authz

package

v0.14.0 Latest Latest Go to latest Published: Feb 7, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openchoreo/openchoreo

Links

Documentation ¶

Index ¶

func Initialize(ctx context.Context, mgr ctrl.Manager, cfg Config, logger *slog.Logger) (authzcore.PAP, authzcore.PDP, error)
type Config
type DisabledAuthorizer
- func NewDisabledAuthorizer(logger *slog.Logger) *DisabledAuthorizer

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Initialize ¶

func Initialize(ctx context.Context, mgr ctrl.Manager, cfg Config, logger *slog.Logger) (authzcore.PAP, authzcore.PDP, error)

Initialize creates and returns PAP and PDP implementations based on configuration. When authorization is disabled, it returns a passthrough implementation that allows all operations.

When authorization is enabled, this function sets up informer-based watchers on the manager to sync policies from Kubernetes CRDs. The caller MUST:

Types ¶

type Config ¶ added in v0.13.0

type Config struct {
	// Enabled enables or disables authorization enforcement.
	Enabled bool
	// CacheEnabled enables the Casbin enforcer cache.
	CacheEnabled bool
	// CacheTTL is the cache time-to-live duration.
	CacheTTL time.Duration
	// ResyncInterval is the interval for informer cache resync.
	// This triggers re-listing of resources and OnUpdate callbacks for all objects.
	// Set to 0 to disable periodic resync (watch events still work).
	ResyncInterval time.Duration
}

Config holds configuration for authorization initialization. Policies are loaded from AuthzClusterRole, AuthzRole, AuthzClusterRoleBinding, and AuthzRoleBinding CRDs.

type DisabledAuthorizer ¶

type DisabledAuthorizer struct {
	// contains filtered or unexported fields
}

func NewDisabledAuthorizer ¶

func NewDisabledAuthorizer(logger *slog.Logger) *DisabledAuthorizer

NewDisabledAuthorizer creates a new disabled authorization implementation

func (*DisabledAuthorizer) AddRole ¶

func (da *DisabledAuthorizer) AddRole(ctx context.Context, role *authz.Role) error

AddRole fails with error

func (*DisabledAuthorizer) AddRoleEntitlementMapping ¶

func (da *DisabledAuthorizer) AddRoleEntitlementMapping(ctx context.Context, mapping *authz.RoleEntitlementMapping) error

AddRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) BatchEvaluate ¶

func (da *DisabledAuthorizer) BatchEvaluate(ctx context.Context, request *authz.BatchEvaluateRequest) (*authz.BatchEvaluateResponse, error)

BatchEvaluate always returns decisions allowing access for all requests

func (*DisabledAuthorizer) Evaluate ¶

func (da *DisabledAuthorizer) Evaluate(ctx context.Context, request *authz.EvaluateRequest) (*authz.Decision, error)

Evaluate always returns a decision allowing access

func (*DisabledAuthorizer) ForceRemoveRole ¶ added in v0.9.0

func (da *DisabledAuthorizer) ForceRemoveRole(ctx context.Context, roleRef *authz.RoleRef) error

ForceRemoveRole fails with error

func (*DisabledAuthorizer) GetRole ¶

func (da *DisabledAuthorizer) GetRole(ctx context.Context, roleRef *authz.RoleRef) (*authz.Role, error)

GetRole fails with error

func (*DisabledAuthorizer) GetRoleEntitlementMapping ¶ added in v0.14.0

func (da *DisabledAuthorizer) GetRoleEntitlementMapping(ctx context.Context, mappingRef *authz.MappingRef) (*authz.RoleEntitlementMapping, error)

GetRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) GetSubjectProfile ¶

func (da *DisabledAuthorizer) GetSubjectProfile(ctx context.Context, request *authz.ProfileRequest) (*authz.UserCapabilitiesResponse, error)

GetSubjectProfile returns a profile with all actions allowed

func (*DisabledAuthorizer) ListActions ¶

func (da *DisabledAuthorizer) ListActions(ctx context.Context) ([]string, error)

ListActions fails with error

func (*DisabledAuthorizer) ListRoleEntitlementMappings ¶

func (da *DisabledAuthorizer) ListRoleEntitlementMappings(ctx context.Context, filter *authz.RoleEntitlementMappingFilter) ([]*authz.RoleEntitlementMapping, error)

ListRoleEntitlementMappings fails with error

func (*DisabledAuthorizer) ListRoles ¶

func (da *DisabledAuthorizer) ListRoles(ctx context.Context, filter *authz.RoleFilter) ([]*authz.Role, error)

ListRoles fails with error

func (*DisabledAuthorizer) RemoveRole ¶

func (da *DisabledAuthorizer) RemoveRole(ctx context.Context, roleRef *authz.RoleRef) error

RemoveRole fails with error

func (*DisabledAuthorizer) RemoveRoleEntitlementMapping ¶

func (da *DisabledAuthorizer) RemoveRoleEntitlementMapping(ctx context.Context, mappingRef *authz.MappingRef) error

RemoveRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) UpdateRole ¶ added in v0.9.0

func (da *DisabledAuthorizer) UpdateRole(ctx context.Context, role *authz.Role) error

UpdateRole fails with error

func (*DisabledAuthorizer) UpdateRoleEntitlementMapping ¶ added in v0.9.0

func (da *DisabledAuthorizer) UpdateRoleEntitlementMapping(ctx context.Context, mapping *authz.RoleEntitlementMapping) error

UpdateRoleEntitlementMapping fails with error

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
casbin
core

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL