Documentation
¶
Overview ¶
Package rules registers the single `rule` block kind. Each rule is one policy decision targeting one or more endpoints; the rule's protocol family (https / sql / k8s) is inferred from the resolved endpoints at validate/build time. Mixed-family endpoint sets are rejected with a clean diagnostic.
The match predicate is expressed as a single CEL string in the `condition` attribute, evaluated against the facet-owned environment for the rule's family (see config/plugins/facets/{https,sql,k8s}/). `approve` is a list whose elements are bare-name approver references.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Plugin ¶
Plugin returns the single config.Plugin that registers `rule` as a one-label config.KindRule. Family inference happens at validate time based on the resolved endpoints, so this plugin doesn't carry a family constraint on its endpoint refs — the inferFamily walk reports mixed-family endpoint sets directly.
Types ¶
type Rule ¶
type Rule struct {
Name string `json:"name"`
Family string `json:"family"` // "http" | "sql" | "k8s"
Endpoints []string `json:"endpoints"`
Priority int `json:"priority,omitempty"`
Disabled bool `json:"disabled,omitempty"`
Condition string `json:"condition,omitempty"`
Credential string `json:"credential,omitempty"`
Verdict string `json:"verdict,omitempty"` // "allow" | "deny" | "" (when Approve is set)
Reason string `json:"reason,omitempty"`
Approve []config.ApproveStage `json:"approve,omitempty"`
}
Rule is the canonical, family-stamped record stored in Policy.Rules[name].Body.
func (*Rule) Compile ¶
func (r *Rule) Compile() (*config.CompiledRule, []string, error)
Compile lowers a built rule into the runtime-friendly *CompiledRule the request handler consumes. The match.Matcher is constructed via the facet registry so per-family quirks live with the plugin that owns them.
Returns the compiled rule plus the list of endpoint names this rule attaches to.
type RuleBody ¶
type RuleBody struct {
// Endpoint is the single endpoint this rule attaches to. Use
// endpoint or endpoints, not both.
Endpoint string `hcl:"endpoint,optional"`
// Endpoints is the list of endpoints this rule attaches to. All
// referenced endpoints must share one protocol family.
Endpoints []string `hcl:"endpoints,optional"`
// Priority orders matching rules. Higher values run first; equal
// priorities preserve declaration order.
Priority int `hcl:"priority,optional"`
// Disabled keeps the rule in config while excluding it from
// runtime evaluation.
Disabled bool `hcl:"disabled,optional"`
// Condition is a CEL expression evaluated against the
// family-specific variable set. An absent / empty condition
// matches everything — the catch-all pattern (`rule
// "X-default" { priority = -100; verdict = "deny" }`) relies
// on this.
Condition string `hcl:"condition,optional"`
// Credential, if set, is a bare-name reference to a credential
// block. The runtime treats it as an extra match predicate
// (request must have been dispatched against this credential)
// evaluated before the CEL expression.
Credential string `hcl:"credential,optional"`
// Verdict is the outcome when the rule matches. Set exactly one
// of `verdict` (`"allow"` / `"deny"`) or `approve`.
Verdict string `hcl:"verdict,optional"`
// Reason is the operator-facing explanation recorded when the rule
// matches.
Reason string `hcl:"reason,optional"`
// Approve is a list of bare-name approver references. The
// approvers run in order; the request is allowed only if every
// stage approves. Set this *or* `verdict`, not both.
Approve cty.Value `hcl:"approve,optional"`
}
RuleBody is the gohcl-tagged decode target. The match predicate is family-agnostic at the HCL layer (just a CEL string); the facet's *cel.Env decides which variables are valid once the family has been inferred from the endpoint refs.
Source Files