Generated protobufs

pkg/apis/authorization/v1beta1/generated.proto

@@ -43,6 +43,7 @@ message ExtraValue {
 // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
 // checking.
 message LocalSubjectAccessReview {
+  // +optional
   optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
 
   // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
@@ -50,15 +51,18 @@ message LocalSubjectAccessReview {
   optional SubjectAccessReviewSpec spec = 2;
 
   // Status is filled in by the server and indicates whether the request is allowed or not
+  // +optional
   optional SubjectAccessReviewStatus status = 3;
 }
 
 // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
 message NonResourceAttributes {
   // Path is the URL path of the request
+  // +optional
   optional string path = 1;
 
   // Verb is the standard HTTP verb
+  // +optional
   optional string verb = 2;
 }
 
@@ -68,24 +72,31 @@ message ResourceAttributes {
   // "" (empty) is defaulted for LocalSubjectAccessReviews
   // "" (empty) is empty for cluster-scoped resources
   // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
+  // +optional
   optional string namespace = 1;
 
   // Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
+  // +optional
   optional string verb = 2;
 
   // Group is the API Group of the Resource.  "*" means all.
+  // +optional
   optional string group = 3;
 
   // Version is the API Version of the Resource.  "*" means all.
+  // +optional
   optional string version = 4;
 
   // Resource is one of the existing resource types.  "*" means all.
+  // +optional
   optional string resource = 5;
 
   // Subresource is one of the existing resource types.  "" means none.
+  // +optional
   optional string subresource = 6;
 
   // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
+  // +optional
   optional string name = 7;
 }
 
@@ -93,12 +104,14 @@ message ResourceAttributes {
 // spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
 // to check whether they can perform an action
 message SelfSubjectAccessReview {
+  // +optional
   optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
 
   // Spec holds information about the request being evaluated.  user and groups must be empty
   optional SelfSubjectAccessReviewSpec spec = 2;
 
   // Status is filled in by the server and indicates whether the request is allowed or not
+  // +optional
   optional SubjectAccessReviewStatus status = 3;
 }
 
@@ -106,20 +119,24 @@ message SelfSubjectAccessReview {
 // and NonResourceAuthorizationAttributes must be set
 message SelfSubjectAccessReviewSpec {
   // ResourceAuthorizationAttributes describes information for a resource access request
+  // +optional
   optional ResourceAttributes resourceAttributes = 1;
 
   // NonResourceAttributes describes information for a non-resource access request
+  // +optional
   optional NonResourceAttributes nonResourceAttributes = 2;
 }
 
 // SubjectAccessReview checks whether or not a user or group can perform an action.
 message SubjectAccessReview {
+  // +optional
   optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
 
   // Spec holds information about the request being evaluated
   optional SubjectAccessReviewSpec spec = 2;
 
   // Status is filled in by the server and indicates whether the request is allowed or not
+  // +optional
   optional SubjectAccessReviewStatus status = 3;
 }
 
@@ -127,20 +144,25 @@ message SubjectAccessReview {
 // and NonResourceAuthorizationAttributes must be set
 message SubjectAccessReviewSpec {
   // ResourceAuthorizationAttributes describes information for a resource access request
+  // +optional
   optional ResourceAttributes resourceAttributes = 1;
 
   // NonResourceAttributes describes information for a non-resource access request
+  // +optional
   optional NonResourceAttributes nonResourceAttributes = 2;
 
   // User is the user you're testing for.
   // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
+  // +optional
   optional string verb = 3;
 
   // Groups is the groups you're testing for.
+  // +optional
   repeated string group = 4;
 
   // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
   // it needs a reflection here.
+  // +optional
   map<string, ExtraValue> extra = 5;
 }
 
@@ -150,11 +172,13 @@ message SubjectAccessReviewStatus {
   optional bool allowed = 1;
 
   // Reason is optional.  It indicates why a request was allowed or denied.
+  // +optional
   optional string reason = 2;
 
   // EvaluationError is an indication that some error occurred during the authorization check.
   // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
   // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
+  // +optional
   optional string evaluationError = 3;
 }