connectivitypdp

Documentation

Index

• Constants
• func WorkloadSetOrSelectorListMatches(wsl *v1alpha1.WorkloadSetOrSelectorList, workloadAttrs WorkloadAttrs) (bool, error)
• type AccessPolicy
  • func PolicyFromCR(vap *v1alpha1.AccessPolicy) *AccessPolicy
  • func PolicyFromPrivilegedCR(vap *v1alpha1.PrivilegedAccessPolicy) *AccessPolicy
• type ConnectionRequest
• type ConnectionResponse
• type Decision
• type DestinationDecision
• type Direction
• type PDP
  • func NewPDP() *PDP
  • func (pdp *PDP) AddOrUpdatePolicy(policy *AccessPolicy) error
  • func (pdp *PDP) Decide(src WorkloadAttrs, dests []WorkloadAttrs, ns string) ([]DestinationDecision, error)
  • func (pdp *PDP) DeletePolicy(policyName types.NamespacedName, privileged bool) error
  • func (pdp *PDP) GetPolicies() []v1alpha1.AccessPolicy
  • func (pdp *PDP) GetPrivilegedPolicies() []v1alpha1.PrivilegedAccessPolicy
• type WorkloadAttrs

Constants

const DefaultDenyPolicyName = "<default deny>"

Functions

func WorkloadSetOrSelectorListMatches

func WorkloadSetOrSelectorListMatches(wsl *v1alpha1.WorkloadSetOrSelectorList, workloadAttrs WorkloadAttrs) (bool, error)

checks whether a workload with the given labels matches any item in a slice of WorkloadSetOrSelectors.

Types

type AccessPolicy

type AccessPolicy struct {
	// contains filtered or unexported fields
}

AccessPolicy is an opaque, PDP-internal, generalized representation of AccessPolicy and PrivilegedAccessPolicy CRDs.

func PolicyFromCR

func PolicyFromCR(vap *v1alpha1.AccessPolicy) *AccessPolicy

PolicyFromCR converts the AccessPolicy Custom Resource into the PDP's AccessPolicy.

func PolicyFromPrivilegedCR

func PolicyFromPrivilegedCR(vap *v1alpha1.PrivilegedAccessPolicy) *AccessPolicy

PolicyFromPrivilegedCR converts the PrivilegedAccessPolicy Custom Resource into the PDP's AccessPolicy.

type ConnectionRequest

type ConnectionRequest struct {
	SrcWorkloadAttrs WorkloadAttrs
	DstSvcName       string
	DstSvcNamespace  string

	Direction Direction
}

ConnectionRequest encapsulates all the information needed to decide on a given incoming/outgoing connection.

type ConnectionResponse

type ConnectionResponse struct {
	Action       v1alpha1.AccessPolicyAction
	DstPeer      string
	DstName      string
	DstNamespace string
}

ConnectionResponse encapsulates the returned decision on a given incoming incoming/outgoing connection.

type Decision

type Decision int

Decision represents an AccessPolicy decision on a given connection.

const (
	DecisionUndecided Decision = iota
	DecisionAllow
	DecisionDeny
)

type DestinationDecision

type DestinationDecision struct {
	Destination     WorkloadAttrs
	Decision        Decision
	MatchedBy       string // The name of the policy that matched the connection and took the decision
	PrivilegedMatch bool   // Whether the policy that took the decision was privileged
}

DestinationDecision describes the PDP decision on a given destination (w.r.t, to a given source), including the deciding policy, if any. Calling PDP.Decide() with a source workload and a slice of destinations workloads, returns a slice of corresponding DestinationDecisions.

type Direction

type Direction int

Direction indicates whether a given request is for an incoming or an outgoing connection.

const (
	Incoming Direction = iota
	Outgoing
)

type PDP

type PDP struct {
	// contains filtered or unexported fields
}

PDP is the main object to maintain a set of access policies and decide whether a given connection is allowed or denied by these policies.

func NewPDP

func NewPDP() *PDP

NewPDP constructs a new PDP.

func (*PDP) AddOrUpdatePolicy

func (pdp *PDP) AddOrUpdatePolicy(policy *AccessPolicy) error

AddOrUpdatePolicy adds an AccessPolicy to the PDP. If a policy with the same name already exists in the PDP, it is updated (including updating the Action field). Invalid policies return an error.

func (*PDP) Decide

func (pdp *PDP) Decide(src WorkloadAttrs, dests []WorkloadAttrs, ns string) ([]DestinationDecision, error)

Decide makes allow/deny decisions for the queried connections between src and each of destinations in dests. The decision, as well as the deciding policy, are recorded in the returned slice of DestinationDecision structs. The order of destinations in dests is preserved in the returned slice.

func (*PDP) DeletePolicy

func (pdp *PDP) DeletePolicy(policyName types.NamespacedName, privileged bool) error

DeletePolicy deletes an AccessPolicy with the given name and privilege from the PDP. If no such AccessPolicy exists in the PDP, an error is returned.

func (*PDP) GetPolicies

func (pdp *PDP) GetPolicies() []v1alpha1.AccessPolicy

Returns a slice of copies of the non-privileged policies stored in the PDP.

func (*PDP) GetPrivilegedPolicies

func (pdp *PDP) GetPrivilegedPolicies() []v1alpha1.PrivilegedAccessPolicy

Returns a slice of copies of the non-privileged policies stored in the PDP.

type WorkloadAttrs

type WorkloadAttrs map[string]string

WorkloadAttrs are the actual key-value attributes attached to any given workload.