Documentation
¶
Overview ¶
Package permissions resolves RBAC bindings and roles into a flat "effective permissions" view keyed by subject. It does not evaluate at request time; it just unions the rules reachable via all bindings for each subject so the analyzers can reason about subject capabilities without re-traversing the graph.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Aggregate ¶
func Aggregate(snapshot models.Snapshot) map[string]*EffectivePermissions
Aggregate walks every RoleBinding and ClusterRoleBinding, resolves their RoleRef to the referenced rules, and returns a subject-keyed map of every rule granted to that subject. Missing roles silently contribute no rules.
func SubjectRef ¶
func SubjectRef(subject rbacv1.Subject, fallbackNamespace string) models.SubjectRef
SubjectRef converts an rbacv1.Subject into a models.SubjectRef, filling in a ServiceAccount namespace from fallbackNamespace when omitted.
Types ¶
type EffectivePermissions ¶
type EffectivePermissions struct {
Subject models.SubjectRef
Rules []EffectiveRule
}
EffectivePermissions is the set of rules effectively granted to a single RBAC subject across all bindings.
type EffectiveRule ¶
type EffectiveRule struct {
Namespace string // binding namespace, or empty for cluster-scoped rules
APIGroups []string
Resources []string
Verbs []string
SourceRole string
SourceBinding string
}
EffectiveRule is one PolicyRule copy tagged with where it came from (namespace, originating Role/ClusterRole, binding).
Source Files