Documentation
¶
Overview ¶
Package mountpolicy resolves and verifies Dataset REFERENCE mount permissions.
It is intentionally independent from the Dataset controller so every mount consumer can make the same fail-closed decision immediately before creating a Pod.
Index ¶
- Constants
- func Bindings(ctx context.Context, reader client.Reader, sources []*datasetv1alpha1.Dataset) ([]datasetv1alpha1.MountSource, error)
- func ParseReference(uri string) (client.ObjectKey, error)
- func ProtectedPVC(ctx context.Context, reader client.Reader, namespace, pvcName string) (bool, error)
- func Validate(ds *datasetv1alpha1.Dataset) error
- func VerifyPVCBinding(ctx context.Context, reader client.Reader, ds *datasetv1alpha1.Dataset, ...) error
- type GrantResult
- type Resolution
Constants ¶
const ( // MaxReferenceDepth bounds both the work performed by a request and the // amount of source state a Dataset status can retain. MaxReferenceDepth = 32 // MountPolicyCondition is the authoritative condition for status.ReadOnly. MountPolicyCondition = "MountPolicy" SourceDatasetUIDAnnotation = "dataset.baizeai.io/mount-source-dataset-uid" SourcePVCUIDAnnotation = "dataset.baizeai.io/mount-source-pvc-uid" SourcePVUIDAnnotation = "dataset.baizeai.io/mount-source-pv-uid" )
Variables ¶
This section is empty.
Functions ¶
func Bindings ¶
func Bindings(ctx context.Context, reader client.Reader, sources []*datasetv1alpha1.Dataset) ([]datasetv1alpha1.MountSource, error)
Bindings returns the status representation of the supplied source chain and verifies that every Dataset has an actual PVC and PV. It intentionally reads live objects rather than trusting an old status record.
func ParseReference ¶
ParseReference validates a REFERENCE URI and returns its source Dataset key. It is shared by the controller and policy resolver so both paths accept the same URI grammar.
func ProtectedPVC ¶
func ProtectedPVC(ctx context.Context, reader client.Reader, namespace, pvcName string) (bool, error)
ProtectedPVC reports whether a PVC is the controller-managed PVC of any REFERENCE Dataset. Callers must treat an error as a denial, preventing an ordinary PVC Dataset from becoming an alias that bypasses mount policy.
func Validate ¶
func Validate(ds *datasetv1alpha1.Dataset) error
Validate verifies policy data defensively. CRD CEL performs the same checks for normal API writes, but controllers must not trust objects that bypassed schema validation (for example, a fake client, an old API server, or an imported object).
func VerifyPVCBinding ¶
func VerifyPVCBinding(ctx context.Context, reader client.Reader, ds *datasetv1alpha1.Dataset, source *datasetv1alpha1.Dataset, sourceBinding datasetv1alpha1.MountSource) error
VerifyPVCBinding validates the current reference Dataset's own PVC/PV. The source Dataset/PV are passed explicitly so this is also usable by the controller before it writes the MountPolicy=True condition.
Types ¶
type GrantResult ¶
type GrantResult string
GrantResult is the result of granting one source Dataset to one target namespace. It is not a Kubernetes volume access mode.
const ( Denied GrantResult = "Denied" ReadOnly GrantResult = "ReadOnly" ReadWrite GrantResult = "ReadWrite" )
func Grant ¶
func Grant(ctx context.Context, reader client.Reader, source *datasetv1alpha1.Dataset, targetNamespace string) (GrantResult, error)
Grant computes the access that source grants to targetNamespace. Namespace labels are always loaded from the API reader; callers never supply a workspace ID or a label map, which prevents a request from forging identity.
type Resolution ¶
type Resolution struct {
Sources []*datasetv1alpha1.Dataset
ReadOnly bool
}
Resolution is the direct-to-root source chain for one REFERENCE Dataset.
func Resolve ¶
func Resolve(ctx context.Context, reader client.Reader, ds *datasetv1alpha1.Dataset) (*Resolution, error)
Resolve checks every ancestor against the final namespace and all intervening reference namespaces. Any inherited denial or read-only grant is preserved. Cached upstream status.ReadOnly never grants access.
func Verify ¶
func Verify(ctx context.Context, reader client.Reader, ds *datasetv1alpha1.Dataset) (*Resolution, error)
Verify confirms that a reference Dataset is still mountable. It is the only method a pod-producing consumer should use to decide whether ReadOnly=false permits a writable volume.
Source Files