Documentation
¶
Overview ¶
Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused. Roles come from the Authenticator (the proxy's groups header, an OIDC token's claims), so this adapter stores nothing.
It is deliberately coarse. A policy per kind, or per manifest, is a second adapter over the same Action; the enforcement point does not change.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Authorizer ¶
type Authorizer struct {
// contains filtered or unexported fields
}
Authorizer holds the two role sets.
func New ¶
func New(readRoles, writeRoles []string) *Authorizer
New builds the policy. An empty read set means any authenticated principal may read; an empty write set means nobody may write.
func Parse ¶
func Parse(readRoles, writeRoles string) *Authorizer
Parse builds the policy from two comma-separated lists, the shape the environment carries.
Source Files
Click to show internal directories.
Click to hide internal directories.