Documentation
¶
Overview ¶
Package authz contains the shared authorization mode setting used by Radius services for internal component authorization.
Every service reads a Mode from its configuration file:
- ModeOff (default): authorization checks are not applied.
- ModeDryRun: checks run, and denials are logged instead of rejected. This is the preflight run operators use before turning on enforcement.
- ModeEnforce: checks run, and denials are logged and rejected with a specific error code.
Checks build a Decision and pass it to Apply, which acts on it according to the configured mode. Decisions carry an error code rather than a free-text reason to avoid exposing sensitive diagnostic text in errors or logs. An enforced denial is a *DeniedError, which converts to an ARM error response whose HTTP status comes from StatusForCode. Conversion requires the caller's requested action and target, and names the admission rule for AdmissionPolicyDenied.
Index ¶
Constants ¶
const ( // LogFieldMode is the log key for the authorization mode. LogFieldMode = "authzMode" // LogFieldWouldDeny marks a denial that was logged in dry-run mode instead of rejected. LogFieldWouldDeny = "authzWouldDeny" // LogFieldDenied marks a denial that was rejected in enforce mode. LogFieldDenied = "authzDenied" // LogFieldCode is the log key for the authorization error code. LogFieldCode = "authzCode" // LogFieldAction is the log key for the caller's requested action. LogFieldAction = "authzAction" // LogFieldTarget is the log key for the caller's requested target. LogFieldTarget = "authzTarget" // LogFieldRule is the log key for the public admission rule identifier. LogFieldRule = "authzRule" )
const ( // CodePeerCertificateInvalid is logged when a peer's certificate fails verification. CodePeerCertificateInvalid = "PeerCertificateInvalid" // CodeCertificateExpired is logged when a component's own certificate has expired. CodeCertificateExpired = "CertificateExpired" )
Log-only codes for mTLS handshake failures. A failed handshake has no HTTP response, so these codes are used only in logs and metrics and have no HTTP status.
const CodeAuthorizationFailed = v1.CodeAuthorizationFailed
CodeAuthorizationFailed is used when a denial does not carry a specific code.
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply acts on an authorization decision according to mode. It returns nil when the decision is allowed or mode is off, logs and returns nil for a denial in dry-run mode, and logs and returns a *DeniedError for a denial in enforce mode. An unknown mode fails closed, even for allowed decisions.
func GenericMessageForCode ¶
GenericMessageForCode returns a public authorization error message for code when request action and target details are unavailable.
func StatusForCode ¶
StatusForCode returns the HTTP status for an authorization error code. It returns http.StatusInternalServerError for log-only codes and unknown codes, since neither is expected in an HTTP response.
Types ¶
type Decision ¶
type Decision struct {
// Allowed is true when the check passed.
Allowed bool
// Code is the error code for a denial, such as "AuthorizationFailed".
Code string
// Action is the caller's requested action, such as "Applications.Core/containers/write".
Action string
// Target is the caller's requested resource ID or scope, not a resource discovered
// while evaluating permissions.
Target string
// Rule is the public identifier of the admission rule that rejected the request,
// such as "control-plane-secret". It is required for AdmissionPolicyDenied.
Rule string
}
Decision is the result of an authorization check.
type DeniedError ¶
type DeniedError struct {
// Code is the error code for the denial.
Code string
// Action is the caller's requested action. It is required for ARM responses.
Action string
// Target is the caller's requested resource ID or scope, not a resource discovered
// while evaluating permissions. It is required for ARM responses.
Target string
// Rule is the public admission rule identifier. It is required for, and only
// included in, AdmissionPolicyDenied responses.
Rule string
}
DeniedError is returned by Apply when a denial is enforced.
func (*DeniedError) Error ¶
func (e *DeniedError) Error() string
Error implements the error interface.
func (*DeniedError) ErrorResponse ¶
func (e *DeniedError) ErrorResponse() (v1.ErrorResponse, error)
ErrorResponse converts the denial to an ARM error response body. Action and Target must identify the caller's requested action and target; conversion fails if either is blank. AdmissionPolicyDenied responses also name Rule, which must be a short identifier. The public message varies by error code so unavailable checks and authentication failures are not described as authorization denials.
type DeniedResponse ¶
type DeniedResponse struct {
// StatusCode is the HTTP status to write.
StatusCode int
// Body is the ARM error payload.
Body v1.ErrorResponse
}
DeniedResponse is a rest.Response that writes an ARM error payload for an authorization failure.
func (*DeniedResponse) Apply ¶
func (r *DeniedResponse) Apply(ctx context.Context, w http.ResponseWriter, req *http.Request) error
Apply writes the response status and JSON body to w.
type Mode ¶
type Mode string
Mode is the authorization mode of a Radius installation.
const ( // ModeOff disables authorization checks. This is the default. ModeOff Mode = "off" // ModeDryRun runs authorization checks and logs denials without rejecting requests. ModeDryRun Mode = "dryRun" // ModeEnforce runs authorization checks and rejects denied requests. ModeEnforce Mode = "enforce" )
type Options ¶
type Options struct {
// Mode is the authorization mode. Defaults to ModeOff when unset.
Mode Mode `yaml:"mode,omitempty"`
}
Options is the authorization configuration shared by Radius services.
func (Options) EffectiveMode ¶
EffectiveMode returns the configured mode, or ModeOff when it is unset.
Source Files