Add Access Control List API types and conditions

apis/acl/acl_types.go

@@ -0,0 +1,36 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package acl
+
+// AccessFrom defines an ACL for allowing cross-namespace references to a source object
+// based on the caller's namespace labels.
+type AccessFrom struct {
+	// NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+	// Items in this list are evaluated using a logical OR operation.
+	// +required
+	NamespaceSelectors []NamespaceSelector `json:"namespaceSelectors"`
+}
+
+// NamespaceSelector selects the namespaces to which this ACL applies.
+// An empty map of MatchLabels matches all namespaces in a cluster.
+type NamespaceSelector struct {
+	// MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+	// map is equivalent to an element of matchExpressions, whose key field is "key", the
+	// operator is "In", and the values array contains only "value". The requirements are ANDed.
+	// +optional
+	MatchLabels map[string]string `json:"matchLabels,omitempty"`
+}

apis/acl/conditions.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package acl
+
+// These constants define the Condition types for when the GitOps Toolkit components perform ACL assertions.
+const (
+	// AccessDeniedCondition indicates that access to a resource has been denied by an ACL assertion.
+	// The Condition adheres to an "abnormal-true" polarity pattern, and MUST only be present on the resource if the
+	// Condition is True.
+	AccessDeniedCondition string = "AccessDenied"
+)
+
+// These constants define the Condition reasons for when the GitOps Toolkit components perform ACL assertions.
+const (
+	// AccessDeniedReason indicates that access to a resource has been denied by an ACL assertion.
+	AccessDeniedReason string = "AccessDenied"
+)

apis/acl/doc.go

@@ -0,0 +1,19 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package acl contains the API types for defining access control lists for use by GitOps Toolkit components.
+// +kubebuilder:object:generate=true
+package acl

apis/acl/go.mod

@@ -0,0 +1,3 @@
+module github.com/fluxcd/pkg/apis/acl
+
+go 1.16