rbac

Documentation

Overview

Package rbac provides RBAC middleware utilies for the Everest API server.

Index

• Constants
• func Can(ctx context.Context, filePath string, k *kubernetes.Kubernetes, req ...string) (bool, error)
• func GetUser(c echo.Context) (string, error)
• func IsEnabled(cm *corev1.ConfigMap) bool
• func NewEnforceHandler(l *zap.SugaredLogger, basePath string, enforcer *casbin.Enforcer) func(c echo.Context, user string) (bool, error)
• func NewEnforcer(ctx context.Context, kubeClient *kubernetes.Kubernetes, l *zap.SugaredLogger) (*casbin.Enforcer, error)
• func NewEnforcerFromFilePath(filePath string) (*casbin.Enforcer, error)
• func NewSkipper(basePath string) (func(echo.Context) bool, error)
• func ObjectName(args ...string) string
• func ValidatePolicy(ctx context.Context, k *kubernetes.Kubernetes, filepath string) error

Constants

const (
	ResourceBackupStorages             = "backup-storages"
	ResourceDatabaseClusters           = "database-clusters"
	ResourceDatabaseClusterBackups     = "database-cluster-backups"
	ResourceDatabaseClusterCredentials = "database-cluster-credentials"
	ResourceDatabaseClusterRestores    = "database-cluster-restores"
	ResourceDatabaseEngines            = "database-engines"
	ResourceMonitoringInstances        = "monitoring-instances"
	ResourceNamespaces                 = "namespaces"
)

Everest API resource names.

const (
	ActionCreate = "create"
	ActionRead   = "read"
	ActionUpdate = "update"
	ActionDelete = "delete"
)

RBAC actions.

Functions

func Can

func Can(ctx context.Context, filePath string, k *kubernetes.Kubernetes, req ...string) (bool, error)

Can checks if a user is allowed to perform an action on a resource. Input request should be of the form [user action resource object].

func GetUser

func GetUser(c echo.Context) (string, error)

GetUser extracts the user from the JWT token in the context.

func IsEnabled

func IsEnabled(cm *corev1.ConfigMap) bool

IsEnabled returns true if enabled == 'true' in the given ConfigMap.

func NewEnforceHandler

func NewEnforceHandler(l *zap.SugaredLogger, basePath string, enforcer *casbin.Enforcer) func(c echo.Context, user string) (bool, error)

NewEnforceHandler returns a function that checks if a user is allowed to access a resource.

func NewEnforcer

func NewEnforcer(ctx context.Context, kubeClient *kubernetes.Kubernetes, l *zap.SugaredLogger) (*casbin.Enforcer, error)

NewEnforcer creates a new Casbin enforcer with the RBAC model and ConfigMap adapter.

func NewEnforcerFromFilePath

func NewEnforcerFromFilePath(filePath string) (*casbin.Enforcer, error)

NewEnforcerFromFilePath creates a new Casbin enforcer with the policy stored at the given filePath.

func NewSkipper

func NewSkipper(basePath string) (func(echo.Context) bool, error)

NewSkipper returns a new function that checks if a given request should be skipped from RBAC checks.

func ObjectName

func ObjectName(args ...string) string

ObjectName returns the a string that represents the name of an object in RBAC format.

func ValidatePolicy

func ValidatePolicy(
	ctx context.Context,
	k *kubernetes.Kubernetes,
	filepath string,
) error

ValidatePolicy validates a policy from either Kubernetes or local file.