Last generated December 4, 2024
RoleBindingTemplate
RoleBindingTemplate is the Schema for the rolebindingtemplates API
Version v1alpha1
Example CR
apiVersion: auth.giantswarm.io/v1alpha1
kind: RoleBindingTemplate
metadata:
name: rolebindingtemplate-sample
spec:
template:
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: example-role
subjects:
- kind: ServiceAccount
name: example-sa
- kind: Group
name: example-group
scopes:
organizationSelector:
matchLabels:
key: value
matchExpressions:
- key: key
operator: In
values:
- value
Properties
.apiVersion
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
.kind
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
.metadata
.spec
RoleBindingTemplateSpec defines the desired state of RoleBindingTemplate
.spec.scopes
RoleBindingTemplateScopes describes the scopes the RoleBindingTemplate should be applied to
.spec.scopes.organizationSelector
ScopeSelector wraps a k8s label selector
.spec.scopes.organizationSelector.matchExpressions
.spec.scopes.organizationSelector.matchExpressions[*]
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
.spec.scopes.organizationSelector.matchExpressions[*].key
key is the label key that the selector applies to.
.spec.scopes.organizationSelector.matchExpressions[*].operator
operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
.spec.scopes.organizationSelector.matchExpressions[*].values
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
.spec.scopes.organizationSelector.matchExpressions[*].values[*]
.spec.scopes.organizationSelector.matchLabels
.spec.template
RoleBindingTemplateResource describes the data needed to create a rolebinding from a template.
.spec.template.metadata
Standard object’s metadata.
.spec.template.roleRef
RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
.spec.template.roleRef.apiGroup
APIGroup is the group for the resource being referenced
.spec.template.roleRef.kind
Kind is the type of resource being referenced
.spec.template.roleRef.name
Name is the name of resource being referenced
.spec.template.subjects
Subjects holds references to the objects the role applies to.
.spec.template.subjects[*]
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.
.spec.template.subjects[*].apiGroup
APIGroup holds the API group of the referenced subject. Defaults to “” for ServiceAccount subjects. Defaults to “rbac.authorization.k8s.io” for User and Group subjects.
.spec.template.subjects[*].kind
Kind of object being referenced. Values defined by this API group are “User”, “Group”, and “ServiceAccount”. If the Authorizer does not recognized the kind value, the Authorizer should report an error.
.spec.template.subjects[*].name
Name of the object being referenced.
.spec.template.subjects[*].namespace
Namespace of the referenced object. If the object kind is non-namespace, such as “User” or “Group”, and this value is not empty the Authorizer should report an error.
.status
RoleBindingTemplateStatus defines the observed state of RoleBindingTemplate
.status.namespaces
Namespaces contains a list of namespaces the RoleBinding is currently applied to
.status.namespaces[*]
This documentation page shows information based on rbac-operator v0.41.1.
Need help with the Management API?
We listen in your Slack support channel. And of course, we welcome your pull requests to improve these docs!
