rbac

Documentation

Index

• Constants
• type ClaimsEnforcerFunc
• type Enforcer
  • func NewEnforcer(clientset kubernetes.Interface, namespace, configmap string, ...) *Enforcer
  • func (e *Enforcer) Enforce(rvals ...interface{}) bool
  • func (e *Enforcer) EnforceClaims(rvals ...interface{}) bool
  • func (e *Enforcer) EnforceCustomPolicy(policy string, rvals ...interface{}) bool
  • func (e *Enforcer) RunPolicyLoader(ctx context.Context) error
  • func (e *Enforcer) SetBuiltinPolicy(policy string) error
  • func (e *Enforcer) SetClaimsEnforcerFunc(claimsEnforcer ClaimsEnforcerFunc)
  • func (e *Enforcer) SetDefaultRole(roleName string)
  • func (e *Enforcer) SetUserPolicy(policy string) error

Constants

const (
	ConfigMapPolicyCSVKey     = "policy.csv"
	ConfigMapPolicyDefaultKey = "policy.default"
)

Types

type ClaimsEnforcerFunc

type ClaimsEnforcerFunc func(rvals ...interface{}) bool

ClaimsEnforcerFunc is func template

type Enforcer

type Enforcer struct {
	*casbin.Enforcer
	// contains filtered or unexported fields
}

func NewEnforcer

func NewEnforcer(clientset kubernetes.Interface, namespace, configmap string, claimsEnforcer ClaimsEnforcerFunc) *Enforcer

func (*Enforcer) Enforce

func (e *Enforcer) Enforce(rvals ...interface{}) bool

Enforce is a wrapper around casbin.Enforce to additionally enforce a default role

func (*Enforcer) EnforceClaims

func (e *Enforcer) EnforceClaims(rvals ...interface{}) bool

EnforceClaims checks if the first value is a jwt.Claims and runs enforce against its groups and sub

func (*Enforcer) EnforceCustomPolicy

func (e *Enforcer) EnforceCustomPolicy(policy string, rvals ...interface{}) bool

EnforceCustomPolicy enforce a custom policy with the buildin and user defined policies in case of explicit deny of that resource

func (*Enforcer) RunPolicyLoader

func (e *Enforcer) RunPolicyLoader(ctx context.Context) error

RunPolicyLoader runs the policy loader which watches policy updates from the configmap and reloads them

func (*Enforcer) SetBuiltinPolicy

func (e *Enforcer) SetBuiltinPolicy(policy string) error

SetBuiltinPolicy sets a built-in policy, which augments any user defined policies

func (*Enforcer) SetClaimsEnforcerFunc

func (e *Enforcer) SetClaimsEnforcerFunc(claimsEnforcer ClaimsEnforcerFunc)

SetClaimsEnforcerFunc sets a claims enforce function during enforcement. The claims enforce function can extract claims from JWT token and do the proper enforcement based on user, group or any information available in the input parameter list

func (*Enforcer) SetDefaultRole

func (e *Enforcer) SetDefaultRole(roleName string)

SetDefaultRole sets a default role to use during enforcement. Will fall back to this role if normal enforcement fails

func (*Enforcer) SetUserPolicy

func (e *Enforcer) SetUserPolicy(policy string) error

SetUserPolicy sets a user policy, augmenting the built-in policy