acl

Documentation

Index

• Constants
• func NamespaceValidator(ops ...string) func(*ACL, string) bool
• type ACL
  • func NewACL(management bool, policies []*Policy) (*ACL, error)
  • func (a *ACL) AllowAgentRead() bool
  • func (a *ACL) AllowAgentWrite() bool
  • func (a *ACL) AllowHostVolume(ns string) bool
  • func (a *ACL) AllowHostVolumeOperation(hv string, op string) bool
  • func (a *ACL) AllowNamespace(ns string) bool
  • func (a *ACL) AllowNamespaceOperation(ns string, op string) bool
  • func (a *ACL) AllowNodeRPCRead() bool
  • func (a *ACL) AllowNodeRPCWrite() bool
  • func (a *ACL) AllowNodeRead() bool
  • func (a *ACL) AllowNodeWrite() bool
  • func (a *ACL) AllowNsOp(ns string, op string) bool
  • func (a *ACL) AllowOperatorRead() bool
  • func (a *ACL) AllowOperatorWrite() bool
  • func (a *ACL) AllowPluginList() bool
  • func (a *ACL) AllowPluginRead() bool
  • func (a *ACL) AllowQuotaRead() bool
  • func (a *ACL) AllowQuotaWrite() bool
  • func (a *ACL) IsManagement() bool
• type AgentPolicy
• type HostVolumePolicy
• type NamespacePolicy
• type NodePolicy
• type NodeRPCPolicy
• type OperatorPolicy
• type PluginPolicy
• type Policy
  • func Parse(rules string) (*Policy, error)
  • func (p *Policy) IsEmpty() bool
• type QuotaPolicy

Constants

const (
	// The following levels are the only valid values for the `policy = "read"` stanza.
	// When policies are merged together, the most privilege is granted, except for deny
	// which always takes precedence and supersedes.
	PolicyDeny  = "deny"
	PolicyRead  = "read"
	PolicyList  = "list"
	PolicyWrite = "write"
	PolicyScale = "scale"
)

const (
	NamespaceCapabilityDeny                = "deny"
	NamespaceCapabilityListJobs            = "list-jobs"
	NamespaceCapabilityReadJob             = "read-job"
	NamespaceCapabilitySubmitJob           = "submit-job"
	NamespaceCapabilityDispatchJob         = "dispatch-job"
	NamespaceCapabilityReadLogs            = "read-logs"
	NamespaceCapabilityReadFS              = "read-fs"
	NamespaceCapabilityAllocExec           = "alloc-exec"
	NamespaceCapabilityAllocNodeExec       = "alloc-node-exec"
	NamespaceCapabilityAllocLifecycle      = "alloc-lifecycle"
	NamespaceCapabilitySentinelOverride    = "sentinel-override"
	NamespaceCapabilityCSIRegisterPlugin   = "csi-register-plugin"
	NamespaceCapabilityCSIWriteVolume      = "csi-write-volume"
	NamespaceCapabilityCSIReadVolume       = "csi-read-volume"
	NamespaceCapabilityCSIListVolume       = "csi-list-volume"
	NamespaceCapabilityCSIMountVolume      = "csi-mount-volume"
	NamespaceCapabilityListScalingPolicies = "list-scaling-policies"
	NamespaceCapabilityReadScalingPolicy   = "read-scaling-policy"
	NamespaceCapabilityReadJobScaling      = "read-job-scaling"
	NamespaceCapabilityScaleJob            = "scale-job"
)

const (
	HostVolumeCapabilityDeny           = "deny"
	HostVolumeCapabilityMountReadOnly  = "mount-readonly"
	HostVolumeCapabilityMountReadWrite = "mount-readwrite"
)

Functions

func NamespaceValidator

func NamespaceValidator(ops ...string) func(*ACL, string) bool

NamespaceValidator returns a func that wraps ACL.AllowNamespaceOperation in a list of operations. Returns true (allowed) if acls are disabled or if *any* capabilities match.

Types

type ACL

type ACL struct {
	// contains filtered or unexported fields
}

ACL object is used to convert a set of policies into a structure that can be efficiently evaluated to determine if an action is allowed.

var ManagementACL *ACL

ManagementACL is a singleton used for management tokens

func NewACL

func NewACL(management bool, policies []*Policy) (*ACL, error)

NewACL compiles a set of policies into an ACL object

func (*ACL) AllowAgentRead

func (a *ACL) AllowAgentRead() bool

AllowAgentRead checks if read operations are allowed for an agent

func (*ACL) AllowAgentWrite

func (a *ACL) AllowAgentWrite() bool

AllowAgentWrite checks if write operations are allowed for an agent

func (*ACL) AllowHostVolume

func (a *ACL) AllowHostVolume(ns string) bool

AllowHostVolume checks if any operations are allowed for a HostVolume

func (*ACL) AllowHostVolumeOperation

func (a *ACL) AllowHostVolumeOperation(hv string, op string) bool

AllowHostVolumeOperation checks if a given operation is allowed for a host volume

func (*ACL) AllowNamespace

func (a *ACL) AllowNamespace(ns string) bool

AllowNamespace checks if any operations are allowed for a namespace

func (*ACL) AllowNamespaceOperation

func (a *ACL) AllowNamespaceOperation(ns string, op string) bool

AllowNamespaceOperation checks if a given operation is allowed for a namespace

func (*ACL) AllowNodeRPCRead

func (a *ACL) AllowNodeRPCRead() bool

AllowNodeWrite checks if write operations are allowed for a node

func (*ACL) AllowNodeRPCWrite

func (a *ACL) AllowNodeRPCWrite() bool

AllowNodeWrite checks if write operations are allowed for a node

func (*ACL) AllowNodeRead

func (a *ACL) AllowNodeRead() bool

AllowNodeRead checks if read operations are allowed for a node

func (*ACL) AllowNodeWrite

func (a *ACL) AllowNodeWrite() bool

AllowNodeWrite checks if write operations are allowed for a node

func (*ACL) AllowNsOp

func (a *ACL) AllowNsOp(ns string, op string) bool

AllowNsOp is shorthand for AllowNamespaceOperation

func (*ACL) AllowOperatorRead

func (a *ACL) AllowOperatorRead() bool

AllowOperatorRead checks if read operations are allowed for a operator

func (*ACL) AllowOperatorWrite

func (a *ACL) AllowOperatorWrite() bool

AllowOperatorWrite checks if write operations are allowed for a operator

func (*ACL) AllowPluginList

func (a *ACL) AllowPluginList() bool

AllowPluginList checks if list operations are allowed for all plugins

func (*ACL) AllowPluginRead

func (a *ACL) AllowPluginRead() bool

AllowPluginRead checks if read operations are allowed for all plugins

func (*ACL) AllowQuotaRead

func (a *ACL) AllowQuotaRead() bool

AllowQuotaRead checks if read operations are allowed for all quotas

func (*ACL) AllowQuotaWrite

func (a *ACL) AllowQuotaWrite() bool

AllowQuotaWrite checks if write operations are allowed for quotas

func (*ACL) IsManagement

func (a *ACL) IsManagement() bool

IsManagement checks if this represents a management token

type AgentPolicy

type AgentPolicy struct {
	Policy string
}

type HostVolumePolicy

type HostVolumePolicy struct {
	Name         string `hcl:",key"`
	Policy       string
	Capabilities []string
}

HostVolumePolicy is the policy for a specific named host volume

type NamespacePolicy

type NamespacePolicy struct {
	Name         string `hcl:",key"`
	Policy       string
	Capabilities []string
}

NamespacePolicy is the policy for a specific namespace

type NodePolicy

type NodePolicy struct {
	Policy string
}

type NodeRPCPolicy

type NodeRPCPolicy struct {
	Policy string
}

type OperatorPolicy

type OperatorPolicy struct {
	Policy string
}

type PluginPolicy

type PluginPolicy struct {
	Policy string
}

type Policy

type Policy struct {
	Namespaces  []*NamespacePolicy  `hcl:"namespace,expand"`
	HostVolumes []*HostVolumePolicy `hcl:"host_volume,expand"`
	Agent       *AgentPolicy        `hcl:"agent"`
	Node        *NodePolicy         `hcl:"node"`
	NodeRPC     *NodeRPCPolicy      `hcl:"noderpc"`
	Operator    *OperatorPolicy     `hcl:"operator"`
	Quota       *QuotaPolicy        `hcl:"quota"`
	Plugin      *PluginPolicy       `hcl:"plugin"`
	Raw         string              `hcl:"-"`
}

Policy represents a parsed HCL or JSON policy.

func Parse

func Parse(rules string) (*Policy, error)

Parse is used to parse the specified ACL rules into an intermediary set of policies, before being compiled into the ACL

func (*Policy) IsEmpty

func (p *Policy) IsEmpty() bool

IsEmpty checks to make sure that at least one policy has been set and is not comprised of only a raw policy.

type QuotaPolicy

type QuotaPolicy struct {
	Policy string
}