engine

Documentation

Index

• Constants
• Variables
• func ResidualExpr(a *cel.Ast, details *cel.EvalDetails) *exprpb.Expr
• type CheckOpt
  • func WithTraceSink(tracerSink tracer.Sink) CheckOpt
  • func WithZapTraceSink(log *zap.Logger) CheckOpt
• type Components
• type Conf
  • func GetConf() (*Conf, error)
  • func (c *Conf) Key() string
  • func (c *Conf) SetDefaults()
  • func (c *Conf) Validate() error
• type EffectInfo
• type Engine
  • func New(ctx context.Context, components Components) (*Engine, error)
  • func NewEphemeral(compileMgr *compile.Manager, schemaMgr schema.Manager) (*Engine, error)
  • func NewFromConf(ctx context.Context, conf *Conf, components Components) *Engine
  • func (engine *Engine) Check(ctx context.Context, inputs []*enginev1.CheckInput, opts ...CheckOpt) ([]*enginev1.CheckOutput, error)
  • func (engine *Engine) PlanResources(ctx context.Context, input *enginev1.PlanResourcesInput) (*enginev1.PlanResourcesOutput, error)
• type Evaluator
  • func NewEvaluator(rps *runtimev1.RunnablePolicySet, schemaMgr schema.Manager) Evaluator
• type PolicyEvalResult
• type PolicyPlanResult
  • func (p *PolicyPlanResult) Add(filter *qpN, effect effectv1.Effect)
  • func (p *PolicyPlanResult) Empty() bool
  • func (p *PolicyPlanResult) ToPlanResourcesOutput(input *enginev1.PlanResourcesInput) (*enginev1.PlanResourcesOutput, error)

Constants

const (
	Or                 = "or"
	And                = "and"
	Not                = "not"
	Equals             = "eq"
	NotEquals          = "ne"
	GreaterThan        = "gt"
	GreaterThanOrEqual = "ge"
	LessThan           = "lt"
	LessThanOrEqual    = "le"
	In                 = "in"
	List               = "list"
	Struct             = "struct"
	Add                = "add"
	Sub                = "sub"
	Mult               = "mult"
	Div                = "div"
	Mod                = "mod"
	SetField           = "set-field"
	GetField           = "get-field"
	Index              = "index"
	All                = "all"
	Filter             = "filter"
	Exists             = "exists"
	ExistsOne          = "exists_one"
	Map                = "map"
	Lambda             = "lambda"
)

Variables

var ErrPolicyNotExecutable = errors.New("policy not executable")

var ErrUnknownOperator = errors.New("unknown operator")

Functions

func ResidualExpr

func ResidualExpr(a *cel.Ast, details *cel.EvalDetails) *exprpb.Expr

ResidualExpr evaluates `residual expression` of the partial evaluation. There are two approaches for this: 1. ast := env.ResidualAst(); ast.Expr() 2. ResidualExpr() The former is the built-in approach, but unlike the latter doesn't support CEL comprehensions.

Types

type CheckOpt

type CheckOpt func(*checkOptions)

CheckOpt defines options for engine Check calls.

func WithTraceSink

func WithTraceSink(tracerSink tracer.Sink) CheckOpt

func WithZapTraceSink

func WithZapTraceSink(log *zap.Logger) CheckOpt

WithZapTraceSink sets an engine tracer with Zap set as the sink.

type Components

type Components struct {
	AuditLog   audit.Log
	CompileMgr *compile.Manager
	SchemaMgr  schema.Manager
}

type Conf

type Conf struct {
	// DefaultPolicyVersion defines what version to assume if the request does not specify one.
	DefaultPolicyVersion string `yaml:"defaultPolicyVersion" conf:",example=\"default\""`
	NumWorkers           uint   `yaml:"numWorkers" conf:",ignore"`
}

Conf is optional configuration for engine.

func GetConf

func GetConf() (*Conf, error)

func (*Conf) Key

func (c *Conf) Key() string

func (*Conf) SetDefaults

func (c *Conf) SetDefaults()

func (*Conf) Validate

func (c *Conf) Validate() error

type EffectInfo

type EffectInfo struct {
	Policy string
	Scope  string
	Effect effectv1.Effect
}

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, components Components) (*Engine, error)

func NewEphemeral

func NewEphemeral(compileMgr *compile.Manager, schemaMgr schema.Manager) (*Engine, error)

func NewFromConf

func NewFromConf(ctx context.Context, conf *Conf, components Components) *Engine

func (*Engine) Check

func (engine *Engine) Check(ctx context.Context, inputs []*enginev1.CheckInput, opts ...CheckOpt) ([]*enginev1.CheckOutput, error)

func (*Engine) PlanResources

func (engine *Engine) PlanResources(ctx context.Context, input *enginev1.PlanResourcesInput) (*enginev1.PlanResourcesOutput, error)

type Evaluator

type Evaluator interface {
	Evaluate(context.Context, tracer.Context, *enginev1.CheckInput) (*PolicyEvalResult, error)
	EvaluateResourcesQueryPlan(ctx context.Context, request *enginev1.PlanResourcesInput) (*PolicyPlanResult, error)
}

func NewEvaluator

func NewEvaluator(rps *runtimev1.RunnablePolicySet, schemaMgr schema.Manager) Evaluator

type PolicyEvalResult

type PolicyEvalResult struct {
	Effects               map[string]EffectInfo
	EffectiveDerivedRoles map[string]struct{}

	ValidationErrors []*schemav1.ValidationError
	// contains filtered or unexported fields
}

type PolicyPlanResult

type PolicyPlanResult struct {
	Scope            string
	AllowFilter      []*qpN
	DenyFilter       []*qpN
	ValidationErrors []*schemav1.ValidationError
}

func (*PolicyPlanResult) Add

func (p *PolicyPlanResult) Add(filter *qpN, effect effectv1.Effect)

func (*PolicyPlanResult) Empty

func (p *PolicyPlanResult) Empty() bool

func (*PolicyPlanResult) ToPlanResourcesOutput

func (p *PolicyPlanResult) ToPlanResourcesOutput(input *enginev1.PlanResourcesInput) (*enginev1.PlanResourcesOutput, error)