compute

package
v1.20.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	PolicyComputationNameIndex = statedb.Index[Result, identity.NumericIdentity]{
		Name: "numeric-identity",
		FromObject: func(r Result) index.KeySet {
			return index.NewKeySet(index.Uint32(uint32(r.Identity)))
		},
		FromKey:    func(i identity.NumericIdentity) index.Key { return index.Uint32(uint32(i)) },
		FromString: index.Uint32String,
		Unique:     true,
	}

	PolicyComputationByIdentity = PolicyComputationNameIndex.Query
)
View Source 
var Cell = cell.Module(
	"identity-policy-computer",
	"Handles policy computation per identity",

	cell.ProvidePrivate(NewPolicyComputationTable),
	cell.Provide(
		func(params Params) PolicyRecomputer {
			return NewIdentityPolicyComputer(params)
		},
		statedb.RWTable[Result].ToTable,
	),
)

Cell provides the IdentityPolicyRecomputer as a hive cell.

Functions

func NewPolicyComputationTable 

func NewPolicyComputationTable(db *statedb.DB) (statedb.RWTable[Result], statedb.Index[Result, identity.NumericIdentity], error)

func PolicyComputerScriptCmds 

func PolicyComputerScriptCmds(pc *IdentityPolicyComputer) map[string]script.Cmd

Types

type IdentityPolicyComputer 

type IdentityPolicyComputer struct {
	// contains filtered or unexported fields
}

IdentityPolicyComputer handles policy computation for specific identities.

func NewIdentityPolicyComputer 

func NewIdentityPolicyComputer(params Params) *IdentityPolicyComputer

func (*IdentityPolicyComputer) GetAuthTypes 

func (r *IdentityPolicyComputer) GetAuthTypes(localID, remoteID identity.NumericIdentity) types.AuthTypes

GetAuthTypes returns the AuthTypes required by the policy between localID and remoteID. Returns nil if the local identity has no computed policy yet or if no auth is required.

func (*IdentityPolicyComputer) GetIdentityPolicyByIdentity 

func (r *IdentityPolicyComputer) GetIdentityPolicyByIdentity(identity *identity.Identity) (Result, statedb.Revision, <-chan struct{}, bool)

func (*IdentityPolicyComputer) GetIdentityPolicyByNumericIdentity 

func (r *IdentityPolicyComputer) GetIdentityPolicyByNumericIdentity(identity identity.NumericIdentity) (Result, statedb.Revision, <-chan struct{}, bool)

func (*IdentityPolicyComputer) GetPolicySnapshot 

func (r *IdentityPolicyComputer) GetPolicySnapshot() map[identity.NumericIdentity]policy.SelectorPolicy

GetPolicySnapshot returns the current SelectorPolicy for every identity in the compute table. The returned map is a snapshot taken at a single statedb revision.

func (*IdentityPolicyComputer) LocalEndpointIdentityAdded 

func (r *IdentityPolicyComputer) LocalEndpointIdentityAdded(id *identity.Identity)

LocalEndpointIdentityAdded is part of the identitymanager.Observer interface.

The subject selectorcache must be updated with the identity before recomputation, otherwise policy will not be computed properly.

func (*IdentityPolicyComputer) LocalEndpointIdentityRemoved 

func (r *IdentityPolicyComputer) LocalEndpointIdentityRemoved(id *identity.Identity)

LocalEndpointIdentityRemoved is part of the identitymanager.Observer interface.

func (*IdentityPolicyComputer) RecomputeIdentityPolicy 

func (r *IdentityPolicyComputer) RecomputeIdentityPolicy(identity *identity.Identity, toRev uint64) (<-chan struct{}, error)

RecomputeIdentityPolicy schedules a policy recomputation for identity at toRev. The returned channel closes once the result is committed to the table. A pending request for the same identity is reused, bumping its toRev to max(existing, toRev), so there is at most one in-flight request per identity.

func (*IdentityPolicyComputer) RecomputeIdentityPolicyForAllIdentities 

func (r *IdentityPolicyComputer) RecomputeIdentityPolicyForAllIdentities(toRev uint64) (*statedb.WatchSet, error)

RecomputeIdentityPolicyForAllIdentities recomputes policy for all local identities.

func (*IdentityPolicyComputer) UpdatePolicy 

func (r *IdentityPolicyComputer) UpdatePolicy(idsToRegen set.Set[identity.NumericIdentity], _, toRev uint64)

type Params 

type Params struct {
	cell.In

	Lifecycle cell.Lifecycle
	Logger    *slog.Logger
	JobGroup  job.Group

	DB    *statedb.DB
	Table statedb.RWTable[Result]

	Repo      policy.PolicyRepository
	IDManager identitymanager.IDManager
}

type PolicyRecomputer 

type PolicyRecomputer interface {
	RecomputeIdentityPolicy(identity *identity.Identity, toRev uint64) (<-chan struct{}, error)
	RecomputeIdentityPolicyForAllIdentities(toRev uint64) (*statedb.WatchSet, error)
	UpdatePolicy(idsToRegen set.Set[identity.NumericIdentity], fromRev, toRev uint64)
	GetIdentityPolicyByNumericIdentity(identity identity.NumericIdentity) (Result, statedb.Revision, <-chan struct{}, bool)
	GetIdentityPolicyByIdentity(identity *identity.Identity) (Result, statedb.Revision, <-chan struct{}, bool)
	GetAuthTypes(localID, remoteID identity.NumericIdentity) policyTypes.AuthTypes
	GetPolicySnapshot() map[identity.NumericIdentity]policy.SelectorPolicy
}

type Result 

type Result struct {
	Identity             identity.NumericIdentity
	NewPolicy, OldPolicy policy.SelectorPolicy
	Revision             uint64
	Err                  error
}

func (Result) TableHeader 

func (Result) TableHeader() []string

func (Result) TableRow 

func (r Result) TableRow() []string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.