Documentation
¶
Index ¶
- Constants
- func Init(conf rbacconf.Config, policyPath string, authNconf config.Authentication, ...) (*casbin.SyncedCachedEnforcer, error)
- func ReferencedNamespaces(blob []byte, staticAPIKeyUsers []string) ([]string, error)
- func RequireReferencedNamespacesExist(blob []byte, staticAPIKeyUsers []string, ns usecasesNamespaces.Exister) error
- func StaticAPIKeyUsers(conf config.Authentication) []string
- func ValidateNamespaceStrip(blob []byte, staticAPIKeyUsers []string) error
- func ValidateSnapshot(blob []byte, stripNamespaces bool, staticAPIKeyUsers []string) error
- type Manager
- func (m *Manager) AddRolesForUser(user string, roles []string) error
- func (m *Manager) Authorize(ctx context.Context, principal *models.Principal, verb string, ...) error
- func (m *Manager) AuthorizeSilent(ctx context.Context, principal *models.Principal, verb string, ...) error
- func (m *Manager) CountNamespaceLocalRBAC(namespace string) (int, error)
- func (m *Manager) CreateRolesPermissions(roles map[string][]authorization.Policy) error
- func (m *Manager) DeleteRoles(roles ...string) error
- func (m *Manager) FilterAuthorizedResources(ctx context.Context, principal *models.Principal, verb string, ...) ([]string, error)
- func (m *Manager) GetRoles(names ...string) (map[string][]authorization.Policy, error)
- func (m *Manager) GetRolesForUserOrGroup(userName string, authType authentication.AuthType, isGroup bool) (map[string][]authorization.Policy, error)
- func (m *Manager) GetUsersOrGroupForRole(roleName string, authType authentication.AuthType, isGroup bool) ([]string, error)
- func (m *Manager) GetUsersOrGroupsWithRoles(isGroup bool, authType authentication.AuthType) ([]string, error)
- func (m *Manager) HasPermission(roleName string, permission *authorization.Policy) (bool, error)
- func (m *Manager) ListAllRoles() ([]string, error)
- func (m *Manager) ListGroupingSubjects() ([]string, error)
- func (m *Manager) NamespaceLocalRBAC(namespace string) (roles []string, subjects []NamespaceSubject, err error)
- func (m *Manager) RemovePermissions(roleName string, permissions []*authorization.Policy) error
- func (m *Manager) Restore(b []byte, stripNamespaces bool) error
- func (m *Manager) RevokeRolesForUser(userName string, roles ...string) error
- func (m *Manager) Snapshot(roles ...string) ([]byte, error)
- func (m *Manager) UpdateRolesPermissions(roles map[string][]authorization.Policy) error
- type NamespaceLister
- type NamespaceSubject
Constants ¶
const ( SnapshotVersionV0 = iota SnapshotVersionLatest )
const AuditLogVersion = 2
const DEFAULT_POLICY_VERSION = "1.29.0"
const ( // MODEL is the used model for casbin to store roles, permissions, users and comparisons patterns. // docs: https://casbin.org/docs/syntax-for-models MODEL = `` /* 281-byte string literal not displayed */ )
Variables ¶
This section is empty.
Functions ¶
func Init ¶
func Init(conf rbacconf.Config, policyPath string, authNconf config.Authentication, namespacesEnabled bool) (*casbin.SyncedCachedEnforcer, error)
func ReferencedNamespaces ¶ added in v1.38.12
ReferencedNamespaces returns every namespace the snapshot names. Two sources feed it. The first is the snapshot's own Namespaces list. The source cluster writes that list, because only the source can tell a namespace prefix from a colon inside a global id such as the OIDC subject "urn:foo". The list covers role names, resource paths, and OIDC subjects, but not db subjects (see referencedNamespaces). The second source is the "db:" user subjects, read here: a dynamic user name cannot contain a colon, so a colon in one always marks a namespace. The restoring cluster's static API key users are the one exception to that rule. A blob from before the list existed is checked on its db subjects only; namespaced backups that predate the list are unsupported.
func RequireReferencedNamespacesExist ¶ added in v1.38.12
func RequireReferencedNamespacesExist(blob []byte, staticAPIKeyUsers []string, ns usecasesNamespaces.Exister) error
RequireReferencedNamespacesExist returns an error when any namespace the snapshot names is missing or deleting on this cluster. See ReferencedNamespaces for which names the snapshot carries and usecasesNamespaces.RequireAllExisting for which states pass.
func StaticAPIKeyUsers ¶ added in v1.38.10
func StaticAPIKeyUsers(conf config.Authentication) []string
StaticAPIKeyUsers returns the static API key user names the namespace strip must treat as global identities, which is none at all while API keys are turned off. A configuration file can populate the list and disable API keys at once, and on that path the names are never checked for format, so a disabled list may hold anything. Every other reader of the list gates on the same flag, and the strip has to agree with them or it would keep a row whole for a principal the cluster will never authenticate.
func ValidateNamespaceStrip ¶ added in v1.38.10
ValidateNamespaceStrip runs the strip path of Manager.Restore against blob without changing state, returning the collision error a real strip would hit. staticAPIKeyUsers is the restoring cluster's configured list.
func ValidateSnapshot ¶ added in v1.38.12
ValidateSnapshot runs the checks Manager.Restore makes before it clears the policy store, without clearing it: the decode, plus the strip when stripNamespaces is set. Restore has no version check of its own, so with the strip off only the decode runs.
Types ¶
type Manager ¶ added in v1.30.9
type Manager struct {
// contains filtered or unexported fields
}
func New ¶
func New(rbacStoragePath string, rbacConf rbacconf.Config, authNconf config.Authentication, namespacesEnabled bool, namespaces NamespaceLister, logger logrus.FieldLogger) (*Manager, error)
func (*Manager) AddRolesForUser ¶ added in v1.30.9
AddRolesFroUser NOTE: user has to be prefixed by user:, group:, key: etc. see func PrefixUserName(user) it will prefix username and nop-op if already prefixed
func (*Manager) Authorize ¶ added in v1.30.9
func (m *Manager) Authorize(ctx context.Context, principal *models.Principal, verb string, resources ...string) error
Authorize verify if the user has access to a resource to do specific action
func (*Manager) AuthorizeSilent ¶ added in v1.30.9
func (m *Manager) AuthorizeSilent(ctx context.Context, principal *models.Principal, verb string, resources ...string) error
AuthorizeSilent verify if the user has access to a resource to do specific action without audit logs to be used internally
func (*Manager) CountNamespaceLocalRBAC ¶ added in v1.38.3
CountNamespaceLocalRBAC returns the number of namespace-local roles plus direct-principal assignments in the namespace. Removal of a namespace entity is blocked while this is non-zero.
func (*Manager) CreateRolesPermissions ¶ added in v1.30.9
func (m *Manager) CreateRolesPermissions(roles map[string][]authorization.Policy) error
func (*Manager) DeleteRoles ¶ added in v1.30.9
func (*Manager) FilterAuthorizedResources ¶ added in v1.30.9
func (m *Manager) FilterAuthorizedResources(ctx context.Context, principal *models.Principal, verb string, resources ...string) ([]string, error)
FilterAuthorizedResources authorize the passed resources with best effort approach, it will return list of allowed resources, if none, it will return an empty slice
func (*Manager) GetRolesForUserOrGroup ¶ added in v1.32.5
func (m *Manager) GetRolesForUserOrGroup(userName string, authType authentication.AuthType, isGroup bool) (map[string][]authorization.Policy, error)
func (*Manager) GetUsersOrGroupForRole ¶ added in v1.32.5
func (*Manager) GetUsersOrGroupsWithRoles ¶ added in v1.32.5
func (*Manager) HasPermission ¶ added in v1.30.9
func (*Manager) ListAllRoles ¶ added in v1.38.10
ListAllRoles returns every role name known to the store, custom and built-in. includeRoles selectors are matched against this list.
func (*Manager) ListGroupingSubjects ¶ added in v1.38.3
ListGroupingSubjects returns the subject key of every role-assignment row (each a `<prefix>:<user>` or `<prefix>:<group>` string).
func (*Manager) NamespaceLocalRBAC ¶ added in v1.38.3
func (m *Manager) NamespaceLocalRBAC(namespace string) (roles []string, subjects []NamespaceSubject, err error)
NamespaceLocalRBAC returns the namespace-local role names and the distinct direct (db/oidc) principals whose role assignments belong to namespace. It is the single source of "what RBAC belongs to a namespace": the removal-block gate counts this set and the delete cascade revokes/deletes exactly it, so the two stay consistent by construction. Group assignments are global and so are excluded — a namespace-named group can't block its namespace's removal.
func (*Manager) RemovePermissions ¶ added in v1.30.9
func (m *Manager) RemovePermissions(roleName string, permissions []*authorization.Policy) error
func (*Manager) RevokeRolesForUser ¶ added in v1.30.9
func (*Manager) Snapshot ¶ added in v1.30.9
Snapshot serialises the RBAC state for RAFT snapshots and backups. Called with no roles it captures the whole store. Called with roles it keeps only those roles' rows: `p` rows are matched on p[0] and `g` rows on g[1], both of which hold the role name, so the assignments and the db:wv_internal_empty placeholder come along too. A selection also carries the admin and viewer grants held by the principals it covers, for the reason given on apiManagedBuiltInGroupings.
func (*Manager) UpdateRolesPermissions ¶ added in v1.30.9
func (m *Manager) UpdateRolesPermissions(roles map[string][]authorization.Policy) error
there is no different between UpdateRolesPermissions and CreateRolesPermissions, purely to satisfy an interface
type NamespaceLister ¶ added in v1.38.10
NamespaceLister reports the namespaces this cluster currently has. Snapshot calls it when it runs rather than at construction, so a snapshot taken later sees namespaces created since boot.
type NamespaceSubject ¶ added in v1.38.3
type NamespaceSubject struct {
ID string
AuthType authentication.AuthType
}
NamespaceSubject is a direct (db/oidc) principal holding at least one role assignment bound to a namespace. ID is the user id without the auth-type prefix, e.g. "customer1:bob".
Source Files
Directories