Update ingress godeps

vendor/k8s.io/kubernetes/pkg/apis/authorization/deep_copy_generated.go

@@ -1,149 +0,0 @@
-// +build !ignore_autogenerated
-
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// This file was autogenerated by deepcopy-gen. Do not edit it manually!
-
-package authorization
-
-import (
-	api "k8s.io/kubernetes/pkg/api"
-	conversion "k8s.io/kubernetes/pkg/conversion"
-)
-
-func init() {
-	if err := api.Scheme.AddGeneratedDeepCopyFuncs(
-		DeepCopy_authorization_LocalSubjectAccessReview,
-		DeepCopy_authorization_NonResourceAttributes,
-		DeepCopy_authorization_ResourceAttributes,
-		DeepCopy_authorization_SelfSubjectAccessReview,
-		DeepCopy_authorization_SelfSubjectAccessReviewSpec,
-		DeepCopy_authorization_SubjectAccessReview,
-		DeepCopy_authorization_SubjectAccessReviewSpec,
-		DeepCopy_authorization_SubjectAccessReviewStatus,
-	); err != nil {
-		// if one of the deep copy functions is malformed, detect it immediately.
-		panic(err)
-	}
-}
-
-func DeepCopy_authorization_LocalSubjectAccessReview(in LocalSubjectAccessReview, out *LocalSubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_authorization_SubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_authorization_NonResourceAttributes(in NonResourceAttributes, out *NonResourceAttributes, c *conversion.Cloner) error {
-	out.Path = in.Path
-	out.Verb = in.Verb
-	return nil
-}
-
-func DeepCopy_authorization_ResourceAttributes(in ResourceAttributes, out *ResourceAttributes, c *conversion.Cloner) error {
-	out.Namespace = in.Namespace
-	out.Verb = in.Verb
-	out.Group = in.Group
-	out.Version = in.Version
-	out.Resource = in.Resource
-	out.Subresource = in.Subresource
-	out.Name = in.Name
-	return nil
-}
-
-func DeepCopy_authorization_SelfSubjectAccessReview(in SelfSubjectAccessReview, out *SelfSubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_authorization_SelfSubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_authorization_SelfSubjectAccessReviewSpec(in SelfSubjectAccessReviewSpec, out *SelfSubjectAccessReviewSpec, c *conversion.Cloner) error {
-	if in.ResourceAttributes != nil {
-		in, out := in.ResourceAttributes, &out.ResourceAttributes
-		*out = new(ResourceAttributes)
-		**out = *in
-	} else {
-		out.ResourceAttributes = nil
-	}
-	if in.NonResourceAttributes != nil {
-		in, out := in.NonResourceAttributes, &out.NonResourceAttributes
-		*out = new(NonResourceAttributes)
-		**out = *in
-	} else {
-		out.NonResourceAttributes = nil
-	}
-	return nil
-}
-
-func DeepCopy_authorization_SubjectAccessReview(in SubjectAccessReview, out *SubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_authorization_SubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_authorization_SubjectAccessReviewSpec(in SubjectAccessReviewSpec, out *SubjectAccessReviewSpec, c *conversion.Cloner) error {
-	if in.ResourceAttributes != nil {
-		in, out := in.ResourceAttributes, &out.ResourceAttributes
-		*out = new(ResourceAttributes)
-		**out = *in
-	} else {
-		out.ResourceAttributes = nil
-	}
-	if in.NonResourceAttributes != nil {
-		in, out := in.NonResourceAttributes, &out.NonResourceAttributes
-		*out = new(NonResourceAttributes)
-		**out = *in
-	} else {
-		out.NonResourceAttributes = nil
-	}
-	out.User = in.User
-	if in.Groups != nil {
-		in, out := in.Groups, &out.Groups
-		*out = make([]string, len(in))
-		copy(*out, in)
-	} else {
-		out.Groups = nil
-	}
-	if in.Extra != nil {
-		in, out := in.Extra, &out.Extra
-		*out = make(map[string][]string)
-		for key, val := range in {
-			if newVal, err := c.DeepCopy(val); err != nil {
-				return err
-			} else {
-				(*out)[key] = newVal.([]string)
-			}
-		}
-	} else {
-		out.Extra = nil
-	}
-	return nil
-}
-
-func DeepCopy_authorization_SubjectAccessReviewStatus(in SubjectAccessReviewStatus, out *SubjectAccessReviewStatus, c *conversion.Cloner) error {
-	out.Allowed = in.Allowed
-	out.Reason = in.Reason
-	return nil
-}

vendor/k8s.io/kubernetes/pkg/apis/authorization/doc.go

@@ -16,4 +16,5 @@ limitations under the License.
 
 // +k8s:deepcopy-gen=package,register
 
+// +groupName=authorization.k8s.io
 package authorization

vendor/k8s.io/kubernetes/pkg/apis/authorization/install/install.go

@@ -89,7 +89,10 @@ func enableVersions(externalVersions []unversioned.GroupVersion) error {
 
 func addVersionsToScheme(externalVersions ...unversioned.GroupVersion) {
 	// add the internal version to Scheme
-	authorization.AddToScheme(api.Scheme)
+	if err := authorization.AddToScheme(api.Scheme); err != nil {
+		// Programmer error, detect immediately
+		panic(err)
+	}
 	// add the enabled external versions to Scheme
 	for _, v := range externalVersions {
 		if !registered.IsEnabledVersion(v) {
@@ -98,7 +101,10 @@ func addVersionsToScheme(externalVersions ...unversioned.GroupVersion) {
 		}
 		switch v {
 		case v1beta1.SchemeGroupVersion:
-			v1beta1.AddToScheme(api.Scheme)
+			if err := v1beta1.AddToScheme(api.Scheme); err != nil {
+				// Programmer error, detect immediately
+				panic(err)
+			}
 		}
 	}
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/register.go

@@ -37,14 +37,16 @@ func Resource(resource string) unversioned.GroupResource {
 	return SchemeGroupVersion.WithResource(resource).GroupResource()
 }
 
-func AddToScheme(scheme *runtime.Scheme) {
-	addKnownTypes(scheme)
-}
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
 
-func addKnownTypes(scheme *runtime.Scheme) {
+func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&SelfSubjectAccessReview{},
 		&SubjectAccessReview{},
 		&LocalSubjectAccessReview{},
 	)
+	return nil
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/types.go

@@ -17,13 +17,19 @@ limitations under the License.
 package authorization
 
 import (
+	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/unversioned"
 )
 
+// +genclient=true
+// +nonNamespaced=true
+// +noMethods=true
+
 // SubjectAccessReview checks whether or not a user or group can perform an action.  Not filling in a
 // spec.namespace means "in all namespaces".
 type SubjectAccessReview struct {
 	unversioned.TypeMeta
+	api.ObjectMeta
 
 	// Spec holds information about the request being evaluated
 	Spec SubjectAccessReviewSpec
@@ -37,6 +43,7 @@ type SubjectAccessReview struct {
 // to check whether they can perform an action
 type SelfSubjectAccessReview struct {
 	unversioned.TypeMeta
+	api.ObjectMeta
 
 	// Spec holds information about the request being evaluated.
 	Spec SelfSubjectAccessReviewSpec
@@ -50,6 +57,7 @@ type SelfSubjectAccessReview struct {
 // checking.
 type LocalSubjectAccessReview struct {
 	unversioned.TypeMeta
+	api.ObjectMeta
 
 	// Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
 	// you made the request against.  If empty, it is defaulted.
@@ -103,9 +111,13 @@ type SubjectAccessReviewSpec struct {
 	Groups []string
 	// Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
 	// it needs a reflection here.
-	Extra map[string][]string
+	Extra map[string]ExtraValue
 }
 
+// ExtraValue masks the value so protobuf can generate
+// +protobuf.nullable=true
+type ExtraValue []string
+
 // SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAttributes
 // and NonResourceAttributes must be set
 type SelfSubjectAccessReviewSpec struct {
@@ -121,4 +133,8 @@ type SubjectAccessReviewStatus struct {
 	Allowed bool
 	// Reason is optional.  It indicates why a request was allowed or denied.
 	Reason string
+	// EvaluationError is an indication that some error occurred during the authorization check.
+	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
+	// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
+	EvaluationError string
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/conversion.go

@@ -20,11 +20,7 @@ import (
 	"k8s.io/kubernetes/pkg/runtime"
 )
 
-func addConversionFuncs(scheme *runtime.Scheme) {
+func addConversionFuncs(scheme *runtime.Scheme) error {
 	// Add non-generated conversion functions
-	err := scheme.AddConversionFuncs()
-	if err != nil {
-		// If one of the conversion functions is malformed, detect it immediately.
-		panic(err)
-	}
+	return scheme.AddConversionFuncs()
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/deep_copy_generated.go

@@ -1,149 +0,0 @@
-// +build !ignore_autogenerated
-
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// This file was autogenerated by deepcopy-gen. Do not edit it manually!
-
-package v1beta1
-
-import (
-	api "k8s.io/kubernetes/pkg/api"
-	conversion "k8s.io/kubernetes/pkg/conversion"
-)
-
-func init() {
-	if err := api.Scheme.AddGeneratedDeepCopyFuncs(
-		DeepCopy_v1beta1_LocalSubjectAccessReview,
-		DeepCopy_v1beta1_NonResourceAttributes,
-		DeepCopy_v1beta1_ResourceAttributes,
-		DeepCopy_v1beta1_SelfSubjectAccessReview,
-		DeepCopy_v1beta1_SelfSubjectAccessReviewSpec,
-		DeepCopy_v1beta1_SubjectAccessReview,
-		DeepCopy_v1beta1_SubjectAccessReviewSpec,
-		DeepCopy_v1beta1_SubjectAccessReviewStatus,
-	); err != nil {
-		// if one of the deep copy functions is malformed, detect it immediately.
-		panic(err)
-	}
-}
-
-func DeepCopy_v1beta1_LocalSubjectAccessReview(in LocalSubjectAccessReview, out *LocalSubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_v1beta1_SubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_v1beta1_NonResourceAttributes(in NonResourceAttributes, out *NonResourceAttributes, c *conversion.Cloner) error {
-	out.Path = in.Path
-	out.Verb = in.Verb
-	return nil
-}
-
-func DeepCopy_v1beta1_ResourceAttributes(in ResourceAttributes, out *ResourceAttributes, c *conversion.Cloner) error {
-	out.Namespace = in.Namespace
-	out.Verb = in.Verb
-	out.Group = in.Group
-	out.Version = in.Version
-	out.Resource = in.Resource
-	out.Subresource = in.Subresource
-	out.Name = in.Name
-	return nil
-}
-
-func DeepCopy_v1beta1_SelfSubjectAccessReview(in SelfSubjectAccessReview, out *SelfSubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_v1beta1_SelfSubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_v1beta1_SelfSubjectAccessReviewSpec(in SelfSubjectAccessReviewSpec, out *SelfSubjectAccessReviewSpec, c *conversion.Cloner) error {
-	if in.ResourceAttributes != nil {
-		in, out := in.ResourceAttributes, &out.ResourceAttributes
-		*out = new(ResourceAttributes)
-		**out = *in
-	} else {
-		out.ResourceAttributes = nil
-	}
-	if in.NonResourceAttributes != nil {
-		in, out := in.NonResourceAttributes, &out.NonResourceAttributes
-		*out = new(NonResourceAttributes)
-		**out = *in
-	} else {
-		out.NonResourceAttributes = nil
-	}
-	return nil
-}
-
-func DeepCopy_v1beta1_SubjectAccessReview(in SubjectAccessReview, out *SubjectAccessReview, c *conversion.Cloner) error {
-	out.TypeMeta = in.TypeMeta
-	if err := DeepCopy_v1beta1_SubjectAccessReviewSpec(in.Spec, &out.Spec, c); err != nil {
-		return err
-	}
-	out.Status = in.Status
-	return nil
-}
-
-func DeepCopy_v1beta1_SubjectAccessReviewSpec(in SubjectAccessReviewSpec, out *SubjectAccessReviewSpec, c *conversion.Cloner) error {
-	if in.ResourceAttributes != nil {
-		in, out := in.ResourceAttributes, &out.ResourceAttributes
-		*out = new(ResourceAttributes)
-		**out = *in
-	} else {
-		out.ResourceAttributes = nil
-	}
-	if in.NonResourceAttributes != nil {
-		in, out := in.NonResourceAttributes, &out.NonResourceAttributes
-		*out = new(NonResourceAttributes)
-		**out = *in
-	} else {
-		out.NonResourceAttributes = nil
-	}
-	out.User = in.User
-	if in.Groups != nil {
-		in, out := in.Groups, &out.Groups
-		*out = make([]string, len(in))
-		copy(*out, in)
-	} else {
-		out.Groups = nil
-	}
-	if in.Extra != nil {
-		in, out := in.Extra, &out.Extra
-		*out = make(map[string][]string)
-		for key, val := range in {
-			if newVal, err := c.DeepCopy(val); err != nil {
-				return err
-			} else {
-				(*out)[key] = newVal.([]string)
-			}
-		}
-	} else {
-		out.Extra = nil
-	}
-	return nil
-}
-
-func DeepCopy_v1beta1_SubjectAccessReviewStatus(in SubjectAccessReviewStatus, out *SubjectAccessReviewStatus, c *conversion.Cloner) error {
-	out.Allowed = in.Allowed
-	out.Reason = in.Reason
-	return nil
-}

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/defaults.go

@@ -20,6 +20,6 @@ import (
 	"k8s.io/kubernetes/pkg/runtime"
 )
 
-func addDefaultingFuncs(scheme *runtime.Scheme) {
-	scheme.AddDefaultingFuncs()
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return scheme.AddDefaultingFuncs()
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/doc.go

@@ -17,4 +17,5 @@ limitations under the License.
 // +k8s:deepcopy-gen=package,register
 // +k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/authorization
 
+// +groupName=authorization.k8s.io
 package v1beta1

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/generated.proto

@@ -0,0 +1,160 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = 'proto2';
+
+package k8s.io.kubernetes.pkg.apis.authorization.v1beta1;
+
+import "k8s.io/kubernetes/pkg/api/resource/generated.proto";
+import "k8s.io/kubernetes/pkg/api/unversioned/generated.proto";
+import "k8s.io/kubernetes/pkg/api/v1/generated.proto";
+import "k8s.io/kubernetes/pkg/runtime/generated.proto";
+import "k8s.io/kubernetes/pkg/util/intstr/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "v1beta1";
+
+// ExtraValue masks the value so protobuf can generate
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message ExtraValue {
+  // items, if empty, will result in an empty slice
+
+  repeated string items = 1;
+}
+
+// LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
+// Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
+// checking.
+message LocalSubjectAccessReview {
+  optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
+
+  // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
+  // you made the request against.  If empty, it is defaulted.
+  optional SubjectAccessReviewSpec spec = 2;
+
+  // Status is filled in by the server and indicates whether the request is allowed or not
+  optional SubjectAccessReviewStatus status = 3;
+}
+
+// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
+message NonResourceAttributes {
+  // Path is the URL path of the request
+  optional string path = 1;
+
+  // Verb is the standard HTTP verb
+  optional string verb = 2;
+}
+
+// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
+message ResourceAttributes {
+  // Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
+  // "" (empty) is defaulted for LocalSubjectAccessReviews
+  // "" (empty) is empty for cluster-scoped resources
+  // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
+  optional string namespace = 1;
+
+  // Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
+  optional string verb = 2;
+
+  // Group is the API Group of the Resource.  "*" means all.
+  optional string group = 3;
+
+  // Version is the API Version of the Resource.  "*" means all.
+  optional string version = 4;
+
+  // Resource is one of the existing resource types.  "*" means all.
+  optional string resource = 5;
+
+  // Subresource is one of the existing resource types.  "" means none.
+  optional string subresource = 6;
+
+  // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
+  optional string name = 7;
+}
+
+// SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
+// spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
+// to check whether they can perform an action
+message SelfSubjectAccessReview {
+  optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
+
+  // Spec holds information about the request being evaluated.  user and groups must be empty
+  optional SelfSubjectAccessReviewSpec spec = 2;
+
+  // Status is filled in by the server and indicates whether the request is allowed or not
+  optional SubjectAccessReviewStatus status = 3;
+}
+
+// SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
+// and NonResourceAuthorizationAttributes must be set
+message SelfSubjectAccessReviewSpec {
+  // ResourceAuthorizationAttributes describes information for a resource access request
+  optional ResourceAttributes resourceAttributes = 1;
+
+  // NonResourceAttributes describes information for a non-resource access request
+  optional NonResourceAttributes nonResourceAttributes = 2;
+}
+
+// SubjectAccessReview checks whether or not a user or group can perform an action.
+message SubjectAccessReview {
+  optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
+
+  // Spec holds information about the request being evaluated
+  optional SubjectAccessReviewSpec spec = 2;
+
+  // Status is filled in by the server and indicates whether the request is allowed or not
+  optional SubjectAccessReviewStatus status = 3;
+}
+
+// SubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
+// and NonResourceAuthorizationAttributes must be set
+message SubjectAccessReviewSpec {
+  // ResourceAuthorizationAttributes describes information for a resource access request
+  optional ResourceAttributes resourceAttributes = 1;
+
+  // NonResourceAttributes describes information for a non-resource access request
+  optional NonResourceAttributes nonResourceAttributes = 2;
+
+  // User is the user you're testing for.
+  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
+  optional string verb = 3;
+
+  // Groups is the groups you're testing for.
+  repeated string group = 4;
+
+  // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
+  // it needs a reflection here.
+  map<string, ExtraValue> extra = 5;
+}
+
+// SubjectAccessReviewStatus
+message SubjectAccessReviewStatus {
+  // Allowed is required.  True if the action would be allowed, false otherwise.
+  optional bool allowed = 1;
+
+  // Reason is optional.  It indicates why a request was allowed or denied.
+  optional string reason = 2;
+
+  // EvaluationError is an indication that some error occurred during the authorization check.
+  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
+  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
+  optional string evaluationError = 3;
+}
+

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/register.go

@@ -18,7 +18,9 @@ package v1beta1
 
 import (
 	"k8s.io/kubernetes/pkg/api/unversioned"
+	"k8s.io/kubernetes/pkg/api/v1"
 	"k8s.io/kubernetes/pkg/runtime"
+	versionedwatch "k8s.io/kubernetes/pkg/watch/versioned"
 )
 
 // GroupName is the group name use in this package
@@ -27,20 +29,24 @@ const GroupName = "authorization.k8s.io"
 // SchemeGroupVersion is group version used to register these objects
 var SchemeGroupVersion = unversioned.GroupVersion{Group: GroupName, Version: "v1beta1"}
 
-func AddToScheme(scheme *runtime.Scheme) {
-	// Add the API to Scheme.
-	addKnownTypes(scheme)
-	addDefaultingFuncs(scheme)
-	addConversionFuncs(scheme)
-}
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes, addDefaultingFuncs, addConversionFuncs)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
 
 // Adds the list of known types to api.Scheme.
-func addKnownTypes(scheme *runtime.Scheme) {
+func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
+		&v1.ListOptions{},
+		&v1.DeleteOptions{},
+
 		&SelfSubjectAccessReview{},
 		&SubjectAccessReview{},
 		&LocalSubjectAccessReview{},
 	)
+
+	versionedwatch.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
 }
 
 func (obj *LocalSubjectAccessReview) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/types.go

@@ -17,18 +17,26 @@ limitations under the License.
 package v1beta1
 
 import (
+	"fmt"
+
 	"k8s.io/kubernetes/pkg/api/unversioned"
+	"k8s.io/kubernetes/pkg/api/v1"
 )
 
+// +genclient=true
+// +nonNamespaced=true
+// +noMethods=true
+
 // SubjectAccessReview checks whether or not a user or group can perform an action.
 type SubjectAccessReview struct {
 	unversioned.TypeMeta `json:",inline"`
+	v1.ObjectMeta        `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec holds information about the request being evaluated
-	Spec SubjectAccessReviewSpec `json:"spec"`
+	Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is filled in by the server and indicates whether the request is allowed or not
-	Status SubjectAccessReviewStatus `json:"status,omitempty"`
+	Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
@@ -36,12 +44,13 @@ type SubjectAccessReview struct {
 // to check whether they can perform an action
 type SelfSubjectAccessReview struct {
 	unversioned.TypeMeta `json:",inline"`
+	v1.ObjectMeta        `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec holds information about the request being evaluated.  user and groups must be empty
-	Spec SelfSubjectAccessReviewSpec `json:"spec"`
+	Spec SelfSubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is filled in by the server and indicates whether the request is allowed or not
-	Status SubjectAccessReviewStatus `json:"status,omitempty"`
+	Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
@@ -49,13 +58,14 @@ type SelfSubjectAccessReview struct {
 // checking.
 type LocalSubjectAccessReview struct {
 	unversioned.TypeMeta `json:",inline"`
+	v1.ObjectMeta        `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
 	// you made the request against.  If empty, it is defaulted.
-	Spec SubjectAccessReviewSpec `json:"spec"`
+	Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is filled in by the server and indicates whether the request is allowed or not
-	Status SubjectAccessReviewStatus `json:"status,omitempty"`
+	Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
@@ -64,60 +74,73 @@ type ResourceAttributes struct {
 	// "" (empty) is defaulted for LocalSubjectAccessReviews
 	// "" (empty) is empty for cluster-scoped resources
 	// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
-	Namespace string `json:"namespace,omitempty"`
+	Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
 	// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
-	Verb string `json:"verb,omitempty"`
+	Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
 	// Group is the API Group of the Resource.  "*" means all.
-	Group string `json:"group,omitempty"`
+	Group string `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
 	// Version is the API Version of the Resource.  "*" means all.
-	Version string `json:"version,omitempty"`
+	Version string `json:"version,omitempty" protobuf:"bytes,4,opt,name=version"`
 	// Resource is one of the existing resource types.  "*" means all.
-	Resource string `json:"resource,omitempty"`
+	Resource string `json:"resource,omitempty" protobuf:"bytes,5,opt,name=resource"`
 	// Subresource is one of the existing resource types.  "" means none.
-	Subresource string `json:"subresource,omitempty"`
+	Subresource string `json:"subresource,omitempty" protobuf:"bytes,6,opt,name=subresource"`
 	// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
-	Name string `json:"name,omitempty"`
+	Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"`
 }
 
 // NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
 type NonResourceAttributes struct {
 	// Path is the URL path of the request
-	Path string `json:"path,omitempty"`
+	Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
 	// Verb is the standard HTTP verb
-	Verb string `json:"verb,omitempty"`
+	Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
 }
 
 // SubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
 // and NonResourceAuthorizationAttributes must be set
 type SubjectAccessReviewSpec struct {
 	// ResourceAuthorizationAttributes describes information for a resource access request
-	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty"`
+	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// NonResourceAttributes describes information for a non-resource access request
-	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty"`
+	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 
 	// User is the user you're testing for.
 	// If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
-	User string `json:"user,omitempty"`
+	User string `json:"user,omitempty" protobuf:"bytes,3,opt,name=verb"`
 	// Groups is the groups you're testing for.
-	Groups []string `json:"group,omitempty"`
+	Groups []string `json:"group,omitempty" protobuf:"bytes,4,rep,name=group"`
 	// Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
 	// it needs a reflection here.
-	Extra map[string][]string `json:"extra,omitempty"`
+	Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,5,rep,name=extra"`
+}
+
+// ExtraValue masks the value so protobuf can generate
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type ExtraValue []string
+
+func (t ExtraValue) String() string {
+	return fmt.Sprintf("%v", []string(t))
 }
 
 // SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
 // and NonResourceAuthorizationAttributes must be set
 type SelfSubjectAccessReviewSpec struct {
 	// ResourceAuthorizationAttributes describes information for a resource access request
-	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty"`
+	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// NonResourceAttributes describes information for a non-resource access request
-	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty"`
+	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 }
 
 // SubjectAccessReviewStatus
 type SubjectAccessReviewStatus struct {
 	// Allowed is required.  True if the action would be allowed, false otherwise.
-	Allowed bool `json:"allowed"`
+	Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
 	// Reason is optional.  It indicates why a request was allowed or denied.
-	Reason string `json:"reason,omitempty"`
+	Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`
+	// EvaluationError is an indication that some error occurred during the authorization check.
+	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
+	// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
+	EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,3,opt,name=evaluationError"`
 }

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/types_swagger_doc_generated.go

@@ -106,9 +106,10 @@ func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
 }
 
 var map_SubjectAccessReviewStatus = map[string]string{
-	"":        "SubjectAccessReviewStatus",
-	"allowed": "Allowed is required.  True if the action would be allowed, false otherwise.",
-	"reason":  "Reason is optional.  It indicates why a request was allowed or denied.",
+	"":                "SubjectAccessReviewStatus",
+	"allowed":         "Allowed is required.  True if the action would be allowed, false otherwise.",
+	"reason":          "Reason is optional.  It indicates why a request was allowed or denied.",
+	"evaluationError": "EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
 }
 
 func (SubjectAccessReviewStatus) SwaggerDoc() map[string]string {

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/zz_generated.conversion.go

@@ -24,10 +24,17 @@ import (
 	api "k8s.io/kubernetes/pkg/api"
 	authorization "k8s.io/kubernetes/pkg/apis/authorization"
 	conversion "k8s.io/kubernetes/pkg/conversion"
+	runtime "k8s.io/kubernetes/pkg/runtime"
 )
 
 func init() {
-	if err := api.Scheme.AddGeneratedConversionFuncs(
+	SchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(scheme *runtime.Scheme) error {
+	return scheme.AddGeneratedConversionFuncs(
 		Convert_v1beta1_LocalSubjectAccessReview_To_authorization_LocalSubjectAccessReview,
 		Convert_authorization_LocalSubjectAccessReview_To_v1beta1_LocalSubjectAccessReview,
 		Convert_v1beta1_NonResourceAttributes_To_authorization_NonResourceAttributes,
@@ -44,16 +51,17 @@ func init() {
 		Convert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessReviewSpec,
 		Convert_v1beta1_SubjectAccessReviewStatus_To_authorization_SubjectAccessReviewStatus,
 		Convert_authorization_SubjectAccessReviewStatus_To_v1beta1_SubjectAccessReviewStatus,
-	); err != nil {
-		// if one of the conversion functions is malformed, detect it immediately.
-		panic(err)
-	}
+	)
 }
 
 func autoConvert_v1beta1_LocalSubjectAccessReview_To_authorization_LocalSubjectAccessReview(in *LocalSubjectAccessReview, out *authorization.LocalSubjectAccessReview, s conversion.Scope) error {
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_v1beta1_SubjectAccessReviewSpec_To_authorization_SubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -71,6 +79,10 @@ func autoConvert_authorization_LocalSubjectAccessReview_To_v1beta1_LocalSubjectA
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -138,6 +150,10 @@ func autoConvert_v1beta1_SelfSubjectAccessReview_To_authorization_SelfSubjectAcc
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_v1beta1_SelfSubjectAccessReviewSpec_To_authorization_SelfSubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -155,6 +171,10 @@ func autoConvert_authorization_SelfSubjectAccessReview_To_v1beta1_SelfSubjectAcc
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_authorization_SelfSubjectAccessReviewSpec_To_v1beta1_SelfSubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -224,6 +244,10 @@ func autoConvert_v1beta1_SubjectAccessReview_To_authorization_SubjectAccessRevie
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_v1beta1_SubjectAccessReviewSpec_To_authorization_SubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -241,6 +265,10 @@ func autoConvert_authorization_SubjectAccessReview_To_v1beta1_SubjectAccessRevie
 	if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
 		return err
 	}
+	// TODO: Inefficient conversion - can we improve it?
+	if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
+		return err
+	}
 	if err := Convert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessReviewSpec(&in.Spec, &out.Spec, s); err != nil {
 		return err
 	}
@@ -275,7 +303,20 @@ func autoConvert_v1beta1_SubjectAccessReviewSpec_To_authorization_SubjectAccessR
 	}
 	out.User = in.User
 	out.Groups = in.Groups
-	out.Extra = in.Extra
+	if in.Extra != nil {
+		in, out := &in.Extra, &out.Extra
+		*out = make(map[string]authorization.ExtraValue, len(*in))
+		for key, val := range *in {
+			newVal := new(authorization.ExtraValue)
+			// TODO: Inefficient conversion - can we improve it?
+			if err := s.Convert(&val, newVal, 0); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Extra = nil
+	}
 	return nil
 }
 
@@ -304,7 +345,20 @@ func autoConvert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessR
 	}
 	out.User = in.User
 	out.Groups = in.Groups
-	out.Extra = in.Extra
+	if in.Extra != nil {
+		in, out := &in.Extra, &out.Extra
+		*out = make(map[string]ExtraValue, len(*in))
+		for key, val := range *in {
+			newVal := new(ExtraValue)
+			// TODO: Inefficient conversion - can we improve it?
+			if err := s.Convert(&val, newVal, 0); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Extra = nil
+	}
 	return nil
 }
 
@@ -315,6 +369,7 @@ func Convert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessRevie
 func autoConvert_v1beta1_SubjectAccessReviewStatus_To_authorization_SubjectAccessReviewStatus(in *SubjectAccessReviewStatus, out *authorization.SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
 	out.Reason = in.Reason
+	out.EvaluationError = in.EvaluationError
 	return nil
 }
 
@@ -325,6 +380,7 @@ func Convert_v1beta1_SubjectAccessReviewStatus_To_authorization_SubjectAccessRev
 func autoConvert_authorization_SubjectAccessReviewStatus_To_v1beta1_SubjectAccessReviewStatus(in *authorization.SubjectAccessReviewStatus, out *SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
 	out.Reason = in.Reason
+	out.EvaluationError = in.EvaluationError
 	return nil
 }
 

vendor/k8s.io/kubernetes/pkg/apis/authorization/v1beta1/zz_generated.deepcopy.go

@@ -0,0 +1,196 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This file was autogenerated by deepcopy-gen. Do not edit it manually!
+
+package v1beta1
+
+import (
+	v1 "k8s.io/kubernetes/pkg/api/v1"
+	conversion "k8s.io/kubernetes/pkg/conversion"
+	runtime "k8s.io/kubernetes/pkg/runtime"
+	reflect "reflect"
+)
+
+func init() {
+	SchemeBuilder.Register(RegisterDeepCopies)
+}
+
+// RegisterDeepCopies adds deep-copy functions to the given scheme. Public
+// to allow building arbitrary schemes.
+func RegisterDeepCopies(scheme *runtime.Scheme) error {
+	return scheme.AddGeneratedDeepCopyFuncs(
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_LocalSubjectAccessReview, InType: reflect.TypeOf(&LocalSubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_NonResourceAttributes, InType: reflect.TypeOf(&NonResourceAttributes{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_ResourceAttributes, InType: reflect.TypeOf(&ResourceAttributes{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_SelfSubjectAccessReview, InType: reflect.TypeOf(&SelfSubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_SelfSubjectAccessReviewSpec, InType: reflect.TypeOf(&SelfSubjectAccessReviewSpec{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_SubjectAccessReview, InType: reflect.TypeOf(&SubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_SubjectAccessReviewSpec, InType: reflect.TypeOf(&SubjectAccessReviewSpec{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_v1beta1_SubjectAccessReviewStatus, InType: reflect.TypeOf(&SubjectAccessReviewStatus{})},
+	)
+}
+
+func DeepCopy_v1beta1_LocalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*LocalSubjectAccessReview)
+		out := out.(*LocalSubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := v1.DeepCopy_v1_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_v1beta1_SubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_NonResourceAttributes(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*NonResourceAttributes)
+		out := out.(*NonResourceAttributes)
+		out.Path = in.Path
+		out.Verb = in.Verb
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_ResourceAttributes(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*ResourceAttributes)
+		out := out.(*ResourceAttributes)
+		out.Namespace = in.Namespace
+		out.Verb = in.Verb
+		out.Group = in.Group
+		out.Version = in.Version
+		out.Resource = in.Resource
+		out.Subresource = in.Subresource
+		out.Name = in.Name
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_SelfSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SelfSubjectAccessReview)
+		out := out.(*SelfSubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := v1.DeepCopy_v1_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_v1beta1_SelfSubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_SelfSubjectAccessReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SelfSubjectAccessReviewSpec)
+		out := out.(*SelfSubjectAccessReviewSpec)
+		if in.ResourceAttributes != nil {
+			in, out := &in.ResourceAttributes, &out.ResourceAttributes
+			*out = new(ResourceAttributes)
+			**out = **in
+		} else {
+			out.ResourceAttributes = nil
+		}
+		if in.NonResourceAttributes != nil {
+			in, out := &in.NonResourceAttributes, &out.NonResourceAttributes
+			*out = new(NonResourceAttributes)
+			**out = **in
+		} else {
+			out.NonResourceAttributes = nil
+		}
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_SubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReview)
+		out := out.(*SubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := v1.DeepCopy_v1_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_v1beta1_SubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_SubjectAccessReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReviewSpec)
+		out := out.(*SubjectAccessReviewSpec)
+		if in.ResourceAttributes != nil {
+			in, out := &in.ResourceAttributes, &out.ResourceAttributes
+			*out = new(ResourceAttributes)
+			**out = **in
+		} else {
+			out.ResourceAttributes = nil
+		}
+		if in.NonResourceAttributes != nil {
+			in, out := &in.NonResourceAttributes, &out.NonResourceAttributes
+			*out = new(NonResourceAttributes)
+			**out = **in
+		} else {
+			out.NonResourceAttributes = nil
+		}
+		out.User = in.User
+		if in.Groups != nil {
+			in, out := &in.Groups, &out.Groups
+			*out = make([]string, len(*in))
+			copy(*out, *in)
+		} else {
+			out.Groups = nil
+		}
+		if in.Extra != nil {
+			in, out := &in.Extra, &out.Extra
+			*out = make(map[string]ExtraValue)
+			for key, val := range *in {
+				if newVal, err := c.DeepCopy(&val); err != nil {
+					return err
+				} else {
+					(*out)[key] = *newVal.(*ExtraValue)
+				}
+			}
+		} else {
+			out.Extra = nil
+		}
+		return nil
+	}
+}
+
+func DeepCopy_v1beta1_SubjectAccessReviewStatus(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReviewStatus)
+		out := out.(*SubjectAccessReviewStatus)
+		out.Allowed = in.Allowed
+		out.Reason = in.Reason
+		out.EvaluationError = in.EvaluationError
+		return nil
+	}
+}

vendor/k8s.io/kubernetes/pkg/apis/authorization/zz_generated.deepcopy.go

@@ -0,0 +1,196 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This file was autogenerated by deepcopy-gen. Do not edit it manually!
+
+package authorization
+
+import (
+	api "k8s.io/kubernetes/pkg/api"
+	conversion "k8s.io/kubernetes/pkg/conversion"
+	runtime "k8s.io/kubernetes/pkg/runtime"
+	reflect "reflect"
+)
+
+func init() {
+	SchemeBuilder.Register(RegisterDeepCopies)
+}
+
+// RegisterDeepCopies adds deep-copy functions to the given scheme. Public
+// to allow building arbitrary schemes.
+func RegisterDeepCopies(scheme *runtime.Scheme) error {
+	return scheme.AddGeneratedDeepCopyFuncs(
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_LocalSubjectAccessReview, InType: reflect.TypeOf(&LocalSubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_NonResourceAttributes, InType: reflect.TypeOf(&NonResourceAttributes{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_ResourceAttributes, InType: reflect.TypeOf(&ResourceAttributes{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_SelfSubjectAccessReview, InType: reflect.TypeOf(&SelfSubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_SelfSubjectAccessReviewSpec, InType: reflect.TypeOf(&SelfSubjectAccessReviewSpec{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_SubjectAccessReview, InType: reflect.TypeOf(&SubjectAccessReview{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_SubjectAccessReviewSpec, InType: reflect.TypeOf(&SubjectAccessReviewSpec{})},
+		conversion.GeneratedDeepCopyFunc{Fn: DeepCopy_authorization_SubjectAccessReviewStatus, InType: reflect.TypeOf(&SubjectAccessReviewStatus{})},
+	)
+}
+
+func DeepCopy_authorization_LocalSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*LocalSubjectAccessReview)
+		out := out.(*LocalSubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := api.DeepCopy_api_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_authorization_SubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_authorization_NonResourceAttributes(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*NonResourceAttributes)
+		out := out.(*NonResourceAttributes)
+		out.Path = in.Path
+		out.Verb = in.Verb
+		return nil
+	}
+}
+
+func DeepCopy_authorization_ResourceAttributes(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*ResourceAttributes)
+		out := out.(*ResourceAttributes)
+		out.Namespace = in.Namespace
+		out.Verb = in.Verb
+		out.Group = in.Group
+		out.Version = in.Version
+		out.Resource = in.Resource
+		out.Subresource = in.Subresource
+		out.Name = in.Name
+		return nil
+	}
+}
+
+func DeepCopy_authorization_SelfSubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SelfSubjectAccessReview)
+		out := out.(*SelfSubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := api.DeepCopy_api_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_authorization_SelfSubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_authorization_SelfSubjectAccessReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SelfSubjectAccessReviewSpec)
+		out := out.(*SelfSubjectAccessReviewSpec)
+		if in.ResourceAttributes != nil {
+			in, out := &in.ResourceAttributes, &out.ResourceAttributes
+			*out = new(ResourceAttributes)
+			**out = **in
+		} else {
+			out.ResourceAttributes = nil
+		}
+		if in.NonResourceAttributes != nil {
+			in, out := &in.NonResourceAttributes, &out.NonResourceAttributes
+			*out = new(NonResourceAttributes)
+			**out = **in
+		} else {
+			out.NonResourceAttributes = nil
+		}
+		return nil
+	}
+}
+
+func DeepCopy_authorization_SubjectAccessReview(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReview)
+		out := out.(*SubjectAccessReview)
+		out.TypeMeta = in.TypeMeta
+		if err := api.DeepCopy_api_ObjectMeta(&in.ObjectMeta, &out.ObjectMeta, c); err != nil {
+			return err
+		}
+		if err := DeepCopy_authorization_SubjectAccessReviewSpec(&in.Spec, &out.Spec, c); err != nil {
+			return err
+		}
+		out.Status = in.Status
+		return nil
+	}
+}
+
+func DeepCopy_authorization_SubjectAccessReviewSpec(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReviewSpec)
+		out := out.(*SubjectAccessReviewSpec)
+		if in.ResourceAttributes != nil {
+			in, out := &in.ResourceAttributes, &out.ResourceAttributes
+			*out = new(ResourceAttributes)
+			**out = **in
+		} else {
+			out.ResourceAttributes = nil
+		}
+		if in.NonResourceAttributes != nil {
+			in, out := &in.NonResourceAttributes, &out.NonResourceAttributes
+			*out = new(NonResourceAttributes)
+			**out = **in
+		} else {
+			out.NonResourceAttributes = nil
+		}
+		out.User = in.User
+		if in.Groups != nil {
+			in, out := &in.Groups, &out.Groups
+			*out = make([]string, len(*in))
+			copy(*out, *in)
+		} else {
+			out.Groups = nil
+		}
+		if in.Extra != nil {
+			in, out := &in.Extra, &out.Extra
+			*out = make(map[string]ExtraValue)
+			for key, val := range *in {
+				if newVal, err := c.DeepCopy(&val); err != nil {
+					return err
+				} else {
+					(*out)[key] = *newVal.(*ExtraValue)
+				}
+			}
+		} else {
+			out.Extra = nil
+		}
+		return nil
+	}
+}
+
+func DeepCopy_authorization_SubjectAccessReviewStatus(in interface{}, out interface{}, c *conversion.Cloner) error {
+	{
+		in := in.(*SubjectAccessReviewStatus)
+		out := out.(*SubjectAccessReviewStatus)
+		out.Allowed = in.Allowed
+		out.Reason = in.Reason
+		out.EvaluationError = in.EvaluationError
+		return nil
+	}
+}