// authorizeReadNamespacedObject authorizes "get", "list" and "watch" requests to single objects of a
// specified types if they are related to the specified node.
498977
func (r *NodeAuthorizer) authorizeReadNamespacedObject(nodeName string, startingType vertexType, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
	if attrs.GetVerb() != "get" && attrs.GetVerb() != "list" && attrs.GetVerb() != "watch" {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "can only read resources of this type", nil
	}
	if len(attrs.GetSubresource()) > 0 {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "cannot read subresource", nil
	}
	if len(attrs.GetNamespace()) == 0 {
		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
		return authorizer.DecisionNoOpinion, "can only read namespaced object of this type", nil
	}
	return r.authorize(nodeName, startingType, attrs)
}
84847
func GetNamespaceEngine(config map[string]string) TSDSDBEngine {
	db := golkeyval.GetDBEngine(config["DBEngine"])
	db.Configure(config)
	db.CreateDB()

	ns := golkeyvalNS.GetNSDBEngine(config["NSEngine"])
	ns.Configure(db)

	tsds := GetTSDSDBEngine("namespace")
	tsds.Configure(ns)
	return tsds
}
870567
func (ns *dynamicNamespaceListerShim) Get(name string) (runtime.Object, error) {
	return ns.namespaceLister.Get(name)
}
894176
func (p *PolicyAuthorizer) EventRead(name string) bool {
	// Longest-prefix match on event names
	if rule, ok := getPolicy(name, p.eventRules); ok {
		if allow, recurse := enforce(rule.(string), PolicyRead); !recurse {
			return allow
		}
	}

	// No matching rule, use the parent.
	return p.parent.EventRead(name)
}
1043634
func (k *kubernetesClient) GetNamespace(name string) (*core.Namespace, error) {
	ns, err := k.getNamespaceByName(name)
	if err != nil {
		return nil, errors.Trace(err)
	}
	if err := checkNamespaceOwnedByJuju(ns, k.annotations); err != nil {
		return nil, errors.NotFoundf("namespace %q", name)
	}
	return ns, nil
}
1284817
func (a AuthorizerAdapter) GetRole(namespace, name string) (*rbacv1.Role, error) {
	return a.Registry.GetRole(genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace), name, &metav1.GetOptions{})
}
108973
func (n *NodeAuthorizer) authorizeHandler(w http.ResponseWriter, r *http.Request) {
	err := func() error {
		// @check we have a body to read in
		if r.Body == nil {
			w.WriteHeader(http.StatusBadRequest)
			return nil
		}

		// @step: read in the request body
		content, err := ioutil.ReadAll(r.Body)
		defer r.Body.Close()
		if err != nil {
			return err
		}

		address, err := getClientAddress(r.RemoteAddr)
		if err != nil {
			return err
		}

		// @step: construct the node registration request
		req := &NodeRegistration{
			Spec: NodeRegistrationSpec{
				NodeName:   mux.Vars(r)["name"],
				RemoteAddr: address,
				Request:    content,
			},
		}

		// @step: attempt to authorise the request
		if err := n.authorizeNodeRequest(r.Context(), req); err != nil {
			return err
		}

		// @check if the node was denied and if so, 403 it
		if !req.Status.Allowed {
			w.WriteHeader(http.StatusForbidden)
			return nil
		}

		return json.NewEncoder(w).Encode(req)
	}()
	if err != nil {
		utils.Logger.Info("failed to handle node request", zap.Error(err))

		w.WriteHeader(http.StatusInternalServerError)
	}
}
325547
func ValidNamespace(ctx context.Context, resource metav1.Object) bool {
	ns, ok := genericapirequest.NamespaceFrom(ctx)
	if len(resource.GetNamespace()) == 0 {
		resource.SetNamespace(ns)
	}
	return ns == resource.GetNamespace() && ok
}
882122
func (_class AuthClass) GetSubjectIdentifier(sessionID SessionRef, subjectName string) (_retval string, _err error) {
	_method := "auth.get_subject_identifier"
	_sessionIDArg, _err := convertSessionRefToXen(fmt.Sprintf("%s(%s)", _method, "session_id"), sessionID)
	if _err != nil {
		return
	}
	_subjectNameArg, _err := convertStringToXen(fmt.Sprintf("%s(%s)", _method, "subject_name"), subjectName)
	if _err != nil {
		return
	}
	_result, _err := _class.client.APICall(_method, _sessionIDArg, _subjectNameArg)
	if _err != nil {
		return
	}
	_retval, _err = convertStringToGo(_method + " -> ", _result.Value)
	return
}
1274705
func getNamespaceByName(name string, ns *corev1.Namespace, client kubernetes.Interface) (*corev1.Namespace, error) {
	if ns != nil && name == ns.Name {
		return ns, nil
	}
	return client.CoreV1().Namespaces().Get(name, metav1.GetOptions{})
}
491748
func ValidateNetNamespace(netnamespace *networkapi.NetNamespace) field.ErrorList {
	allErrs := validation.ValidateObjectMeta(&netnamespace.ObjectMeta, false, path.ValidatePathSegmentName, field.NewPath("metadata"))

	if netnamespace.NetName != netnamespace.Name {
		allErrs = append(allErrs, field.Invalid(field.NewPath("netname"), netnamespace.NetName, fmt.Sprintf("must be the same as metadata.name: %q", netnamespace.Name)))
	}

	if err := ValidVNID(netnamespace.NetID); err != nil {
		allErrs = append(allErrs, field.Invalid(field.NewPath("netid"), netnamespace.NetID, err.Error()))
	}

	for i, ip := range netnamespace.EgressIPs {
		if _, err := validateIPv4(ip); err != nil {
			allErrs = append(allErrs, field.Invalid(field.NewPath("egressIPs").Index(i), ip, err.Error()))
		}
	}

	return allErrs
}
88578
func (l *dynamicNamespaceLister) Get(name string) (*unstructured.Unstructured, error) {
	obj, exists, err := l.indexer.GetByKey(l.namespace + "/" + name)
	if err != nil {
		return nil, err
	}
	if !exists {
		return nil, errors.NewNotFound(l.gvr.GroupResource(), name)
	}
	return obj.(*unstructured.Unstructured), nil
}
432073
func addSubjectsToNamespace(subjectRecordStore cache.Store, subjects []string, namespace string) {
	for _, subject := range subjects {
		var item *subjectRecord
		obj, exists, _ := subjectRecordStore.GetByKey(subject)
		if exists {
			item = obj.(*subjectRecord)
		} else {
			item = &subjectRecord{subject: subject, namespaces: sets.NewString()}
			subjectRecordStore.Add(item)
		}
		item.namespaces.Insert(namespace)
	}
}
898912
func GetNamespaceEndpoints(netNS string) ([]*hns.HNSEndpoint, error) {
	op := "hcsoci::GetNamespaceEndpoints"
	log := logrus.WithField("netns-id", netNS)
	log.Debug(op + " - Begin")
	defer func() {
		log.Debug(op + " - End")
	}()

	ids, err := hns.GetNamespaceEndpoints(netNS)
	if err != nil {
		return nil, err
	}
	var endpoints []*hns.HNSEndpoint
	for _, id := range ids {
		endpoint, err := hns.GetHNSEndpointByID(id)
		if err != nil {
			return nil, err
		}
		endpoints = append(endpoints, endpoint)
	}
	return endpoints, nil
}
987808
func (k *kubernetesClient) listNamespacesByAnnotations(annotations k8sannotations.Annotation) ([]core.Namespace, error) {
	namespaces, err := k.client().CoreV1().Namespaces().List(v1.ListOptions{IncludeUninitialized: true})
	if err != nil {
		return nil, errors.Trace(err)
	}
	var matchedNS []core.Namespace
	annotationMap := annotations
	for _, ns := range namespaces.Items {
		if err := checkNamespaceOwnedByJuju(&ns, annotationMap); err == nil {
			matchedNS = append(matchedNS, ns)
		}
	}
	if len(matchedNS) > 0 {
		doLog := logger.Debugf
		if len(matchedNS) > 1 {
			// this should never happen before we enable multi controller in single cluster.
			doLog = logger.Warningf
		}
		doLog("found %d matched namespaces with annotations %v", len(matchedNS), annotationMap)
		return matchedNS, nil
	}
	return nil, errors.NotFoundf("namespace for %v", k.annotations)
}
1224410
func (i *Info) Namespaced() bool {
	return i.Mapping != nil && i.Mapping.Scope.Name() == meta.RESTScopeNameNamespace
}
130515
func (actor Actor) GrantSpaceManagerByUsername(orgGUID string, spaceGUID string, username string) (Warnings, error) {
	if actor.Config.UAAGrantType() == string(uaaconst.GrantTypeClientCredentials) {
		return actor.grantSpaceManagerByClientCredentials(orgGUID, spaceGUID, username)
	}

	return actor.grantSpaceManagerByUsername(orgGUID, spaceGUID, username)
}