extra

object

Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.

extra{}

array (string)

groups

array (string)

Groups is the groups you’re testing for.

nonResourceAttributes

object

NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface

resourceAttributes

object

ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface

uid

UID information about the requesting user.

user

User is the user you’re testing for. If you specify “User” but not “Groups”, then is it interpreted as “What if User were not a member of any groups

path

string

Path is the URL path of the request

verb

string

Verb is the standard HTTP verb

allowed

boolean

Allowed is required. True if the action would be allowed, false otherwise.

denied

boolean

Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.

evaluationError

string

EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

reason

string

Reason is optional. It indicates why a request was allowed or denied.

namespace

string

object name and auth scope, such as for teams and projects

body

200 - OK

LocalSubjectAccessReview authorization.k8s.io/v1