k8s-authorization.cedarschema

namespace k8s {
	@doc("ExtraAttribute represents a set of key-value pairs for an identity")
	type ExtraAttribute = {
		"key": __cedar::String,
		"values": Set < __cedar::String >
	};
	@doc("FieldRequirement represents a requirement on a field")
	type FieldRequirement = {
		"field": __cedar::String,
		"operator": __cedar::String,
		"value": __cedar::String
	};
	@doc("LabelRequirement represents a requirement on a label")
	type LabelRequirement = {
		"key": __cedar::String,
		"operator": __cedar::String,
		"values": Set < __cedar::String >
	};
	@doc("Extra represents a set of key-value pairs for an identity")
	entity Extra = {
		"key": __cedar::String,
		"value"?: __cedar::String
	};
	@doc("Group represents a Kubernetes group")
	entity Group = {
		"name": __cedar::String
	};
	@doc("Node represents a Kubernetes node identity")
	entity Node in [Group] = {
		"extra"?: Set < ExtraAttribute >,
		"name": __cedar::String
	};
	@doc("NonResourceURL represents a URL that is not associated with a Kubernetes resource")
	entity NonResourceURL = {
		"path": __cedar::String
	};
	@doc("PrincipalUID represents an impersonatable identifier for a principal")
	entity PrincipalUID;
	@doc("Resource represents an authorizable Kubernetes resource")
	entity Resource = {
		"apiGroup": __cedar::String,
		"fieldSelector"?: Set < FieldRequirement >,
		"labelSelector"?: Set < LabelRequirement >,
		"name"?: __cedar::String,
		"namespace"?: __cedar::String,
		"resource": __cedar::String,
		"subresource"?: __cedar::String
	};
	@doc("ServiceAccount represents a Kubernetes service account identity")
	entity ServiceAccount in [Group] = {
		"extra"?: Set < ExtraAttribute >,
		"name": __cedar::String,
		"namespace": __cedar::String
	};
	@doc("User represents a Kubernetes user identity")
	entity User in [Group] = {
		"extra"?: Set < ExtraAttribute >,
		"name": __cedar::String
	};
	action "approve" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "attest" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "bind" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "create" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "delete" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL, Resource],
		context: {}
	};
	action "deletecollection" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "escalate" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "get" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL, Resource],
		context: {}
	};
	action "head" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL],
		context: {}
	};
	action "impersonate" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Extra, Group, Node, PrincipalUID, ServiceAccount, User],
		context: {}
	};
	action "list" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "options" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL],
		context: {}
	};
	action "patch" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL, Resource],
		context: {}
	};
	action "post" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL],
		context: {}
	};
	action "put" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [NonResourceURL],
		context: {}
	};
	action "sign" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "update" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "use" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
	action "watch" appliesTo {
		principal: [Group, Node, ServiceAccount, User],
		resource: [Resource],
		context: {}
	};
}