rbacpolicy

Documentation

Index

• Constants
• Variables
• func GetProjectRoleFromSubject(subject string) (string, string, bool)
• func IsProjectSubject(subject string) bool
• type RBACPolicyEnforcer
  • func NewRBACPolicyEnforcer(enf *rbac.Enforcer, projLister applister.AppProjectNamespaceLister) *RBACPolicyEnforcer
  • func (p *RBACPolicyEnforcer) EnforceClaims(claims jwt.Claims, rvals ...interface{}) bool
  • func (p *RBACPolicyEnforcer) GetScopes() []string
  • func (p *RBACPolicyEnforcer) SetScopes(scopes []string)

Constants

const (
	// please add new items to Resources
	ResourceClusters          = "clusters"
	ResourceProjects          = "projects"
	ResourceApplications      = "applications"
	ResourceApplicationSets   = "applicationsets"
	ResourceRepositories      = "repositories"
	ResourceWriteRepositories = "write-repositories"
	ResourceCertificates      = "certificates"
	ResourceAccounts          = "accounts"
	ResourceGPGKeys           = "gpgkeys"
	ResourceLogs              = "logs"
	ResourceExec              = "exec"
	ResourceExtensions        = "extensions"

	// please add new items to Actions
	ActionGet      = "get"
	ActionCreate   = "create"
	ActionUpdate   = "update"
	ActionDelete   = "delete"
	ActionSync     = "sync"
	ActionOverride = "override"
	ActionAction   = "action"
	ActionInvoke   = "invoke"
)

Variables

var (
	Resources = []string{
		ResourceClusters,
		ResourceProjects,
		ResourceApplications,
		ResourceApplicationSets,
		ResourceRepositories,
		ResourceWriteRepositories,
		ResourceCertificates,
		ResourceAccounts,
		ResourceGPGKeys,
		ResourceLogs,
		ResourceExec,
		ResourceExtensions,
	}
	Actions = []string{
		ActionGet,
		ActionCreate,
		ActionUpdate,
		ActionDelete,
		ActionSync,
		ActionOverride,
		ActionAction,
		ActionInvoke,
	}
)

Functions

func GetProjectRoleFromSubject

func GetProjectRoleFromSubject(subject string) (string, string, bool)

func IsProjectSubject

func IsProjectSubject(subject string) bool

Types

type RBACPolicyEnforcer

type RBACPolicyEnforcer struct {
	// contains filtered or unexported fields
}

RBACPolicyEnforcer provides an RBAC Claims Enforcer which additionally consults AppProject roles, jwt tokens, and groups. It is backed by a AppProject informer/lister cache and does not make any API calls during enforcement.

func NewRBACPolicyEnforcer

func NewRBACPolicyEnforcer(enf *rbac.Enforcer, projLister applister.AppProjectNamespaceLister) *RBACPolicyEnforcer

NewRBACPolicyEnforcer returns a new RBAC Enforcer for the Argo CD API Server

func (*RBACPolicyEnforcer) EnforceClaims

func (p *RBACPolicyEnforcer) EnforceClaims(claims jwt.Claims, rvals ...interface{}) bool

EnforceClaims is an RBAC claims enforcer specific to the Argo CD API server

func (*RBACPolicyEnforcer) GetScopes

func (p *RBACPolicyEnforcer) GetScopes() []string

func (*RBACPolicyEnforcer) SetScopes

func (p *RBACPolicyEnforcer) SetScopes(scopes []string)