kubernetes/staging/src/k8s.io/apiserver/pkg/util/flowcontrol/rule.go

// Tests whether a given request and FlowSchema match.  Nobody mutates
// either input.
func matchesFlowSchema(digest RequestDigest, flowSchema *flowcontrol.FlowSchema) bool { … }

func matchesPolicyRule(digest RequestDigest, policyRule *flowcontrol.PolicyRulesWithSubjects) bool { … }

func matchesASubject(user user.Info, subjects []flowcontrol.Subject) bool { … }

func matchesSubject(user user.Info, subject flowcontrol.Subject) bool { … }

// serviceAccountMatchesNamespace checks whether the provided service account username matches the namespace, without
// allocating. Use this when checking a service account namespace against a known string.
// This is copied from `k8s.io/apiserver/pkg/authentication/serviceaccount::MatchesUsername` and simplified to not check the name part.
func serviceAccountMatchesNamespace(namespace string, username string) bool { … }

func matchesAResourceRule(ri *request.RequestInfo, rules []flowcontrol.ResourcePolicyRule) bool { … }

func matchesResourcePolicyRule(ri *request.RequestInfo, policyRule flowcontrol.ResourcePolicyRule) bool { … }

func matchesANonResourceRule(ri *request.RequestInfo, rules []flowcontrol.NonResourcePolicyRule) bool { … }

func matchesNonResourcePolicyRule(ri *request.RequestInfo, policyRule flowcontrol.NonResourcePolicyRule) bool { … }

func matchPolicyRuleVerb(policyRuleVerbs []string, requestVerb string) bool { … }

func matchPolicyRuleNonResourceURL(policyRuleRequestURLs []string, requestPath string) bool { … }

func matchPolicyRuleAPIGroup(policyRuleAPIGroups []string, requestAPIGroup string) bool { … }

func rsJoin(requestResource, requestSubresource string) string { … }

func matchPolicyRuleResource(policyRuleRequestResources []string, requestResource, requestSubresource string) bool { … }

// containsString returns true if either `x` or `wildcard` is in
// `list`.  The wildcard is not a pattern to match against `x`; rather
// the presence of the wildcard in the list is the caller's way of
// saying that all values of `x` should match the list.  This function
// assumes that if `wildcard` is in `list` then it is the only member
// of the list, which is enforced by validation.
func containsString(x string, list []string, wildcard string) bool { … }