authz

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 21, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ExpandPermissions added in v1.3.0 

func ExpandPermissions(perms map[string][]string, allResources []string) map[string][]string

ExpandPermissions resolves a wildcard-based permission map into an explicit resource-to-verbs mapping. It replicates the precedence logic from CheckPermission: specific entries override the wildcard, and an empty verb list means explicit denial. This is used by both the genroles generator and the round-trip correctness test to ensure a single expansion implementation.

func GetResourcePermissions added in v1.3.0 

func GetResourcePermissions() map[string]map[string][]string

GetResourcePermissions returns a deep copy of the role-based permission map. This is used by the Helm ClusterRole generator to produce K8s RBAC rules that match the static authorization logic.

func GetSyntheticResources added in v1.3.0 

func GetSyntheticResources() []string

GetSyntheticResources returns a copy of the synthetic resource list.

Types

type K8sAuthZ 

type K8sAuthZ struct {
	K8sClient k8sclient.K8SClient
	Namespace string
	Log       logrus.FieldLogger
}

func (K8sAuthZ) CheckPermission 

func (k8sAuth K8sAuthZ) CheckPermission(ctx context.Context, k8sToken string, resource string, op string) (bool, error)

func (K8sAuthZ) GetUserPermissions added in v1.0.0 

func (k8sAuth K8sAuthZ) GetUserPermissions(ctx context.Context, k8sToken string) (*v1beta1.PermissionList, error)

type OpenShiftAuthZ added in v1.0.0 

type OpenShiftAuthZ struct {
	K8sClient k8sclient.K8SClient
	Log       logrus.FieldLogger
	Cache     *ttlcache.Cache[string, bool]
}

func NewOpenShiftAuthZ added in v1.0.0 

func NewOpenShiftAuthZ(ctx context.Context, k8sClient k8sclient.K8SClient, log logrus.FieldLogger) *OpenShiftAuthZ

func (OpenShiftAuthZ) CheckPermission added in v1.0.0 

func (osAuth OpenShiftAuthZ) CheckPermission(ctx context.Context, token string, resource string, op string) (bool, error)

func (OpenShiftAuthZ) GetUserPermissions added in v1.0.0 

func (osAuth OpenShiftAuthZ) GetUserPermissions(ctx context.Context, token string) (*v1beta1.PermissionList, error)

type StaticAuthZ added in v1.0.0 

type StaticAuthZ struct {
	// contains filtered or unexported fields
}

StaticAuthZ implements role-based authorization using system groups

func NewStaticAuthZ added in v1.0.0 

func NewStaticAuthZ(log logrus.FieldLogger) *StaticAuthZ

func (StaticAuthZ) CheckPermission added in v1.0.0 

func (s StaticAuthZ) CheckPermission(ctx context.Context, resource string, op string) (bool, error)

func (StaticAuthZ) GetUserPermissions added in v1.0.0 

func (s StaticAuthZ) GetUserPermissions(ctx context.Context) (*v1beta1.PermissionList, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.