authz

package
v0.17.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 4, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Initialize 

func Initialize(ctx context.Context, mgr ctrl.Manager, cfg Config, k8sClient client.Client, logger *slog.Logger) (authzcore.PAP, authzcore.PDP, error)

Initialize creates and returns PAP and PDP implementations based on configuration. When authorization is disabled, it returns a passthrough implementation that allows all operations.

When authorization is enabled, this function sets up informer-based watchers on the manager to sync policies from Kubernetes CRDs. The caller MUST:

  1. Start the controller manager (mgr.Start) after calling Initialize.
  2. Wait for the manager's cache to sync before serving requests.

Failing to start the manager or not waiting for cache sync will lead to missing or unstable policy data.

Types

type Config added in v0.13.0 

type Config struct {
	// Enabled enables or disables authorization enforcement.
	Enabled bool
	// CacheEnabled enables the Casbin enforcer cache.
	CacheEnabled bool
	// CacheTTL is the cache time-to-live duration.
	CacheTTL time.Duration
	// ResyncInterval is the interval for informer cache resync.
	// This triggers re-listing of resources and OnUpdate callbacks for all objects.
	// Set to 0 to disable periodic resync (watch events still work).
	ResyncInterval time.Duration
}

Config holds configuration for authorization initialization. Policies are loaded from AuthzClusterRole, AuthzRole, AuthzClusterRoleBinding, and AuthzRoleBinding CRDs.

type DisabledAuthorizer 

type DisabledAuthorizer struct {
	// contains filtered or unexported fields
}

func NewDisabledAuthorizer 

func NewDisabledAuthorizer(logger *slog.Logger) *DisabledAuthorizer

NewDisabledAuthorizer creates a new disabled authorization implementation

func (*DisabledAuthorizer) AddRole 

func (da *DisabledAuthorizer) AddRole(ctx context.Context, role *authz.Role) error

AddRole fails with error

func (*DisabledAuthorizer) AddRoleEntitlementMapping 

func (da *DisabledAuthorizer) AddRoleEntitlementMapping(ctx context.Context, mapping *authz.RoleEntitlementMapping) error

AddRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) BatchEvaluate 

func (da *DisabledAuthorizer) BatchEvaluate(ctx context.Context, request *authz.BatchEvaluateRequest) (*authz.BatchEvaluateResponse, error)

BatchEvaluate always returns decisions allowing access for all requests

func (*DisabledAuthorizer) CreateClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) CreateClusterRole(ctx context.Context, role *openchoreov1alpha1.AuthzClusterRole) (*openchoreov1alpha1.AuthzClusterRole, error)

func (*DisabledAuthorizer) CreateClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) CreateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzClusterRoleBinding) (*openchoreov1alpha1.AuthzClusterRoleBinding, error)

func (*DisabledAuthorizer) CreateNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) CreateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) CreateNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) CreateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

func (*DisabledAuthorizer) Evaluate 

func (da *DisabledAuthorizer) Evaluate(ctx context.Context, request *authz.EvaluateRequest) (*authz.Decision, error)

Evaluate always returns a decision allowing access

func (*DisabledAuthorizer) GetClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) GetClusterRole(ctx context.Context, name string) (*openchoreov1alpha1.AuthzClusterRole, error)

func (*DisabledAuthorizer) GetClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) GetClusterRoleBinding(ctx context.Context, name string) (*openchoreov1alpha1.AuthzClusterRoleBinding, error)

func (*DisabledAuthorizer) GetNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) GetNamespacedRole(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) GetNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) GetNamespacedRoleBinding(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRoleBinding, error)

func (*DisabledAuthorizer) GetRole 

func (da *DisabledAuthorizer) GetRole(ctx context.Context, roleRef *authz.RoleRef) (*authz.Role, error)

GetRole fails with error

func (*DisabledAuthorizer) GetRoleEntitlementMapping added in v0.14.0 

func (da *DisabledAuthorizer) GetRoleEntitlementMapping(ctx context.Context, mappingRef *authz.MappingRef) (*authz.RoleEntitlementMapping, error)

GetRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) GetSubjectProfile 

func (da *DisabledAuthorizer) GetSubjectProfile(ctx context.Context, request *authz.ProfileRequest) (*authz.UserCapabilitiesResponse, error)

GetSubjectProfile returns a profile with all actions allowed

func (*DisabledAuthorizer) ListActions 

func (da *DisabledAuthorizer) ListActions(ctx context.Context) ([]string, error)

ListActions fails with error

func (*DisabledAuthorizer) ListClusterRoleBindings added in v0.16.0 

func (da *DisabledAuthorizer) ListClusterRoleBindings(ctx context.Context, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzClusterRoleBinding], error)

func (*DisabledAuthorizer) ListClusterRoles added in v0.16.0 

func (da *DisabledAuthorizer) ListClusterRoles(ctx context.Context, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzClusterRole], error)

func (*DisabledAuthorizer) ListNamespacedRoleBindings added in v0.16.0 

func (da *DisabledAuthorizer) ListNamespacedRoleBindings(ctx context.Context, namespace string, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzRoleBinding], error)

func (*DisabledAuthorizer) ListNamespacedRoles added in v0.16.0 

func (da *DisabledAuthorizer) ListNamespacedRoles(ctx context.Context, namespace string, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzRole], error)

func (*DisabledAuthorizer) ListRoleEntitlementMappings 

func (da *DisabledAuthorizer) ListRoleEntitlementMappings(ctx context.Context, filter *authz.RoleEntitlementMappingFilter) ([]*authz.RoleEntitlementMapping, error)

ListRoleEntitlementMappings fails with error

func (*DisabledAuthorizer) ListRoles 

func (da *DisabledAuthorizer) ListRoles(ctx context.Context, filter *authz.RoleFilter) ([]*authz.Role, error)

ListRoles fails with error

func (*DisabledAuthorizer) RemoveRole 

func (da *DisabledAuthorizer) RemoveRole(ctx context.Context, roleRef *authz.RoleRef) error

RemoveRole fails with error

func (*DisabledAuthorizer) RemoveRoleEntitlementMapping 

func (da *DisabledAuthorizer) RemoveRoleEntitlementMapping(ctx context.Context, mappingRef *authz.MappingRef) error

RemoveRoleEntitlementMapping fails with error

func (*DisabledAuthorizer) UpdateClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) UpdateClusterRole(ctx context.Context, role *openchoreov1alpha1.AuthzClusterRole) (*openchoreov1alpha1.AuthzClusterRole, error)

func (*DisabledAuthorizer) UpdateClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) UpdateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzClusterRoleBinding) (*openchoreov1alpha1.AuthzClusterRoleBinding, error)

func (*DisabledAuthorizer) UpdateNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) UpdateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) UpdateNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) UpdateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

func (*DisabledAuthorizer) UpdateRole added in v0.9.0 

func (da *DisabledAuthorizer) UpdateRole(ctx context.Context, role *authz.Role) error

UpdateRole fails with error

func (*DisabledAuthorizer) UpdateRoleEntitlementMapping added in v0.9.0 

func (da *DisabledAuthorizer) UpdateRoleEntitlementMapping(ctx context.Context, mapping *authz.RoleEntitlementMapping) error

UpdateRoleEntitlementMapping fails with error

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.