controlplane

Documentation

Index

• func CompilePolicy(policyMessage *policylangv1.Policy, policyName string, ...) (*circuitfactory.Circuit, error)
• func HashStoredPolicy(policyJSON []byte) string
• func Module() fx.Option
• func ValidateAndCompileProto(ctx context.Context, name string, policy *policylangv1.Policy) (*circuitfactory.Circuit, *policylangv1.Policy, error)
• func ValidateAndCompileYAML(ctx context.Context, name string, yamlSrc []byte) (*circuitfactory.Circuit, *policylangv1.Policy, error)
• type FxIn
• type FxOut
  • func ProvidePolicyValidator(in FxIn) (FxOut, error)
• type Policy
  • func (policy *Policy) GetEvaluationInterval() time.Duration
  • func (policy *Policy) GetStatusRegistry() status.Registry
  • func (policy *Policy) TicksInDuration(duration time.Duration) int
  • func (policy *Policy) TicksInDurationPb(duration *durationpb.Duration) int
• type PolicyFactory
  • func (factory *PolicyFactory) GetPolicyWrapper(name string) *policysyncv1.PolicyWrapper
  • func (factory *PolicyFactory) GetPolicyWrappers() map[string]*policysyncv1.PolicyWrapper
• type PolicyService
  • func RegisterPolicyService(in RegisterPolicyServiceIn) *PolicyService
  • func (s *PolicyService) DeleteDynamicConfig(ctx context.Context, req *policylangv1.DeleteDynamicConfigRequest) (*emptypb.Empty, error)
  • func (s *PolicyService) DeletePolicy(ctx context.Context, policy *policylangv1.DeletePolicyRequest) (*emptypb.Empty, error)
  • func (s *PolicyService) GetDecisions(ctx context.Context, req *policylangv1.GetDecisionsRequest) (*policylangv1.GetDecisionsResponse, error)
  • func (s *PolicyService) GetDynamicConfig(ctx context.Context, req *policylangv1.GetDynamicConfigRequest) (*policylangv1.GetDynamicConfigResponse, error)
  • func (s *PolicyService) GetPolicies(ctx context.Context, _ *emptypb.Empty) (*policylangv1.GetPoliciesResponse, error)
  • func (s *PolicyService) GetPolicy(ctx context.Context, request *policylangv1.GetPolicyRequest) (*policylangv1.GetPolicyResponse, error)
  • func (s *PolicyService) PostDynamicConfig(ctx context.Context, req *policylangv1.PostDynamicConfigRequest) (*emptypb.Empty, error)
  • func (s *PolicyService) UpsertPolicy(ctx context.Context, req *policylangv1.UpsertPolicyRequest) (*policylangv1.UpsertPolicyResponse, error)
• type PolicySpecValidator
  • func (v *PolicySpecValidator) ValidateSpec(ctx context.Context, name string, yamlSrc []byte) (bool, string, error)
• type RegisterPolicyServiceIn

Functions

func CompilePolicy

func CompilePolicy(policyMessage *policylangv1.Policy, policyName string, registry status.Registry) (*circuitfactory.Circuit, error)

CompilePolicy takes policyMessage and returns a compiled policy. This is a helper method for standalone consumption of policy compiler.

func HashStoredPolicy

func HashStoredPolicy(policyJSON []byte) string

HashStoredPolicy returns sha256 of JSON-serialized policy, truncated to 128 bits.

As the JSON repr of policy is not perfectly stable (it depends whether we've applied defaults yet or not, and could change when adding new fields), we should hash policies which are stored somewhere (e.g. in etcd).

func Module

func Module() fx.Option

Module - Controller can be initialized by passing options from Module() to fx app.

func ValidateAndCompileProto

func ValidateAndCompileProto(ctx context.Context, name string, policy *policylangv1.Policy) (*circuitfactory.Circuit, *policylangv1.Policy, error)

ValidateAndCompileProto checks the validity of a single Policy and compiles it.

func ValidateAndCompileYAML

func ValidateAndCompileYAML(ctx context.Context, name string, yamlSrc []byte) (*circuitfactory.Circuit, *policylangv1.Policy, error)

ValidateAndCompileYAML checks the validity of a single Policy and compiles it.

Types

type FxIn

type FxIn struct {
	fx.In
	Unmarshaller config.Unmarshaller
}

FxIn is the input for the AddAgentInfoAttribute function.

type FxOut

type FxOut struct {
	fx.Out
	Validator policyvalidator.PolicySpecValidator `group:"policy-validators"`
}

FxOut is the output of the controlplane module.

func ProvidePolicyValidator

func ProvidePolicyValidator(in FxIn) (FxOut, error)

ProvidePolicyValidator provides classification Policy Custom Resource validator

Note: This validator must be registered to be accessible.

type Policy

type Policy struct {
	iface.PolicyBase
	// contains filtered or unexported fields
}

Policy invokes the Circuit runtime at tick frequency.

func (*Policy) GetEvaluationInterval

func (policy *Policy) GetEvaluationInterval() time.Duration

GetEvaluationInterval returns the ID of the policy.

func (*Policy) GetStatusRegistry

func (policy *Policy) GetStatusRegistry() status.Registry

GetStatusRegistry returns the status registry of the policy.

func (*Policy) TicksInDuration

func (policy *Policy) TicksInDuration(duration time.Duration) int

TicksInDuration returns the number of ticks in duration.

func (*Policy) TicksInDurationPb

func (policy *Policy) TicksInDurationPb(duration *durationpb.Duration) int

TicksInDurationPb returns the number of ticks in duration pb. If duration pb is nil, it returns 1.

type PolicyFactory

type PolicyFactory struct {
	// contains filtered or unexported fields
}

PolicyFactory factory for policies.

func (*PolicyFactory) GetPolicyWrapper

func (factory *PolicyFactory) GetPolicyWrapper(name string) *policysyncv1.PolicyWrapper

GetPolicyWrapper returns policy wrapper matching given name.

func (*PolicyFactory) GetPolicyWrappers

func (factory *PolicyFactory) GetPolicyWrappers() map[string]*policysyncv1.PolicyWrapper

GetPolicyWrappers returns all policy wrappers.

type PolicyService

type PolicyService struct {
	policylangv1.UnimplementedPolicyServiceServer
	// contains filtered or unexported fields
}

PolicyService is the implementation of policylangv1.PolicyService interface.

func RegisterPolicyService

func RegisterPolicyService(in RegisterPolicyServiceIn) *PolicyService

RegisterPolicyService registers a service for policy.

func (*PolicyService) DeleteDynamicConfig

func (s *PolicyService) DeleteDynamicConfig(ctx context.Context, req *policylangv1.DeleteDynamicConfigRequest) (*emptypb.Empty, error)

DeleteDynamicConfig deletes dynamic config of a policy.

func (*PolicyService) DeletePolicy

func (s *PolicyService) DeletePolicy(ctx context.Context, policy *policylangv1.DeletePolicyRequest) (*emptypb.Empty, error)

DeletePolicy deletes a policy from the system.

func (*PolicyService) GetDecisions

func (s *PolicyService) GetDecisions(ctx context.Context, req *policylangv1.GetDecisionsRequest) (*policylangv1.GetDecisionsResponse, error)

GetDecisions returns the decisions.

func (*PolicyService) GetDynamicConfig

func (s *PolicyService) GetDynamicConfig(ctx context.Context, req *policylangv1.GetDynamicConfigRequest) (*policylangv1.GetDynamicConfigResponse, error)

GetDynamicConfig gets dynamic config of a policy.

func (*PolicyService) GetPolicies

func (s *PolicyService) GetPolicies(ctx context.Context, _ *emptypb.Empty) (*policylangv1.GetPoliciesResponse, error)

GetPolicies returns all the policies running (or supposed to be running) in the system.

func (*PolicyService) GetPolicy

func (s *PolicyService) GetPolicy(ctx context.Context, request *policylangv1.GetPolicyRequest) (*policylangv1.GetPolicyResponse, error)

GetPolicy returns the policy which matches the given name.

Returns error if policy cannot be found in *neither* etcd nor locally.

func (*PolicyService) PostDynamicConfig

func (s *PolicyService) PostDynamicConfig(ctx context.Context, req *policylangv1.PostDynamicConfigRequest) (*emptypb.Empty, error)

PostDynamicConfig updates dynamic config to the system.

func (*PolicyService) UpsertPolicy

func (s *PolicyService) UpsertPolicy(ctx context.Context, req *policylangv1.UpsertPolicyRequest) (*policylangv1.UpsertPolicyResponse, error)

UpsertPolicy creates/updates policy to the system.

type PolicySpecValidator

type PolicySpecValidator struct{}

PolicySpecValidator Policy implementation of PolicySpecValidator interface.

func (*PolicySpecValidator) ValidateSpec

func (v *PolicySpecValidator) ValidateSpec(ctx context.Context, name string, yamlSrc []byte) (bool, string, error)

ValidateSpec checks the validity of a Policy spec

returns: * true, "", nil when Policy is valid * false, message, nil when Policy is invalid and * false, "", err on other errors.

ValidateSpec checks the syntax, validity of extractors, and validity of rego modules (by attempting to compile them).

type RegisterPolicyServiceIn

type RegisterPolicyServiceIn struct {
	fx.In
	Server        *grpc.Server `name:"default"`
	PolicyFactory *PolicyFactory
	ETCDClient    *etcdclient.Client
	Lifecycle     fx.Lifecycle
}

RegisterPolicyServiceIn bundles and annotates parameters.