governance

Documentation

Overview

Package governance evaluates Ramen-owned static policy and approval requirements.

This package is experimental in Ramen v0.1; callers should expect its API to evolve before v1.

Index

• Constants
• func LoadPolicyFiles(paths []string) (StaticEngine, []Decision)
• func RequirementsSatisfied(requirements []ApprovalRequirement, approvers []Approver) error
• type ApprovalRequirement
• type Approver
  • func NormalizeApprover(approver Approver) (Approver, error)
• type Decision
• type Engine
• type Input
• type Policy
• type PolicyRef
• type Resource
• type Result
  • func MergeResults(results ...Result) Result
• type StaticEngine
  • func (e StaticEngine) Evaluate(input Input) Result

Constants

const (
	ResultVersion = "ramen.governance.v1"
	PolicyVersion = "ramen.policy.v1"
)

Functions

func LoadPolicyFiles

func LoadPolicyFiles(paths []string) (StaticEngine, []Decision)

func RequirementsSatisfied

func RequirementsSatisfied(requirements []ApprovalRequirement, approvers []Approver) error

RequirementsSatisfied evaluates Ramen approval requirements using the shared evidence/approval primitives. Ramen requirements never expire, so evaluation is independent of the wall clock.

Types

type ApprovalRequirement

type ApprovalRequirement struct {
	ID           string   `json:"id"`
	Policy       string   `json:"policy,omitempty"`
	Reason       string   `json:"reason"`
	Address      string   `json:"address,omitempty"`
	Action       string   `json:"action,omitempty"`
	MinApprovals int      `json:"min_approvals"`
	Roles        []string `json:"roles,omitempty"`
}

type Approver

type Approver struct {
	Identity   string    `json:"identity"`
	Role       string    `json:"role,omitempty"`
	Context    string    `json:"context,omitempty"`
	ApprovedAt time.Time `json:"approved_at"`
}

func NormalizeApprover

func NormalizeApprover(approver Approver) (Approver, error)

NormalizeApprover trims approver identity metadata and normalizes the approval timestamp to UTC via the shared evidence/approval primitive.

type Decision

type Decision struct {
	Policy   string `json:"policy,omitempty"`
	Severity string `json:"severity"`
	Code     string `json:"code"`
	Message  string `json:"message"`
	Address  string `json:"address,omitempty"`
	Action   string `json:"action,omitempty"`
}

type Engine

type Engine interface {
	Evaluate(Input) Result
}

type Input

type Input struct {
	Action       string
	InputsDigest string
	Resources    []Resource
}

type Policy

type Policy struct {
	Version                  string   `json:"version,omitempty" yaml:"version,omitempty"`
	Name                     string   `json:"name,omitempty" yaml:"name,omitempty"`
	DenyActions              []string `json:"deny_actions,omitempty" yaml:"deny_actions,omitempty"`
	WarnActions              []string `json:"warn_actions,omitempty" yaml:"warn_actions,omitempty"`
	RequireApprovalActions   []string `json:"require_approval_actions,omitempty" yaml:"require_approval_actions,omitempty"`
	RequireApprovalAddresses []string `json:"require_approval_addresses,omitempty" yaml:"require_approval_addresses,omitempty"`
	MaxDeletes               int      `json:"max_deletes,omitempty" yaml:"max_deletes,omitempty"`
	RequiredApproverRoles    []string `json:"required_approver_roles,omitempty" yaml:"required_approver_roles,omitempty"`
}

type PolicyRef

type PolicyRef struct {
	Name   string `json:"name,omitempty"`
	Path   string `json:"path,omitempty"`
	Digest string `json:"digest,omitempty"`
}

type Resource

type Resource struct {
	Address  string `json:"address"`
	Type     string `json:"type,omitempty"`
	Provider string `json:"provider,omitempty"`
	Action   string `json:"action"`
}

type Result

type Result struct {
	Version              string                `json:"version,omitempty"`
	Policies             []PolicyRef           `json:"policies,omitempty"`
	Decisions            []Decision            `json:"decisions,omitempty"`
	ApprovalRequirements []ApprovalRequirement `json:"approval_requirements,omitempty"`
}

func MergeResults

func MergeResults(results ...Result) Result

type StaticEngine

type StaticEngine struct {
	Policies []Policy
	Refs     []PolicyRef
}

func (StaticEngine) Evaluate

func (e StaticEngine) Evaluate(input Input) Result