policy

package
v1.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: GPL-3.0 Imports: 1 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	BuiltinLinuxReadOnly         = "builtin:linux-readonly"
	BuiltinK8sReadOnly           = "builtin:k8s-readonly"
	BuiltinK8sDangerousDeny      = "builtin:k8s-dangerous-deny"
	BuiltinDockerReadOnly        = "builtin:docker-readonly"
	BuiltinDangerousDeny         = "builtin:dangerous-deny"
	BuiltinSQLReadOnly           = "builtin:sql-readonly"
	BuiltinSQLDangerousDeny      = "builtin:sql-dangerous-deny"
	BuiltinRedisReadOnly         = "builtin:redis-readonly"
	BuiltinRedisDangerousDeny    = "builtin:redis-dangerous-deny"
	BuiltinMongoReadOnly         = "builtin:mongo-readonly"
	BuiltinMongoReadWrite        = "builtin:mongo-readwrite"
	BuiltinMongoDangerousDeny    = "builtin:mongo-dangerous-deny"
	BuiltinKafkaMetadataReadOnly = "builtin:kafka-metadata-readonly"
	BuiltinKafkaMessageRead      = "builtin:kafka-message-read"
	BuiltinKafkaSchemaReadOnly   = "builtin:kafka-schema-readonly"
	BuiltinKafkaConnectReadOnly  = "builtin:kafka-connect-readonly"
	BuiltinKafkaOperator         = "builtin:kafka-operator"
	BuiltinKafkaSecurityAdmin    = "builtin:kafka-security-admin"
	BuiltinKafkaDangerousDeny    = "builtin:kafka-dangerous-deny"
	BuiltinEtcdReadOnly          = "builtin:etcd-readonly"
	BuiltinEtcdDangerousDeny     = "builtin:etcd-dangerous-deny"

	// BuiltinPrefix 内置权限组 ID 前缀
	BuiltinPrefix = "builtin:"
)
View Source 
const (
	PolicyKindCommand = "command"
	PolicyKindQuery   = "query"
	PolicyKindRedis   = "redis"
	PolicyKindMongo   = "mongo"
	PolicyKindKafka   = "kafka"
	PolicyKindK8s     = "k8s"
	PolicyKindEtcd    = "etcd"
)

PolicyKind* 是 policy 逻辑的规范化种类词表,是资产轴与 policy 轴的唯一映射目标。 ai/policy.PolicyKind* 与 policy_group_entity.PolicyType* alias 到这里。

Variables

This section is empty.

Functions

func AssetKindOf added in v1.9.0 

func AssetKindOf(assetType string) (string, bool)

AssetKindOf 返回资产类型对应的 policyKind 及是否已注册。

func GetDefaultPolicyOf added in v1.1.2 

func GetDefaultPolicyOf(assetType string) (any, bool)

GetDefaultPolicyOf 获取指定资产类型的默认策略。 返回策略结构体和是否找到。

func RegisterAssetKind added in v1.9.0 

func RegisterAssetKind(assetType, kind string)

RegisterAssetKind 注册资产类型所用的 policyKind。

func RegisterDefaultPolicy added in v1.1.2 

func RegisterDefaultPolicy(assetType string, provider func() any)

RegisterDefaultPolicy 注册资产类型的默认策略提供者。 内置类型在 init() 中注册，扩展类型在 Bridge.Register 时注册。

func UnregisterAssetKind added in v1.9.0 

func UnregisterAssetKind(assetType string)

UnregisterAssetKind 注销资产类型的 policyKind(测试用)。

func UnregisterDefaultPolicy added in v1.1.2 

func UnregisterDefaultPolicy(assetType string)

UnregisterDefaultPolicy 注销资产类型的默认策略提供者。

Types

type CommandPolicy 

type CommandPolicy struct {
	AllowList []string `json:"allow_list"`       // 直接执行的命令规则
	DenyList  []string `json:"deny_list"`        // 始终拒绝的命令规则
	Groups    []string `json:"groups,omitempty"` // 引用的权限组 ID（内置组: "builtin:xxx", 用户组: "123"）
}

CommandPolicy 命令权限策略

func DefaultCommandPolicy 

func DefaultCommandPolicy() *CommandPolicy

DefaultCommandPolicy 返回默认命令权限策略（引用内置权限组）

func (*CommandPolicy) IsEmpty 

func (p *CommandPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空（无规则且无引用组）

type EtcdPolicy added in v1.7.0 

type EtcdPolicy = RedisPolicy

EtcdPolicy etcd 权限策略（复用 RedisPolicy 结构）

func DefaultEtcdPolicy added in v1.7.0 

func DefaultEtcdPolicy() *EtcdPolicy

DefaultEtcdPolicy 返回默认 etcd 权限策略（引用内置权限组）

type Holder 

type Holder interface {
	GetCommandPolicy() (*CommandPolicy, error)
	GetQueryPolicy() (*QueryPolicy, error)
	GetRedisPolicy() (*RedisPolicy, error)
	GetMongoPolicy() (*MongoPolicy, error)
	GetKafkaPolicy() (*KafkaPolicy, error)
	GetK8sPolicy() (*K8sPolicy, error)
	GetEtcdPolicy() (*EtcdPolicy, error)
}

Holder 策略持有者接口，Asset 和 Group 均实现此接口

type K8sPolicy added in v1.5.0 

type K8sPolicy struct {
	AllowList []string `json:"allow_list"`       // 允许执行的 kubectl 命令模式
	DenyList  []string `json:"deny_list"`        // 拒绝执行的 kubectl 命令模式
	Groups    []string `json:"groups,omitempty"` // 引用的权限组 ID
}

K8sPolicy K8S 权限策略（k8s 类型资产使用，与命令策略结构相同）

func DefaultK8sPolicy added in v1.5.0 

func DefaultK8sPolicy() *K8sPolicy

DefaultK8sPolicy 返回默认 K8S 权限策略（引用内置权限组）

func (*K8sPolicy) IsEmpty added in v1.5.0 

func (p *K8sPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空

type KafkaPolicy added in v1.5.0 

type KafkaPolicy struct {
	AllowList []string `json:"allow_list"`       // 允许的 Kafka action/resource 模式
	DenyList  []string `json:"deny_list"`        // 拒绝的 Kafka action/resource 模式
	Groups    []string `json:"groups,omitempty"` // 引用的权限组 ID
}

KafkaPolicy Kafka 权限策略

func DefaultKafkaPolicy added in v1.5.0 

func DefaultKafkaPolicy() *KafkaPolicy

DefaultKafkaPolicy 返回默认 Kafka 权限策略（引用内置权限组）

func (*KafkaPolicy) IsEmpty added in v1.5.0 

func (p *KafkaPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空

type MongoPolicy added in v1.2.0 

type MongoPolicy struct {
	AllowTypes []string `json:"allow_types,omitempty"` // 允许的操作类型: find, findOne, aggregate, ...
	DenyTypes  []string `json:"deny_types,omitempty"`  // 拒绝的操作类型: dropDatabase, dropCollection, ...
	Groups     []string `json:"groups,omitempty"`      // 引用的权限组 ID
}

MongoPolicy MongoDB 权限策略

func DefaultMongoPolicy added in v1.2.0 

func DefaultMongoPolicy() *MongoPolicy

DefaultMongoPolicy 返回默认 MongoDB 权限策略（引用内置权限组）

func (*MongoPolicy) IsEmpty added in v1.2.0 

func (p *MongoPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空

type QueryPolicy 

type QueryPolicy struct {
	AllowTypes []string `json:"allow_types"`      // 允许的语句类型: SELECT, SHOW, DESCRIBE, EXPLAIN
	DenyTypes  []string `json:"deny_types"`       // 拒绝的语句类型: DROP TABLE, TRUNCATE, ...
	DenyFlags  []string `json:"deny_flags"`       // 拒绝的特征: no_where_delete, prepare, call
	Groups     []string `json:"groups,omitempty"` // 引用的权限组 ID
}

QueryPolicy SQL 权限策略（database 类型资产使用）

func DefaultQueryPolicy 

func DefaultQueryPolicy() *QueryPolicy

DefaultQueryPolicy 返回默认 SQL 权限策略（引用内置权限组）

func (*QueryPolicy) IsEmpty 

func (p *QueryPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空

type RedisPolicy 

type RedisPolicy struct {
	AllowList []string `json:"allow_list"`       // 允许的命令模式
	DenyList  []string `json:"deny_list"`        // 拒绝的命令模式
	Groups    []string `json:"groups,omitempty"` // 引用的权限组 ID
}

RedisPolicy Redis 权限策略

func DefaultRedisPolicy 

func DefaultRedisPolicy() *RedisPolicy

DefaultRedisPolicy 返回默认 Redis 权限策略（引用内置权限组）

func (*RedisPolicy) IsEmpty 

func (p *RedisPolicy) IsEmpty() bool

IsEmpty 检查策略是否为空

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.