core/v2/clusterrolebindings

Get all cluster role bindings

The /clusterrolebindings API endpoint provides HTTP GET access to cluster role binding data.

Example

The following example demonstrates a GET request to the /clusterrolebindings API endpoint:

curl -X GET \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings \
-H "Authorization: Key $SENSU_API_KEY"

The request results in a successful HTTP/1.1 200 OK response and a JSON array that contains the cluster role binding definitions:

[
  {
    "subjects": [
      {
        "type": "Group",
        "name": "cluster-admins"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-admin"
    },
    "metadata": {
      "name": "cluster-admin",
      "created_by": "admin"
    }
  },
  {
    "subjects": [
      {
        "type": "Group",
        "name": "system:agents"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "system:agent"
    },
    "metadata": {
      "name": "system:agent",
      "created_by": "admin"
    }
  }
]

API Specification

[
  {
    "subjects": [
      {
        "type": "Group",
        "name": "cluster-admins"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-admin"
    },
    "metadata": {
      "name": "cluster-admin",
      "created_by": "admin"
    }
  },
  {
    "subjects": [
      {
        "type": "Group",
        "name": "system:agents"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "system:agent"
    },
    "metadata": {
      "name": "system:agent"
    }
  }
]

Create a new cluster role binding

The /clusterrolebindings API endpoint provides HTTP POST access to create a cluster role binding.

Example

In the following example, an HTTP POST request is submitted to the /clusterrolebindings API endpoint to create a cluster role binding that assigns the cluster-admin cluster role to the user bob. The request includes the cluster role binding definition in the request body,

curl -X POST \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
  "subjects": [
    {
      "type": "User",
      "name": "bob"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "bob-binder"
  }
}' \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings

The request will return a successful HTTP/1.1 201 Created response.

API Specification

{
  "subjects": [
    {
      "type": "User",
      "name": "bob"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "bob-binder"
  }
}

Get a specific cluster role binding

The /clusterrolebindings/:clusterrolebinding API endpoint provides HTTP GET access to cluster role binding data for specific :clusterrolebinding definitions, by cluster role binding name.

Example

The following example queries the /clusterrolebindings/:clusterrolebinding API endpoint for the :clusterrolebinding named bob-binder:

curl -X GET \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings/bob-binder \
-H "Authorization: Key $SENSU_API_KEY"

The request will return a successful HTTP/1.1 200 OK response and a JSON map that contains the requested :clusterrolebinding definition (in this example, bob-binder):

{
  "subjects": [
    {
      "type": "User",
      "name": "bob"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "bob-binder",
    "created_by": "admin"
  }
}

API Specification

{
  "subjects": [
    {
      "type": "User",
      "name": "bob"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "bob-binder",
    "created_by": "admin"
  }
}

Create or update a cluster role binding

The /clusterrolebindings/:clusterrolebinding API endpoint provides HTTP PUT access to create or update a cluster role binding, by cluster role binding name.

Example

In the following example, an HTTP PUT request is submitted to the /clusterrolebindings/:clusterrolebinding API endpoint to create a cluster role binding that assigns the cluster-admin cluster role to users in the group ops. The request includes the cluster role binding definition in the request body:

curl -X PUT \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
  "subjects": [
    {
      "type": "Group",
      "name": "ops"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "ops-group-binder"
  }
}' \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings/ops-group-binder

The request will return a successful HTTP/1.1 201 Created response.

API Specification

{
  "subjects": [
    {
      "type": "Group",
      "name": "ops"
    }
  ],
  "role_ref": {
    "type": "ClusterRole",
    "name": "cluster-admin"
  },
  "metadata": {
    "name": "ops-group-binder"
  }
}

Update a cluster role binding with PATCH

The /clusterrolebindings/:clusterrolebinding API endpoint provides HTTP PATCH access to update :clusterrolebinding definitions, specified by cluster role binding name.

Example

In the following example, an HTTP PATCH request is submitted to the /clusterrolebindings/:clusterrolebinding API endpoint to update the subjects array for the ops-group-binder check, resulting in a HTTP/1.1 200 OK response and the updated cluster role binding definition.

We support JSON merge patches, so you must set the Content-Type header to application/merge-patch+json for PATCH requests.

curl -X PATCH \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/merge-patch+json' \
-d '{
  "subjects": [
    {
      "type": "Group",
      "name": "ops_team_1"
    },
    {
      "type": "Group",
      "name": "ops_team_2"
    }
  ]
}' \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings/ops-group-binder

API Specification

{
  "subjects": [
    {
      "type": "Group",
      "name": "ops_team_1"
    },
    {
      "type": "Group",
      "name": "ops_team_2"
    }
  ]
}

Delete a cluster role binding

The /clusterrolebindings/:clusterrolebinding API endpoint provides HTTP DELETE access to delete a cluster role binding from Sensu (specified by the cluster role binding name).

Example

The following example shows a request to the /clusterrolebindings/:clusterrolebinding API endpoint to delete the check named ops-binding, which will result in a successful HTTP/1.1 204 No Content response:

curl -X DELETE \
-H "Authorization: Key $SENSU_API_KEY" \
http://127.0.0.1:8080/api/core/v2/clusterrolebindings/ops-binding

API Specification

Get a subset of cluster role bindings with response filtering

The /clusterrolebindings API endpoint supports response filtering for a subset of cluster role binding data based on labels and the following fields:

• clusterrolebinding.name
• clusterrolebinding.role_ref.name
• clusterrolebinding.role_ref.type

Example

The following example demonstrates a request to the /clusterrolebindings API endpoint with response filtering to retrieve only cluster role binding definitions whose role_ref.name includes cluster-user:

curl -H "Authorization: Key $SENSU_API_KEY" http://127.0.0.1:8080/api/core/v2/clusterrolebindings -G \
--data-urlencode 'fieldSelector="cluster-user" in clusterrolebinding.role_ref.name'

The example request will result in a successful HTTP/1.1 200 OK response and a JSON array that contains only cluster role binding definitions whose role_ref.name includes cluster-user:

[
  {
    "subjects": [
      {
        "type": "User",
        "name": "ann"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-user"
    },
    "metadata": {
      "name": "ann-binder",
      "created_by": "admin"
    }
  },
  {
    "subjects": [
      {
        "type": "User",
        "name": "bonita"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-user"
    },
    "metadata": {
      "name": "bonita-binder",
      "created_by": "admin"
    }
  }
]

API Specification

[
  {
    "subjects": [
      {
        "type": "User",
        "name": "ann"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-user"
    },
    "metadata": {
      "name": "ann-binder",
      "created_by": "admin"
    }
  },
  {
    "subjects": [
      {
        "type": "User",
        "name": "bonita"
      }
    ],
    "role_ref": {
      "type": "ClusterRole",
      "name": "cluster-user"
    },
    "metadata": {
      "name": "bonita-binder",
      "created_by": "admin"
    }
  }
]