authorize

Documentation

Overview

Package authorize provides authz checks for incoming or returning connections.

Package authorize provides authz checks for incoming or returning connections.

Package authorize provides authorization checks for incoming or returning requests.

Package authorize provides authz checks for incoming or returning connections.

Index

• func NewNetworkServiceEndpointRegistryClient(opts ...Option) registry.NetworkServiceEndpointRegistryClient
• func NewNetworkServiceEndpointRegistryServer(opts ...Option) registry.NetworkServiceEndpointRegistryServer
• func NewNetworkServiceRegistryClient(opts ...Option) registry.NetworkServiceRegistryClient
• func NewNetworkServiceRegistryServer(opts ...Option) registry.NetworkServiceRegistryServer
• type Option
  • func Any() Option
  • func WithPolicies(policyPaths ...string) Option
  • func WithResourcePathIdsMap(m *genericsync.Map[string, []string]) Option
• type Policy
• type RegistryOpaInput

Functions

func NewNetworkServiceEndpointRegistryClient

func NewNetworkServiceEndpointRegistryClient(opts ...Option) registry.NetworkServiceEndpointRegistryClient

NewNetworkServiceEndpointRegistryClient - returns a new authorization registry.NetworkServiceEndpointRegistryClient Authorize registry client checks path of NSE.

func NewNetworkServiceEndpointRegistryServer

func NewNetworkServiceEndpointRegistryServer(opts ...Option) registry.NetworkServiceEndpointRegistryServer

NewNetworkServiceEndpointRegistryServer - returns a new authorization registry.NetworkServiceEndpointRegistryServer Authorize registry server checks spiffeID of NSE.

func NewNetworkServiceRegistryClient

func NewNetworkServiceRegistryClient(opts ...Option) registry.NetworkServiceRegistryClient

NewNetworkServiceRegistryClient - returns a new authorization registry.NetworkServiceRegistryClient Authorize registry client checks spiffeID of NS.

func NewNetworkServiceRegistryServer

func NewNetworkServiceRegistryServer(opts ...Option) registry.NetworkServiceRegistryServer

NewNetworkServiceRegistryServer - returns a new authorization registry.NetworkServiceRegistryServer Authorize registry server checks spiffeID of NS.

Types

type Option

type Option func(*options)

Option is authorization option for server

func Any

func Any() Option

Any authorizes any call of request/close

func WithPolicies

func WithPolicies(policyPaths ...string) Option

WithPolicies sets custom policies for registry. policyPaths can be combination of both policy files and dirs with policies

func WithResourcePathIdsMap

func WithResourcePathIdsMap(m *genericsync.Map[string, []string]) Option

WithResourcePathIdsMap sets map to keep resourcePathIdsMap to authorize connections with Registry Authorize Chain Element

type Policy

type Policy interface {
	// Name returns policy name
	Name() string
	// Check checks authorization
	Check(ctx context.Context, input interface{}) error
}

Policy represents authorization policy for network service.

type RegistryOpaInput

type RegistryOpaInput struct {
	ResourceID         string                      `json:"resource_id"`
	ResourceName       string                      `json:"resource_name"`
	ResourcePathIdsMap map[string][]string         `json:"resource_path_ids_map"`
	PathSegments       []*grpcmetadata.PathSegment `json:"path_segments"`
	Index              uint32                      `json:"index"`
}

RegistryOpaInput represents input for policies in authorizNSEServer and authorizeNSServer