57
+ if len (in .Namespace ) == 0 && len (in .Resource ) == 0 {
58
+ out .Spec .NonResourcePath = "*"
59
+ }
60
+
61
+ return nil
68
62
}
0 commit comments