rbac

Documentation

Index

• Constants
• type ClaimsEnforcerFunc
• type Enforcer
  • func NewEnforcer(clientset kubernetes.Interface, namespace, configmap string, ...) *Enforcer
  • func (e *Enforcer) Enforce(rvals ...interface{}) bool
  • func (e *Enforcer) EnforceClaims(rvals ...interface{}) bool
  • func (e *Enforcer) RunPolicyLoader(ctx context.Context) error
  • func (e *Enforcer) SetBuiltinPolicy(policy string) error
  • func (e *Enforcer) SetClaimsEnforcerFunc(claimsEnforcer ClaimsEnforcerFunc)
  • func (e *Enforcer) SetDefaultRole(roleName string)
  • func (e *Enforcer) SetUserPolicy(policy string) error

Constants

const (
	ConfigMapPolicyCSVKey     = "policy.csv"
	ConfigMapPolicyDefaultKey = "policy.default"
)

Types

type ClaimsEnforcerFunc

type ClaimsEnforcerFunc func(rvals ...interface{}) bool

ClaimsEnforcerFunc is func template

type Enforcer

type Enforcer struct {
	*casbin.Enforcer
	// contains filtered or unexported fields
}

func NewEnforcer

func NewEnforcer(clientset kubernetes.Interface, namespace, configmap string, claimsEnforcer ClaimsEnforcerFunc) *Enforcer

func (*Enforcer) Enforce

func (e *Enforcer) Enforce(rvals ...interface{}) bool

Enforce is a wrapper around casbin.Enforce to additionally enforce a default role

func (*Enforcer) EnforceClaims

func (e *Enforcer) EnforceClaims(rvals ...interface{}) bool

EnforceClaims checks if the first value is a jwt.Claims and runs enforce against its groups and sub

func (*Enforcer) RunPolicyLoader

func (e *Enforcer) RunPolicyLoader(ctx context.Context) error

RunPolicyLoader runs the policy loader which watches policy updates from the configmap and reloads them

func (*Enforcer) SetBuiltinPolicy

func (e *Enforcer) SetBuiltinPolicy(policy string) error

SetBuiltinPolicy sets a built-in policy, which augments any user defined policies

func (*Enforcer) SetClaimsEnforcerFunc

func (e *Enforcer) SetClaimsEnforcerFunc(claimsEnforcer ClaimsEnforcerFunc)

SetClaimsEnforcerFunc sets a claims enforce function during enforcement. The claims enforce function can extract claims from JWT token and do the proper enforcement based on user, group or any information available in the input parameter list

func (*Enforcer) SetDefaultRole

func (e *Enforcer) SetDefaultRole(roleName string)

SetDefaultRole sets a default role to use during enforcement. Will fall back to this role if normal enforcement fails

func (*Enforcer) SetUserPolicy

func (e *Enforcer) SetUserPolicy(policy string) error

SetUserPolicy sets a user policy, augmenting the built-in policy