LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
object
namespace
verb
resourceAPIGroup
resourceAPIVersion
resource
resourceName
path
isNonResourceURL
user
groups
scopes
Property | Type | Description |
---|---|---|
|
|
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources |
|
Content is the actual content of the request for create and update |
|
|
|
Groups is optional. Groups is the list of groups to which the user belongs. |
|
|
IsNonResourceURL is true if this is a request for a non-resource URL (outside of the resource hierarchy) |
|
|
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
|
|
Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces |
|
|
Path is the path of a non resource URL |
|
|
Resource is one of the existing resource types |
|
|
Group is the API group of the resource Serialized as resourceAPIGroup to avoid confusion with the 'groups' field when inlined |
|
|
Version is the API version of the resource Serialized as resourceAPIVersion to avoid confusion with TypeMeta.apiVersion and ObjectMeta.resourceVersion when inlined |
|
|
ResourceName is the name of the resource being requested for a "get" or deleted for a "delete" |
|
|
Scopes to use for the evaluation. Empty means "use the unscoped (full) permissions of the user/groups". Nil for a self-SAR, means "use the scopes on this request". Nil for a regular SAR, means the same as empty. |
|
|
user is optional. If both user and Groups are empty, the current authenticated user is used. |
|
|
Verb is one of: get, list, watch, create, update, delete |
The following API endpoints are available:
/apis/authorization.openshift.io/v1/namespaces/{namespace}/localsubjectaccessreviews
POST
: create a LocalSubjectAccessReview
Parameter | Type | Description |
---|---|---|
|
|
object name and auth scope, such as for teams and projects |
Parameter | Type | Description |
---|---|---|
|
|
If 'true', then the output is pretty printed. |
POST
create a LocalSubjectAccessReview
Parameter | Type | Description |
---|---|---|
|
HTTP code | Reponse body |
---|---|
200 - OK |
|
201 - Created |
|
202 - Accepted |
|
401 - Unauthorized |
Empty |