model

Documentation

Index

• Constants
• func MetadataListValueMatcherForJWTClaims(claims []string, value *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher
• func MetadataMatcherForJWTClaims(claims []string, value *matcherpb.StringMatcher) *matcherpb.MetadataMatcher
• func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher
• func MetadataValueMatcherForJWTClaim(claim string, m *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher
• type Model
  • func New(r *authzpb.Rule) (*Model, error)
  • func (m Model) Generate(forTCP bool, useAuthenticated bool, action rbacpb.RBAC_Action) (*rbacpb.Policy, error)
  • func (m *Model) MigrateTrustDomain(tdBundle trustdomain.Bundle)

Constants

const (
	RBACTCPFilterStatPrefix           = "tcp."
	RBACShadowEngineResult            = "shadow_engine_result"
	RBACShadowEffectivePolicyID       = "shadow_effective_policy_id"
	RBACShadowRulesAllowStatPrefix    = "istio_dry_run_allow_"
	RBACShadowRulesDenyStatPrefix     = "istio_dry_run_deny_"
	RBACExtAuthzShadowRulesStatPrefix = "istio_ext_authz_"
)

Functions

func MetadataListValueMatcherForJWTClaims

func MetadataListValueMatcherForJWTClaims(claims []string, value *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher

MetadataValueMatcherForJWTClaims for Envoy JWT

func MetadataMatcherForJWTClaims

func MetadataMatcherForJWTClaims(claims []string, value *matcherpb.StringMatcher) *matcherpb.MetadataMatcher

MetadataMatcherForJWTClaims is a convenient method for generating metadata matcher for JWT claims.

func MetadataStringMatcherForJWTClaim

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher

func MetadataValueMatcherForJWTClaim

func MetadataValueMatcherForJWTClaim(claim string, m *matcherpb.ValueMatcher) *matcherpb.MetadataMatcher

Types

type Model

type Model struct {
	// contains filtered or unexported fields
}

Model represents a single rule from an authorization policy. The conditions of the rule are consolidated into permission or principal to align with the Envoy RBAC filter API.

func New

func New(r *authzpb.Rule) (*Model, error)

New returns a model representing a single authorization policy.

func (Model) Generate

func (m Model) Generate(forTCP bool, useAuthenticated bool, action rbacpb.RBAC_Action) (*rbacpb.Policy, error)

Generate generates the Envoy RBAC config from the model.

func (*Model) MigrateTrustDomain

func (m *Model) MigrateTrustDomain(tdBundle trustdomain.Bundle)

MigrateTrustDomain replaces the trust domain in source principal based on the trust domain aliases information.