func (e clusterRoleEvaluator) ResolveGettableNamespaces(scope string, clusterPolicyGetter client.ClusterPolicyLister) ([]string, error) {
_, scopeNamespace, _, err := e.parseScope(scope)
if err != nil {
return nil, err
}
rules, err := e.resolveRules(scope, clusterPolicyGetter)
if err != nil {
return nil, err
}
attributes := authorizer.DefaultAuthorizationAttributes{
APIGroup: kapi.GroupName,
Verb: "get",
Resource: "namespaces",
}
errors := []error{}
for _, rule := range rules {
matches, err := attributes.RuleMatches(rule)
if err != nil {
errors = append(errors, err)
continue
}
if matches {
return []string{scopeNamespace}, nil
}
}
return []string{}, kutilerrors.NewAggregate(errors)
}
