rbac

package

v1.3.8 Latest Latest Go to latest Published: May 19, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation ¶

Overview ¶

Package rbac implements utility functions for Role-Based Access Control

Index ¶

Constants
Variables
func ExtractAuthorizationFromMd(ctx context.Context) (string, error)
func GetResourceRole(claims map[string]interface{}) (string, error)
func SetOPAPolicies()
func VerifyContextClaims(ctx context.Context) (metautils.NiceMD, error)
type Policy
- func New(ruleDirectory string) (*Policy, error)
- func (p *Policy) RequestIsAuthorized(ctx context.Context, operation string) bool
- func (p *Policy) Verify(claims metautils.NiceMD, operation string) error

Constants ¶

View Source

const (
	// global variables
	ClusterRoleWrite = "clusters-write-role"
	ClusterRoleRead  = "clusters-read-role"

	TemplateRoleWrite = "cluster-templates-write-role"
	TemplateRoleRead  = "cluster-templates-read-role"

	RoleRancherHeader = "rancher-role-header"

	RbacDirectory = "/rego/authz.rego"

	// internal variables
	RoleRancherAdmin     = "restricted-role"
	RoleRancherReadWrite = "standard-role"
	RoleRancherReadOnly  = "base-role"

	MethodPost     = "POST"
	MethodPut      = "PUT"
	MethodDelete   = "DELETE"
	MethodGet      = "GET"
	MethodPatch    = "PATCH"
	MethodUpdate   = "UPDATE"
	MethodRegister = "REGISTER"
)

Variables ¶

View Source

var (
	Policies        *Policy
	PolicyExistFlag bool
)

Functions ¶

func ExtractAuthorizationFromMd ¶

func ExtractAuthorizationFromMd(ctx context.Context) (string, error)

func GetResourceRole ¶

func GetResourceRole(claims map[string]interface{}) (string, error)

func SetOPAPolicies ¶

func SetOPAPolicies()

func VerifyContextClaims ¶

func VerifyContextClaims(ctx context.Context) (metautils.NiceMD, error)

Types ¶

type Policy ¶

type Policy struct {
	// contains filtered or unexported fields
}

func New ¶

func New(ruleDirectory string) (*Policy, error)

func (*Policy) RequestIsAuthorized ¶

func (p *Policy) RequestIsAuthorized(ctx context.Context, operation string) bool

RequestIsAuthorized function validates the JWT token included in a context. It also starts the OPA instance and performs the RBAC authorization of the call.

func (*Policy) Verify ¶

func (p *Policy) Verify(claims metautils.NiceMD, operation string) error

Source Files ¶

View all Source files

rbac.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL