cdk8s-plus-25
Version:
cdk8s+ is a software development framework that provides high level abstractions for authoring Kubernetes applications. cdk8s-plus-25 synthesizes Kubernetes manifests for Kubernetes 1.25.0
269 lines (268 loc) • 8.89 kB
TypeScript
import { ApiObject } from 'cdk8s';
import { Construct } from 'constructs';
import { IApiResource, IApiEndpoint } from './api-resource.generated';
import * as base from './base';
import * as rb from './role-binding';
/**
* A reference to any Role or ClusterRole.
*/
export interface IRole extends base.IResource {
}
/**
* Properties for `Role`.
*/
export interface RoleProps extends base.ResourceProps {
/**
* A list of rules the role should allow.
*
* @default []
*/
readonly rules?: RolePolicyRule[];
}
/**
* Policy rule of a `Role.
*/
export interface RolePolicyRule {
/**
* Verbs to allow. (e.g ['get', 'watch'])
*/
readonly verbs: string[];
/**
* Resources this rule applies to.
*/
readonly resources: IApiResource[];
}
/**
* Role is a namespaced, logical grouping of PolicyRules that can be referenced
* as a unit by a RoleBinding.
*/
export declare class Role extends base.Resource implements IRole {
/**
* Imports a role from the cluster as a reference.
*/
static fromRoleName(scope: Construct, id: string, name: string): IRole;
/**
* @see base.Resource.apiObject
*/
protected readonly apiObject: ApiObject;
readonly resourceType = "roles";
private readonly _rules;
constructor(scope: Construct, id: string, props?: RoleProps);
/**
* Rules associaated with this Role.
* Returns a copy, use `allow` to add rules.
*/
get rules(): RolePolicyRule[];
/**
* Add permission to perform a list of HTTP verbs on a collection of
* resources.
*
* @param resources The resource(s) to apply to
* @see https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb
*/
allow(verbs: string[], ...resources: IApiResource[]): void;
/**
* Add "create" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowCreate(...resources: IApiResource[]): void;
/**
* Add "get" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowGet(...resources: IApiResource[]): void;
/**
* Add "list" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowList(...resources: IApiResource[]): void;
/**
* Add "watch" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowWatch(...resources: IApiResource[]): void;
/**
* Add "update" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowUpdate(...resources: IApiResource[]): void;
/**
* Add "patch" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowPatch(...resources: IApiResource[]): void;
/**
* Add "delete" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowDelete(...resources: IApiResource[]): void;
/**
* Add "deletecollection" permission for the resources.
* @param resources The resource(s) to apply to
*/
allowDeleteCollection(...resources: IApiResource[]): void;
/**
* Add "get", "list", and "watch" permissions for the resources.
* @param resources The resource(s) to apply to
*/
allowRead(...resources: IApiResource[]): void;
/**
* Add "get", "list", "watch", "create", "update", "patch", "delete", and
* "deletecollection" permissions for the resources.
*
* @param resources The resource(s) to apply to
*/
allowReadWrite(...resources: IApiResource[]): void;
/**
* Create a RoleBinding that binds the permissions in this Role
* to a list of subjects, that will only apply this role's namespace.
* @param subjects a list of subjects to bind to
*/
bind(...subjects: rb.ISubject[]): rb.RoleBinding;
private synthesizeRules;
}
/**
* Represents a cluster-level role.
*/
export interface IClusterRole extends base.IResource {
}
/**
* Properties for `ClusterRole`.
*/
export interface ClusterRoleProps extends base.ResourceProps {
/**
* A list of rules the role should allow.
*
* @default []
*/
readonly rules?: ClusterRolePolicyRule[];
/**
* Specify labels that should be used to locate ClusterRoles, whose rules
* will be automatically filled into this ClusterRole's rules.
*/
readonly aggregationLabels?: {
[key: string]: string;
};
}
/**
* Policy rule of a `ClusterRole.
*/
export interface ClusterRolePolicyRule {
/**
* Verbs to allow. (e.g ['get', 'watch'])
*/
readonly verbs: string[];
/**
* Endpoints this rule applies to. Can be either api resources
* or non api resources.
*/
readonly endpoints: IApiEndpoint[];
}
/**
* ClusterRole is a cluster level, logical grouping of PolicyRules that can be
* referenced as a unit by a RoleBinding or ClusterRoleBinding.
*/
export declare class ClusterRole extends base.Resource implements IClusterRole, IRole {
/**
* Imports a role from the cluster as a reference.
*/
static fromClusterRoleName(scope: Construct, id: string, name: string): IClusterRole;
/**
* @see base.Resource.apiObject
*/
protected readonly apiObject: ApiObject;
readonly resourceType = "clusterroles";
private readonly _labelSelector;
private readonly _rules;
constructor(scope: Construct, id: string, props?: ClusterRoleProps);
/**
* Rules associaated with this Role.
* Returns a copy, use `allow` to add rules.
*/
get rules(): ClusterRolePolicyRule[];
/**
* Add permission to perform a list of HTTP verbs on a collection of
* resources.
*
* @param endpoints The endpoints(s) to apply to
* @see https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb
*/
allow(verbs: string[], ...endpoints: IApiEndpoint[]): void;
/**
* Add "create" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowCreate(...endpoints: IApiEndpoint[]): void;
/**
* Add "get" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowGet(...endpoints: IApiEndpoint[]): void;
/**
* Add "list" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowList(...endpoints: IApiEndpoint[]): void;
/**
* Add "watch" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowWatch(...endpoints: IApiEndpoint[]): void;
/**
* Add "update" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowUpdate(...endpoints: IApiEndpoint[]): void;
/**
* Add "patch" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowPatch(...endpoints: IApiEndpoint[]): void;
/**
* Add "delete" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowDelete(...endpoints: IApiEndpoint[]): void;
/**
* Add "deletecollection" permission for the resources.
* @param endpoints The resource(s) to apply to
*/
allowDeleteCollection(...endpoints: IApiEndpoint[]): void;
/**
* Add "get", "list", and "watch" permissions for the resources.
* @param endpoints The resource(s) to apply to
*/
allowRead(...endpoints: IApiEndpoint[]): void;
/**
* Add "get", "list", "watch", "create", "update", "patch", "delete", and
* "deletecollection" permissions for the resources.
*
* @param endpoints The resource(s) to apply to
*/
allowReadWrite(...endpoints: IApiEndpoint[]): void;
/**
* Aggregate rules from roles matching this label selector.
*/
aggregate(key: string, value: string): void;
/**
* Combines the rules of the argument ClusterRole into this ClusterRole
* using aggregation labels.
* @param rol
*/
combine(rol: ClusterRole): void;
/**
* Create a RoleBinding that binds the permissions in this ClusterRole
* to a list of subjects, that will only apply to the given namespace.
* @param namespace the namespace to limit permissions to.
* @param subjects a list of subjects to bind to
*/
bindInNamespace(namespace: string, ...subjects: rb.ISubject[]): rb.RoleBinding;
/**
* Create a ClusterRoleBinding that binds the permissions in this
* ClusterRole to a list of subjects, without namespace restrictions.
* @param subjects a list of subjects to bind to
*/
bind(...subjects: rb.ISubject[]): rb.ClusterRoleBinding;
private synthesizeRules;
private synthesizeAggregationRules;
}