inventory

type Host ¶

type Host struct {
	Names    []string
	Labels   map[string]string
	Accounts []string
}

Host contains authorization attributes, separate from principal metadata.

type Hosts ¶

type Hosts interface {
	LookupHost(context.Context, string) (*ResolvedHost, error)
}

Hosts resolves machines independently of the user directory.

type PrincipalMode ¶

type PrincipalMode string

PrincipalMode selects how an allowed account@host tuple is represented in an issued SSH certificate.

const (
	// AccountNamePrincipals places the literal requested account name in the
	// certificate. It is compatible with ordinary OpenSSH CA configuration but
	// is not destination-bound.
	AccountNamePrincipals PrincipalMode = "account-name"

	// EpithetPrincipalV1 derives a destination-bound v1 principal from the
	// principal domain and requested account name.
	EpithetPrincipalV1 PrincipalMode = principal.SchemeV1
)

func (m PrincipalMode) Effective() PrincipalMode

func (m PrincipalMode) Validate() error

type ResolvedHost ¶

type ResolvedHost struct {
	Policy        Host
	PrincipalMode PrincipalMode
	Domain        principal.Domain
}

ResolvedHost carries both the authorization resource consumed by Writ and issuance metadata that must remain outside the pure policy model. For a shared named domain, Policy.Names contains only the domain rather than individual DNS names because the resulting credential is portable across every member.

type Static ¶

type Static struct {
	// contains filtered or unexported fields
}

Static is a file-backed inventory: directory users and hosts loaded once at startup. Reload is a process restart, like the policy itself.

Host entries come in two forms. An exact entry (`names:`) is one registered host. A pattern entry (`pattern:`) uses the same DNS-label-aware hostname patterns as Writ host selectors. Exact entries expose all their names; pattern entries adopt the requested name. Destination-bound named domains expose that domain as the Writ resource so policy cannot claim per-member isolation. Patterns are the escape hatch for fleets of short-lived hosts (VM pools, CI runners) that follow a naming pattern but cannot be enumerated in a file.

func NewStatic(paths []string, options ...StaticOption) (*Static, error)

func (s *Static) DirectoryRevision() string

func (s *Static) InventoryRevision() string

func (s *Static) LookupHost(_ context.Context, name string) (*ResolvedHost, error)

func (s *Static) LookupUser(_ context.Context, id string) (*directory.User, error)

type StaticOption ¶

type StaticOption func(*staticOptions) error

StaticOption configures static inventory loading.

func WithDefaultPrincipalMode(mode PrincipalMode) StaticOption