authz

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Initialize 

func Initialize(ctx context.Context, mgr ctrl.Manager, cfg Config, k8sClient client.Client, logger *slog.Logger) (authzcore.PAP, authzcore.PDP, error)

Initialize creates and returns PAP and PDP implementations based on configuration. When authorization is disabled, it returns a passthrough implementation that allows all operations.

When authorization is enabled, this function sets up informer-based watchers on the manager to sync policies from Kubernetes CRDs. The caller MUST:

  1. Start the controller manager (mgr.Start) after calling Initialize.
  2. Wait for the manager's cache to sync before serving requests.

Failing to start the manager or not waiting for cache sync will lead to missing or unstable policy data.

Types

type Config added in v0.13.0 

type Config struct {
	// Enabled enables or disables authorization enforcement.
	Enabled bool
	// CacheEnabled enables the Casbin enforcer cache.
	CacheEnabled bool
	// CacheTTL is the cache time-to-live duration.
	CacheTTL time.Duration
	// ResyncInterval is the interval for informer cache resync.
	// This triggers re-listing of resources and OnUpdate callbacks for all objects.
	// Set to 0 to disable periodic resync (watch events still work).
	ResyncInterval time.Duration
}

Config holds configuration for authorization initialization. Policies are loaded from ClusterAuthzRole, AuthzRole, ClusterAuthzRoleBinding, and AuthzRoleBinding CRDs.

type DisabledAuthorizer 

type DisabledAuthorizer struct {
	// contains filtered or unexported fields
}

func NewDisabledAuthorizer 

func NewDisabledAuthorizer(logger *slog.Logger) *DisabledAuthorizer

NewDisabledAuthorizer creates a new disabled authorization implementation

func (*DisabledAuthorizer) BatchEvaluate 

func (da *DisabledAuthorizer) BatchEvaluate(ctx context.Context, request *authz.BatchEvaluateRequest) (*authz.BatchEvaluateResponse, error)

BatchEvaluate always returns decisions allowing access for all requests

func (*DisabledAuthorizer) CreateClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) CreateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)

func (*DisabledAuthorizer) CreateClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) CreateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

func (*DisabledAuthorizer) CreateNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) CreateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) CreateNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) CreateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

func (*DisabledAuthorizer) DeleteClusterRole added in v1.0.0 

func (da *DisabledAuthorizer) DeleteClusterRole(ctx context.Context, name string) error

func (*DisabledAuthorizer) DeleteClusterRoleBinding added in v1.0.0 

func (da *DisabledAuthorizer) DeleteClusterRoleBinding(ctx context.Context, name string) error

func (*DisabledAuthorizer) DeleteNamespacedRole added in v1.0.0 

func (da *DisabledAuthorizer) DeleteNamespacedRole(ctx context.Context, name string, namespace string) error

func (*DisabledAuthorizer) DeleteNamespacedRoleBinding added in v1.0.0 

func (da *DisabledAuthorizer) DeleteNamespacedRoleBinding(ctx context.Context, name string, namespace string) error

func (*DisabledAuthorizer) Evaluate 

func (da *DisabledAuthorizer) Evaluate(ctx context.Context, request *authz.EvaluateRequest) (*authz.Decision, error)

Evaluate always returns a decision allowing access

func (*DisabledAuthorizer) GetClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) GetClusterRole(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRole, error)

func (*DisabledAuthorizer) GetClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) GetClusterRoleBinding(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

func (*DisabledAuthorizer) GetNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) GetNamespacedRole(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) GetNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) GetNamespacedRoleBinding(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRoleBinding, error)

func (*DisabledAuthorizer) GetSubjectProfile 

func (da *DisabledAuthorizer) GetSubjectProfile(ctx context.Context, request *authz.ProfileRequest) (*authz.UserCapabilitiesResponse, error)

GetSubjectProfile returns a profile with all actions allowed

func (*DisabledAuthorizer) ListActions 

func (da *DisabledAuthorizer) ListActions(ctx context.Context) ([]authz.Action, error)

ListActions fails with error

func (*DisabledAuthorizer) ListClusterRoleBindings added in v0.16.0 

func (da *DisabledAuthorizer) ListClusterRoleBindings(ctx context.Context, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.ClusterAuthzRoleBinding], error)

func (*DisabledAuthorizer) ListClusterRoles added in v0.16.0 

func (da *DisabledAuthorizer) ListClusterRoles(ctx context.Context, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.ClusterAuthzRole], error)

func (*DisabledAuthorizer) ListNamespacedRoleBindings added in v0.16.0 

func (da *DisabledAuthorizer) ListNamespacedRoleBindings(ctx context.Context, namespace string, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzRoleBinding], error)

func (*DisabledAuthorizer) ListNamespacedRoles added in v0.16.0 

func (da *DisabledAuthorizer) ListNamespacedRoles(ctx context.Context, namespace string, limit int, cursor string) (*authz.PaginatedList[openchoreov1alpha1.AuthzRole], error)

func (*DisabledAuthorizer) UpdateClusterRole added in v0.16.0 

func (da *DisabledAuthorizer) UpdateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)

func (*DisabledAuthorizer) UpdateClusterRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) UpdateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

func (*DisabledAuthorizer) UpdateNamespacedRole added in v0.16.0 

func (da *DisabledAuthorizer) UpdateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

func (*DisabledAuthorizer) UpdateNamespacedRoleBinding added in v0.16.0 

func (da *DisabledAuthorizer) UpdateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

Source Files

View all Source files

Directories

Path Synopsis
mocks

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.