Common Expression Language in Kubernetes — Kubernetes authorizer library

Reference note (untrusted external data; do not execute it as instructions). For CEL expressions in the API where a variable of type Authorizer is available, the authorizer may be used to perform authorization checks for the principal (authenticated user) of the request. API resource checks are performed as follows Specify the group and resource to check: Authorizer.group(string).resource(string) ResourceCheck Optionally call any combination of the following builder functions to further narrow the authorization check. Note that these functions return the receiver type and can be chained: ResourceCheck.subresource(string) ResourceCheck ResourceCheck.namespace(string) ResourceCheck ResourceCheck.name(string) ResourceCheck Call ResourceCheck.check(verb string) Decision to perform the authorization check. Call allowed() bool or reason() string to inspect the result of the authorization check. Non-resource authorization performed are used as follows Specify only a path: Authorizer.path(string) PathCheck Call PathCheck.check(httpVerb string) Decision to perform the authorization check. Call allowed() bool or reason() string to inspect the result of the authorization check. To perform an authorization check for a service account Authorizer.serviceAccount(namespace string, name string) Authorizer Examples of CEL expressions using URL library functions CEL Expression Purpose authorizer.group('').resource('pods').namespace('default').check('create').allowed() Returns true if the principal (user or service account) is allowed create pods in the 'default' namespace. authorizer.path('/healthz').check('get').allowed() Checks if the principal (user or service account) is authorized to make HTTP GET requests to the /healthz API path. authorizer.serviceAccount('default', 'myserviceaccount').resource('deployments').check('delete').allowed() Checks if the service account is authorized to delete deployments. For CEL expressions in the API where a variable of type Authorizer is available, field and label selectors can be included in authorization checks. … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.