casbin

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	NamespaceResourcePrefix = "ns"
	ProjectResourcePrefix   = "project"
	ComponentResourcePrefix = "component"
	ResourceResourcePrefix  = "resource"
)

HierarchyResourcePrefix constants for resource path formatting

View Source 
const (
	CRDTypeAuthzRole               = "AuthzRole"
	CRDTypeClusterAuthzRole        = "ClusterAuthzRole"
	CRDTypeAuthzRoleBinding        = "AuthzRoleBinding"
	CRDTypeClusterAuthzRoleBinding = "ClusterAuthzRoleBinding"
)

CRD type constants for authz resources

Variables

This section is empty.

Functions

func ConditionMatcher added in v1.1.0 

func ConditionMatcher(requestCtxJSON, requestAction, policyCond, policyEft, bindingName string) bool

ConditionMatcher evaluates the per-binding ABAC conditions against the request.

func SetupAuthzWatchers added in v0.14.0 

func SetupAuthzWatchers(
	ctx context.Context,
	mgr ctrl.Manager,
	enforcer casbin.IEnforcer,
	logger *slog.Logger,
) error

SetupAuthzWatchers sets up informer-based watchers with incremental updates

Types

type CasbinConfig 

type CasbinConfig struct {
	K8sClient    client.Client // Required: Kubernetes client
	CacheEnabled bool          // Optional: Enable policy cache (default: false)
	CacheTTL     time.Duration // Optional: Cache TTL (default: 5m)
}

CasbinConfig holds configuration for the Casbin enforcer. Policies are loaded from ClusterAuthzRole, AuthzRole, ClusterAuthzRoleBinding, and AuthzRoleBinding CRDs.

type CasbinEnforcer 

type CasbinEnforcer struct {
	// contains filtered or unexported fields
}

CasbinEnforcer implements both PDP and PAP interfaces using Casbin with Kubernetes CRDs

func NewEnforcer added in v0.14.0 

func NewEnforcer(ctx context.Context, config CasbinConfig, logger *slog.Logger) (*CasbinEnforcer, error)

NewEnforcer creates a new Casbin-based authorizer using Kubernetes CRD adapter

func (*CasbinEnforcer) BatchEvaluate 

func (ce *CasbinEnforcer) BatchEvaluate(ctx context.Context, request *authzcore.BatchEvaluateRequest) (*authzcore.BatchEvaluateResponse, error)

BatchEvaluate evaluates multiple authorization requests and returns corresponding decisions NOTE: if needed, can be enhanced to do in parallel

func (*CasbinEnforcer) CreateClusterRole added in v0.16.0 

func (ce *CasbinEnforcer) CreateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)

CreateClusterRole creates a new cluster-scoped role and returns the full CRD object

func (*CasbinEnforcer) CreateClusterRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) CreateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

CreateClusterRoleBinding creates a new cluster-scoped role binding and returns the full CRD object

func (*CasbinEnforcer) CreateNamespacedRole added in v0.16.0 

func (ce *CasbinEnforcer) CreateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

CreateNamespacedRole creates a new namespace-scoped role and returns the full CRD object

func (*CasbinEnforcer) CreateNamespacedRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) CreateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

CreateNamespacedRoleBinding creates a new namespace-scoped role binding and returns the full CRD object

func (*CasbinEnforcer) DeleteClusterRole added in v1.0.0 

func (ce *CasbinEnforcer) DeleteClusterRole(ctx context.Context, name string) error

DeleteClusterRole deletes a cluster-scoped role by name

func (*CasbinEnforcer) DeleteClusterRoleBinding added in v1.0.0 

func (ce *CasbinEnforcer) DeleteClusterRoleBinding(ctx context.Context, name string) error

DeleteClusterRoleBinding deletes a cluster-scoped role binding by name

func (*CasbinEnforcer) DeleteNamespacedRole added in v1.0.0 

func (ce *CasbinEnforcer) DeleteNamespacedRole(ctx context.Context, name string, namespace string) error

DeleteNamespacedRole deletes a namespace-scoped role by name and namespace

func (*CasbinEnforcer) DeleteNamespacedRoleBinding added in v1.0.0 

func (ce *CasbinEnforcer) DeleteNamespacedRoleBinding(ctx context.Context, name string, namespace string) error

DeleteNamespacedRoleBinding deletes a namespace-scoped role binding by name and namespace

func (*CasbinEnforcer) Evaluate 

func (ce *CasbinEnforcer) Evaluate(ctx context.Context, request *authzcore.EvaluateRequest) (*authzcore.Decision, error)

Evaluate evaluates a single authorization request and returns a decision

func (*CasbinEnforcer) GetClusterRole added in v0.16.0 

func (ce *CasbinEnforcer) GetClusterRole(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRole, error)

GetClusterRole retrieves a cluster-scoped role by name

func (*CasbinEnforcer) GetClusterRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) GetClusterRoleBinding(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

GetClusterRoleBinding retrieves a cluster-scoped role binding by name

func (*CasbinEnforcer) GetEnforcer added in v0.14.0 

func (ce *CasbinEnforcer) GetEnforcer() casbin.IEnforcer

GetEnforcer returns the underlying Casbin enforcer for use by watchers. This is needed to set up informer-based policy synchronization.

func (*CasbinEnforcer) GetNamespacedRole added in v0.16.0 

func (ce *CasbinEnforcer) GetNamespacedRole(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRole, error)

GetNamespacedRole retrieves a namespace-scoped role by name and namespace

func (*CasbinEnforcer) GetNamespacedRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) GetNamespacedRoleBinding(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRoleBinding, error)

GetNamespacedRoleBinding retrieves a namespace-scoped role binding by name and namespace

func (*CasbinEnforcer) GetSubjectProfile 

func (ce *CasbinEnforcer) GetSubjectProfile(ctx context.Context, request *authzcore.ProfileRequest) (*authzcore.UserCapabilitiesResponse, error)

GetSubjectProfile retrieves the authorization profile for a given subject

func (*CasbinEnforcer) ListActions 

func (ce *CasbinEnforcer) ListActions(ctx context.Context) ([]authzcore.Action, error)

ListActions returns all public actions in the system

func (*CasbinEnforcer) ListClusterRoleBindings added in v0.16.0 

func (ce *CasbinEnforcer) ListClusterRoleBindings(ctx context.Context, limit int, cursor string) (*authzcore.PaginatedList[openchoreov1alpha1.ClusterAuthzRoleBinding], error)

ListClusterRoleBindings lists all cluster-scoped role bindings

func (*CasbinEnforcer) ListClusterRoles added in v0.16.0 

func (ce *CasbinEnforcer) ListClusterRoles(ctx context.Context, limit int, cursor string) (*authzcore.PaginatedList[openchoreov1alpha1.ClusterAuthzRole], error)

ListClusterRoles lists all cluster-scoped roles

func (*CasbinEnforcer) ListNamespacedRoleBindings added in v0.16.0 

func (ce *CasbinEnforcer) ListNamespacedRoleBindings(ctx context.Context, namespace string, limit int, cursor string) (*authzcore.PaginatedList[openchoreov1alpha1.AuthzRoleBinding], error)

ListNamespacedRoleBindings lists namespace-scoped role bindings in the given namespace

func (*CasbinEnforcer) ListNamespacedRoles added in v0.16.0 

func (ce *CasbinEnforcer) ListNamespacedRoles(ctx context.Context, namespace string, limit int, cursor string) (*authzcore.PaginatedList[openchoreov1alpha1.AuthzRole], error)

ListNamespacedRoles lists namespace-scoped roles in the given namespace

func (*CasbinEnforcer) UpdateClusterRole added in v0.16.0 

func (ce *CasbinEnforcer) UpdateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)

UpdateClusterRole updates a cluster-scoped role and returns the updated CRD object

func (*CasbinEnforcer) UpdateClusterRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) UpdateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)

UpdateClusterRoleBinding updates a cluster-scoped role binding and returns the updated CRD object

func (*CasbinEnforcer) UpdateNamespacedRole added in v0.16.0 

func (ce *CasbinEnforcer) UpdateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)

UpdateNamespacedRole updates a namespace-scoped role and returns the updated CRD object

func (*CasbinEnforcer) UpdateNamespacedRoleBinding added in v0.16.0 

func (ce *CasbinEnforcer) UpdateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)

UpdateNamespacedRoleBinding updates a namespace-scoped role binding and returns the updated CRD object

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.