Documentation
¶
Index ¶
- func IsAllowedDefaultModelAlias(alias string) bool
- func IsAllowedModelUsage(usage types.ModelUsage) bool
- func IsInvalidModelResource(err error) bool
- func ValidateModelResource(ctx context.Context, reader kclient.Reader, namespace string, ...) error
- func ValidateModelResources(ctx context.Context, reader kclient.Reader, namespace string, ...) error
- type Helper
- func (h *Helper) GetUserAllowedModels(user kuser.Info) (map[string]bool, bool, error)
- func (h *Helper) GetUserAllowedTargetModels(user kuser.Info, provider, dialect string) (allowed map[string]bool, allowAll bool, _ error)
- func (h *Helper) ResolveModelReference(ctx context.Context, client kclient.Client, ...) (*v1.Model, error)
- func (h *Helper) UserHasAccessToModel(user kuser.Info, modelID string) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsAllowedDefaultModelAlias ¶ added in v0.25.0
IsAllowedDefaultModelAlias reports whether alias can be granted by a model access policy.
func IsAllowedModelUsage ¶ added in v0.25.0
func IsAllowedModelUsage(usage types.ModelUsage) bool
IsAllowedModelUsage reports whether usage can be granted by a model access policy.
func IsInvalidModelResource ¶ added in v0.25.0
IsInvalidModelResource reports whether err identifies a model resource that cannot be used in a model access policy.
func ValidateModelResource ¶ added in v0.25.0
func ValidateModelResource( ctx context.Context, reader kclient.Reader, namespace string, resource types.ModelResource, ) error
ValidateModelResource validates one model access policy resource.
func ValidateModelResources ¶ added in v0.25.0
func ValidateModelResources( ctx context.Context, reader kclient.Reader, namespace string, resources []types.ModelResource, ) error
ValidateModelResources validates all explicit models and default aliases in a policy. Wildcard selectors are allowed because they are selection rules rather than concrete model additions.
Types ¶
type Helper ¶
type Helper struct {
// contains filtered or unexported fields
}
func (*Helper) GetUserAllowedModels ¶
GetUserAllowedModels returns the model IDs that a user can access. Model access policies only grant models with an allowed usage, including when a policy contains a wildcard or suffix selector.
func (*Helper) GetUserAllowedTargetModels ¶ added in v0.23.0
func (h *Helper) GetUserAllowedTargetModels(user kuser.Info, provider, dialect string) (allowed map[string]bool, allowAll bool, _ error)
GetUserAllowedTargetModels returns the set of provider-native target model ids (v1.Model.Spec.Manifest.TargetModel) for provider that the user is allowed to use. When dialect is non-empty, only models using that dialect are returned. A target is included iff a configured, active model maps to it and the user is allowed that model. This mirrors the access check enforced by the LLM passthrough: a target appears here iff a request for it would succeed.
allowAll reports that the user may use every model without a usage restriction. Policy wildcards are enumerated by GetUserAllowedModels instead, so they only include eligible usages. When dialect is empty and allowAll is true, there is nothing to enumerate, so the returned map is nil and callers should skip filtering rather than treat the nil map as "allow nothing". A dialect filter always returns an enumerated target set and allowAll=false.
func (*Helper) ResolveModelReference ¶ added in v0.25.0
func (h *Helper) ResolveModelReference(ctx context.Context, client kclient.Client, namespace, provider, reference string) (*v1.Model, error)
ResolveModelReference resolves a model reference for provider. References may be default model aliases, Model resource names, or provider-native target model IDs. Alias and resource references take precedence over target IDs.
func (*Helper) UserHasAccessToModel ¶
UserHasAccessToModel returns true if the user has access to the model. Access is granted when: - The user is an admin or owner - A ModelAccessPolicy with wildcard subject selector (*) includes the model (or uses wildcard model selector) - A ModelAccessPolicy directly references the user and includes the model (or uses wildcard model selector) - A ModelAccessPolicy references a group the user belongs to and includes the model (or uses wildcard model selector)
Source Files