autogenerated

api/openapi-spec/swagger.json

@@ -64649,7 +64649,11 @@
     ],
     "properties": {
      "allowed": {
-      "description": "Allowed is required.  True if the action would be allowed, false otherwise.",
+      "description": "Allowed is required. True if the action would be allowed, false otherwise.",
+      "type": "boolean"
+     },
+     "denied": {
+      "description": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
       "type": "boolean"
      },
      "evaluationError": {
@@ -65000,7 +65004,11 @@
     ],
     "properties": {
      "allowed": {
-      "description": "Allowed is required.  True if the action would be allowed, false otherwise.",
+      "description": "Allowed is required. True if the action would be allowed, false otherwise.",
+      "type": "boolean"
+     },
+     "denied": {
+      "description": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
       "type": "boolean"
      },
      "evaluationError": {

api/swagger-spec/authorization.k8s.io_v1.json

@@ -635,7 +635,11 @@
     "properties": {
      "allowed": {
       "type": "boolean",
-      "description": "Allowed is required.  True if the action would be allowed, false otherwise."
+      "description": "Allowed is required. True if the action would be allowed, false otherwise."
+     },
+     "denied": {
+      "type": "boolean",
+      "description": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true."
      },
      "reason": {
       "type": "string",

api/swagger-spec/authorization.k8s.io_v1beta1.json

@@ -635,7 +635,11 @@
     "properties": {
      "allowed": {
       "type": "boolean",
-      "description": "Allowed is required.  True if the action would be allowed, false otherwise."
+      "description": "Allowed is required. True if the action would be allowed, false otherwise."
+     },
+     "denied": {
+      "type": "boolean",
+      "description": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true."
      },
      "reason": {
       "type": "string",

docs/api-reference/authorization.k8s.io/v1/definitions.html

@@ -850,12 +850,19 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">allowed</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed is required.  True if the action would be allowed, false otherwise.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed is required. True if the action would be allowed, false otherwise.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 </tr>
 <tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">denied</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+</tr>
+<tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">Reason is optional.  It indicates why a request was allowed or denied.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>

docs/api-reference/authorization.k8s.io/v1beta1/definitions.html

@@ -1094,12 +1094,19 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">allowed</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed is required.  True if the action would be allowed, false otherwise.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed is required. True if the action would be allowed, false otherwise.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 </tr>
 <tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">denied</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+</tr>
+<tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">Reason is optional.  It indicates why a request was allowed or denied.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>

pkg/apis/authorization/v1/zz_generated.conversion.go

@@ -369,6 +369,7 @@ func Convert_authorization_SubjectAccessReviewSpec_To_v1_SubjectAccessReviewSpec
 
 func autoConvert_v1_SubjectAccessReviewStatus_To_authorization_SubjectAccessReviewStatus(in *v1.SubjectAccessReviewStatus, out *authorization.SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
+	out.Denied = in.Denied
 	out.Reason = in.Reason
 	out.EvaluationError = in.EvaluationError
 	return nil
@@ -381,6 +382,7 @@ func Convert_v1_SubjectAccessReviewStatus_To_authorization_SubjectAccessReviewSt
 
 func autoConvert_authorization_SubjectAccessReviewStatus_To_v1_SubjectAccessReviewStatus(in *authorization.SubjectAccessReviewStatus, out *v1.SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
+	out.Denied = in.Denied
 	out.Reason = in.Reason
 	out.EvaluationError = in.EvaluationError
 	return nil

pkg/apis/authorization/v1beta1/zz_generated.conversion.go

@@ -369,6 +369,7 @@ func Convert_authorization_SubjectAccessReviewSpec_To_v1beta1_SubjectAccessRevie
 
 func autoConvert_v1beta1_SubjectAccessReviewStatus_To_authorization_SubjectAccessReviewStatus(in *v1beta1.SubjectAccessReviewStatus, out *authorization.SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
+	out.Denied = in.Denied
 	out.Reason = in.Reason
 	out.EvaluationError = in.EvaluationError
 	return nil
@@ -381,6 +382,7 @@ func Convert_v1beta1_SubjectAccessReviewStatus_To_authorization_SubjectAccessRev
 
 func autoConvert_authorization_SubjectAccessReviewStatus_To_v1beta1_SubjectAccessReviewStatus(in *authorization.SubjectAccessReviewStatus, out *v1beta1.SubjectAccessReviewStatus, s conversion.Scope) error {
 	out.Allowed = in.Allowed
+	out.Denied = in.Denied
 	out.Reason = in.Reason
 	out.EvaluationError = in.EvaluationError
 	return nil

staging/src/k8s.io/api/authorization/v1/generated.proto

@@ -226,9 +226,16 @@ message SubjectAccessReviewSpec {
 
 // SubjectAccessReviewStatus
 message SubjectAccessReviewStatus {
-  // Allowed is required.  True if the action would be allowed, false otherwise.
+  // Allowed is required. True if the action would be allowed, false otherwise.
   optional bool allowed = 1;
 
+  // Denied is optional. True if the action would be denied, otherwise
+  // false. If both allowed is false and denied is false, then the
+  // authorizer has no opinion on whether to authorize the action. Denied
+  // may not be true if Allowed is true.
+  // +optional
+  optional bool denied = 4;
+
   // Reason is optional.  It indicates why a request was allowed or denied.
   // +optional
   optional string reason = 2;

staging/src/k8s.io/api/authorization/v1/types_swagger_doc_generated.go

@@ -148,7 +148,8 @@ func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
 
 var map_SubjectAccessReviewStatus = map[string]string{
 	"":                "SubjectAccessReviewStatus",
-	"allowed":         "Allowed is required.  True if the action would be allowed, false otherwise.",
+	"allowed":         "Allowed is required. True if the action would be allowed, false otherwise.",
+	"denied":          "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
 	"reason":          "Reason is optional.  It indicates why a request was allowed or denied.",
 	"evaluationError": "EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
 }

staging/src/k8s.io/api/authorization/v1beta1/generated.proto

@@ -226,9 +226,16 @@ message SubjectAccessReviewSpec {
 
 // SubjectAccessReviewStatus
 message SubjectAccessReviewStatus {
-  // Allowed is required.  True if the action would be allowed, false otherwise.
+  // Allowed is required. True if the action would be allowed, false otherwise.
   optional bool allowed = 1;
 
+  // Denied is optional. True if the action would be denied, otherwise
+  // false. If both allowed is false and denied is false, then the
+  // authorizer has no opinion on whether to authorize the action. Denied
+  // may not be true if Allowed is true.
+  // +optional
+  optional bool denied = 4;
+
   // Reason is optional.  It indicates why a request was allowed or denied.
   // +optional
   optional string reason = 2;

staging/src/k8s.io/api/authorization/v1beta1/types_swagger_doc_generated.go

@@ -148,7 +148,8 @@ func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
 
 var map_SubjectAccessReviewStatus = map[string]string{
 	"":                "SubjectAccessReviewStatus",
-	"allowed":         "Allowed is required.  True if the action would be allowed, false otherwise.",
+	"allowed":         "Allowed is required. True if the action would be allowed, false otherwise.",
+	"denied":          "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
 	"reason":          "Reason is optional.  It indicates why a request was allowed or denied.",
 	"evaluationError": "EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
 }