Documentation
¶
Overview ¶
Package rbac implements the YAML-driven role-based access control policy engine used by kafkito. It turns a config.RBACConfig into an evaluatable Policy that the HTTP middleware consults for every cluster-scoped request.
Index ¶
- Constants
- Variables
- func MatchName(pattern, name string) bool
- type Policy
- func (p *Policy) Allow(user, _cluster, resType, resName, action string) bool
- func (p *Policy) AllowedResourceNames(user, _cluster, resType, action string) (names []string, all bool)
- func (p *Policy) Enabled() bool
- func (p *Policy) Header() string
- func (p *Policy) MaterializePermissions(user string) map[string][]string
- func (p *Policy) ResolveRoles(user string) []string
Constants ¶
const ( ActionView = "view" ActionConsume = "consume" ActionProduce = "produce" ActionEdit = "edit" ActionDelete = "delete" ActionAdmin = "admin" )
Canonical RBAC actions.
const ( ResourcePrivateCluster = "private_cluster" ActionUse = "use" )
The permission private_cluster:use lets a subject use private clusters when private_clusters.mode is role. It concerns no named resource: callers check it with an empty name, so a rule on the type private_cluster grants it whatever its name part, and so does a rule on "*" with the action use or "*", like any other permission.
Variables ¶
var AllActions = []string{ActionView, ActionConsume, ActionProduce, ActionEdit, ActionDelete, ActionAdmin}
AllActions is the full set of canonical actions.
Functions ¶
func MatchName ¶
MatchName reports whether a concrete resource name matches a glob pattern from the policy. It is exported so HTTP handlers can filter list results (real names from Kafka or the Schema Registry) using the globs returned by AllowedResourceNames. The name is literal: "*" and "" are names, not wildcards.
Types ¶
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is a compiled RBAC policy ready for evaluation.
func Compile ¶
func Compile(cfg config.RBACConfig) *Policy
Compile builds an evaluatable Policy from config.
func (*Policy) Allow ¶
Allow returns true if the subject is allowed action on resource type:name within cluster. resName may be empty (for list operations).
func (*Policy) AllowedResourceNames ¶
func (p *Policy) AllowedResourceNames(user, _cluster, resType, action string) (names []string, all bool)
AllowedResourceNames returns the set of resource name globs (within a type) the user has the given action on. Returns (nil, true) if all are allowed, (names, false) for a specific set. Used for filtering list results.
func (*Policy) MaterializePermissions ¶
MaterializePermissions returns a flat map of resourceType -> []actions for the user. Used by the /api/v1/me endpoint.
func (*Policy) ResolveRoles ¶
ResolveRoles returns the roles for a given user identity. Empty user means anonymous.
Source Files