PolicyRule Schema¶
Note
This is auto-generated documentation from a JSON schema that is under construction, this will improve over time.
Return to the root config schema
https://raw.githubusercontent.com/elastisys/compliantkubernetes-apps/main/config/schemas/config.yaml#/properties/user/properties/extraClusterRoles/additionalProperties/properties/rules/items
PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|---|---|---|---|---|---|---|---|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | config/schemas/config.yaml* |
TYPE:
object (PolicyRule)
PROPERTIES:
| Property | Type | Required | Nullable | Defined by |
|---|---|---|---|---|
| apiGroups | array |
Optional | cannot be null | Welkin Apps Config |
| nonResourceURLs | array |
Optional | cannot be null | Welkin Apps Config |
| resourceNames | array |
Optional | cannot be null | Welkin Apps Config |
| resources | array |
Optional | cannot be null | Welkin Apps Config |
| verbs | array |
Required | cannot be null | Welkin Apps Config |
apiGroups¶
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed.
apiGroups
-
is optional
-
Type:
string[] -
cannot be null
-
defined in: Welkin Apps Config
TYPE:
string[]
nonResourceURLs¶
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
nonResourceURLs
-
is optional
-
Type:
string[] -
cannot be null
-
defined in: Welkin Apps Config
TYPE:
string[]
resourceNames¶
ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
resourceNames
-
is optional
-
Type:
string[] -
cannot be null
-
defined in: Welkin Apps Config
TYPE:
string[]
resources¶
Resources is a list of resources this rule applies to. ResourceAll represents all resources.
resources
-
is optional
-
Type:
string[] -
cannot be null
-
defined in: Welkin Apps Config
TYPE:
string[]
verbs¶
Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
verbs
-
is required
-
Type:
string[] -
cannot be null
-
defined in: Welkin Apps Config
TYPE:
string[]
Return to the root config schema
Generated Sun Jan 19 03:48:14 UTC 2025 from elastisys/compliantkubernetes-apps@main