authz

Documentation

Index

• func NewAuthorizer(client authorizationclient.SubjectAccessReviewInterface, ...) (authorizer.Authorizer, error)
• func PrepareAttributes(ctx context.Context, u user.Info, attributes gqlschema.ResourceAttributes, ...) (authorizer.Attributes, error)
• type Authorizer
• type RBACDirective
  • func NewRBACDirective(a authorizer.Authorizer, client discovery.DiscoveryInterface) RBACDirective
• type SARCacheConfig

Functions

func NewAuthorizer

func NewAuthorizer(client authorizationclient.SubjectAccessReviewInterface, cacheConfig SARCacheConfig) (authorizer.Authorizer, error)

func PrepareAttributes

func PrepareAttributes(ctx context.Context, u user.Info, attributes gqlschema.ResourceAttributes, obj interface{}, client discovery.DiscoveryInterface) (authorizer.Attributes, error)

PrepareAttributes prepares attributes for authorization

Types

type Authorizer

type Authorizer struct {
	// authorizer determines whether a given authorization.Attributes is allowed
	authorizer.Authorizer
}

type RBACDirective

type RBACDirective func(ctx context.Context, obj interface{}, next graphql.Resolver, attributes gqlschema.ResourceAttributes) (res interface{}, err error)

func NewRBACDirective

func NewRBACDirective(a authorizer.Authorizer, client discovery.DiscoveryInterface) RBACDirective

type SARCacheConfig

type SARCacheConfig struct {
	AllowCacheTTL time.Duration `envconfig:"default=5m"`
	DenyCacheTTL  time.Duration `envconfig:"default=30s"`
}