paralus/proto/rpc/sentry/cluster_authz.proto

syntax = "proto3";
package paralus.dev.sentry.rpc;

import "google/api/annotations.proto";
import "protoc-gen-openapiv2/options/annotations.proto";
import "proto/types/controller/cluster_controller.proto";

option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  info : {
    title : "Sentry Cluster Authorization Service"
    version : "2.0"
    contact : {name : "Paralus Dev"}
  }
  schemes : HTTPS
  consumes : "application/json"
  consumes : "application/yaml"
  produces : "application/json"
  produces : "application/yaml"
  security_definitions : {
    security : {
      key : "BasicAuth"
      value : {type : TYPE_BASIC}
    }
    security : {
      key : "ApiKeyAuth"
      value : {type : TYPE_API_KEY in : IN_HEADER name : "X-API-KEYID"}
    }
    security : {
      key : "ApiTokenAuth"
      value : {
        type : TYPE_API_KEY in : IN_HEADER name : "X-API-TOKEN"
      }
    }
  }
  security : {
    security_requirement : {
      key : "BasicAuth"
      value : {}
    }
    security_requirement : {
      key : "ApiKeyAuth"
      value : {}
    }
    security_requirement : {
      key : "ApiTokenAuth"
      value : {}
    }
  }
  responses : {
    key : "403"
    value : {
      description : "Returned when the user does not have permission to access "
                    "the resource."
    }
  }
  responses : {
    key : "404"
    value : {
      description : "Returned when the resource does not exist."
      schema : {json_schema : {type : STRING}}
    }
  }
};

message GetUserAuthorizationResponse {
  string userName = 1;
  paralus.dev.types.controller.StepObject serviceAccount = 2;
  repeated paralus.dev.types.controller.StepObject clusterRoles = 3;
  repeated paralus.dev.types.controller.StepObject clusterRoleBindings = 4;
  repeated paralus.dev.types.controller.StepObject roles = 5;
  repeated paralus.dev.types.controller.StepObject roleBindings = 6;
  repeated paralus.dev.types.controller.StepObject deleteClusterRoleBindings = 7;
  repeated paralus.dev.types.controller.StepObject deleteRoleBindings = 8;
  repeated paralus.dev.types.controller.StepObject namespaces = 9;
  string roleName = 10;
  bool isRead = 11;
  bool enforceOrgAdminOnlySecretAccess = 12;
  bool isOrgAdmin = 13;
}

message GetUserAuthorizationRequest {
  string userCN = 1;
  string clusterID = 2;
  int64 certIssueSeconds  = 3;
}

service ClusterAuthorizationService {
  rpc GetUserAuthorization(GetUserAuthorizationRequest)
      returns (GetUserAuthorizationResponse) {
    option (google.api.http) = {
      get : "/v2/sentry/authorization/user"
    };
  };
}