Documentation
¶
Overview ¶
Package gcppam implements the approval.Backend over GCP Privileged Access Manager (PAM). The server requests a time-bound grant per (class, target) entitlement, lists grant state, and revokes after apply; humans approve in PAM. Everything deployment-specific — the per-class entitlement ids, the requester service-account pool, the grant duration — is Config, so the package carries no hardcoded names. GCP credential acquisition is injected (see New), keeping the package dependency-free and offline-testable.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend struct {
// contains filtered or unexported fields
}
Backend is the GCP PAM approval backend.
func New ¶
func New(cfg Config, token TokenFunc, impersonate ImpersonateFunc) *Backend
New builds a gcp-pam backend. token supplies ADC bearer tokens (list/revoke); impersonate supplies a requester-SA token (create).
func (*Backend) ListGrants ¶
ListGrants returns the grants on the (class, target) entitlement, mapped to approval.Grant with state normalised and the (PR, environment) parsed from each grant's justification. Uses the ADC token. Follows pagination.
func (*Backend) RequestGrant ¶
RequestGrant ensures an open grant exists for req: it lists the entitlement's grants and reuses an open one whose justification matches (idempotent re-request); otherwise it impersonates the leased requester identity and creates a new grant. PAM blocks self-approval and the server only ever holds a requester identity, so it can request but never approve.
type Config ¶
type Config struct {
// BaseURL is the PAM REST base; empty uses the public GCP endpoint.
BaseURL string
// Location is the entitlement location; empty defaults to "global".
Location string
// Entitlements maps a classification class (e.g. "iam") to the PAM
// entitlement id requested for that class.
Entitlements map[string]string
// EntitlementScopes maps a class to the PAM entitlement resource scope —
// "projects" (default), "folders", or "organizations". The class's target is
// the id within that scope. Empty/absent ⇒ "projects" (backward compatible).
EntitlementScopes map[string]string
// RequesterPool is the set of service-account identities the backend
// impersonates when requesting a grant (one leased per PR). Per the PAM model
// the grant elevates the *requester*, so a pool avoids elevating every
// concurrent workload that shares one identity.
RequesterPool []string
// Duration is the requested grant duration (e.g. "28800s"); empty defaults to
// 8 hours.
Duration string
}
Config is the gcp-pam backend configuration.
type ImpersonateFunc ¶
TokenFunc returns an OAuth2 bearer token for the ambient identity (ADC), used for list/revoke. ImpersonateFunc returns a token for a specific service account, used for create (so PAM records the grant against the requester). Both are injected so the package needs no GCP client dependency; the serve command supplies the real implementations.
type TokenFunc ¶
TokenFunc returns an OAuth2 bearer token for the ambient identity (ADC), used for list/revoke. ImpersonateFunc returns a token for a specific service account, used for create (so PAM records the grant against the requester). Both are injected so the package needs no GCP client dependency; the serve command supplies the real implementations.
Source Files