rbac

Documentation

Index

• Variables
• func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error
• func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error
• func FromContext(ctx context.Context) *openapi.Acl
• func NewContext(ctx context.Context, acl *openapi.Acl) context.Context
• type Options
  • func (o *Options) AddFlags(f *pflag.FlagSet)
• type RBAC
  • func New(client client.Client, namespace string, options *Options) *RBAC
  • func (r *RBAC) GetACL(ctx context.Context, organizationID string) (*openapi.Acl, error)
  • func (r *RBAC) GetActiveOrganizationUser(ctx context.Context, organizationID string, user *unikornv1.User) (*unikornv1.OrganizationUser, error)
  • func (r *RBAC) GetActiveUser(ctx context.Context, subject string) (*unikornv1.User, error)
  • func (r *RBAC) GetServiceAccount(ctx context.Context, id string) (*unikornv1.ServiceAccount, error)
  • func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

Variables

var (
	ErrResourceReference = errors.New("resource reference error")
)

Functions

func AllowGlobalScope

func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error

AllowGlobalScope tries to allow the requested operation at the global scope.

func AllowOrganizationScope

func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID string) error

AllowOrganizationScope tries to allow the requested operation at the global scope, then the organization scope.

func AllowProjectScope

func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID, projectID string) error

AllowProjectScope tries to allow the requested operation at the global scope, then the organization scope, and finally at the project scope.

func AllowRole

func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error

AllowRole determines whether your ACL contains the same or higher privileges than the role, which is then used to determine role visibility and limit privilege escalation.

func FromContext

func FromContext(ctx context.Context) *openapi.Acl

func NewContext

func NewContext(ctx context.Context, acl *openapi.Acl) context.Context

Types

type Options

type Options struct {
	PlatformAdministratorRoleID   string
	PlatformAdministratorSubjects []string
	SystemAccountRoleIDs          map[string]string
}

func (*Options) AddFlags

func (o *Options) AddFlags(f *pflag.FlagSet)

type RBAC

type RBAC struct {
	// contains filtered or unexported fields
}

RBAC contains all the scoping rules for services across the platform.

func New

func New(client client.Client, namespace string, options *Options) *RBAC

New creates a new RBAC client.

func (*RBAC) GetACL

func (r *RBAC) GetACL(ctx context.Context, organizationID string) (*openapi.Acl, error)

GetACL returns a granular set of permissions for a user based on their scope. This is used for API level access control and UX.

func (*RBAC) GetActiveOrganizationUser

func (r *RBAC) GetActiveOrganizationUser(ctx context.Context, organizationID string, user *unikornv1.User) (*unikornv1.OrganizationUser, error)

GetActiveOrganizationUser gets an organization user that references the actual user.

func (*RBAC) GetActiveUser

func (r *RBAC) GetActiveUser(ctx context.Context, subject string) (*unikornv1.User, error)

GetActiveUser returns a user that match the subject and is active.

func (*RBAC) GetServiceAccount

func (r *RBAC) GetServiceAccount(ctx context.Context, id string) (*unikornv1.ServiceAccount, error)

GetServiceAccount looks up a service account.

func (*RBAC) UserExists

func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

UserExists tells us whether the user is active in any organization.