engine

Documentation

Index

• Variables
• type CheckOpt
  • func WithGlobals(globals map[string]any) CheckOpt
  • func WithLenientScopeSearch() CheckOpt
  • func WithNowFunc(nowFunc func() time.Time) CheckOpt
  • func WithTraceSink(tracerSink tracer.Sink) CheckOpt
  • func WithZapTraceSink(log *zap.Logger) CheckOpt
• type CheckOptions
  • func ApplyCheckOptions(opts ...CheckOpt) *CheckOptions
  • func (co *CheckOptions) Globals() map[string]any
  • func (co *CheckOptions) LenientScopeSearch() bool
  • func (co *CheckOptions) NowFunc() func() time.Time
• type Components
• type Conf
  • func GetConf() (*Conf, error)
  • func (c *Conf) Key() string
  • func (c *Conf) SetDefaults()
  • func (c *Conf) Validate() error
• type EffectInfo
• type Engine
  • func New(ctx context.Context, components Components) (*Engine, error)
  • func NewEphemeral(policyLoader PolicyLoader, schemaMgr schema.Manager) (*Engine, error)
  • func NewFromConf(ctx context.Context, conf *Conf, components Components) *Engine
  • func (engine *Engine) Check(ctx context.Context, inputs []*enginev1.CheckInput, opts ...CheckOpt) ([]*enginev1.CheckOutput, error)
  • func (engine *Engine) PlanResources(ctx context.Context, input *enginev1.PlanResourcesInput, opts ...CheckOpt) (*enginev1.PlanResourcesOutput, error)
• type Evaluator
  • func NewEvaluator(rps *runtimev1.RunnablePolicySet, schemaMgr schema.Manager, eparams evalParams) Evaluator
• type PolicyEvalResult
• type PolicyLoader

Variables

var ErrPolicyNotExecutable = errors.New("policy not executable")

Types

type CheckOpt

type CheckOpt func(*CheckOptions)

CheckOpt defines options for engine Check calls.

func WithGlobals

func WithGlobals(globals map[string]any) CheckOpt

WithGlobals sets the global variables for the engine.

func WithLenientScopeSearch

func WithLenientScopeSearch() CheckOpt

WithLenientScopeSearch enables lenient scope search.

func WithNowFunc

func WithNowFunc(nowFunc func() time.Time) CheckOpt

WithNowFunc sets the function for determining `now` during condition evaluation.

func WithTraceSink

func WithTraceSink(tracerSink tracer.Sink) CheckOpt

func WithZapTraceSink

func WithZapTraceSink(log *zap.Logger) CheckOpt

WithZapTraceSink sets an engine tracer with Zap set as the sink.

type CheckOptions

type CheckOptions struct {
	// contains filtered or unexported fields
}

func ApplyCheckOptions

func ApplyCheckOptions(opts ...CheckOpt) *CheckOptions

func (*CheckOptions) Globals

func (co *CheckOptions) Globals() map[string]any

func (*CheckOptions) LenientScopeSearch

func (co *CheckOptions) LenientScopeSearch() bool

func (*CheckOptions) NowFunc

func (co *CheckOptions) NowFunc() func() time.Time

type Components

type Components struct {
	AuditLog          audit.Log
	PolicyLoader      PolicyLoader
	SchemaMgr         schema.Manager
	MetadataExtractor audit.MetadataExtractor
}

type Conf

type Conf struct {
	// Globals are environment-specific variables to be made available to policy conditions.
	Globals map[string]any `yaml:"globals" conf:",example={\"environment\": \"staging\"}"`
	// DefaultPolicyVersion defines what version to assume if the request does not specify one.
	DefaultPolicyVersion string `yaml:"defaultPolicyVersion" conf:",example=\"default\""`
	// LenientScopeSearch configures the engine to ignore missing scopes and search upwards through the scope tree until it finds a usable policy.
	LenientScopeSearch bool `yaml:"lenientScopeSearch" conf:",example=false"`
	NumWorkers         uint `yaml:"numWorkers" conf:",ignore"`
}

Conf is optional configuration for engine.

func GetConf

func GetConf() (*Conf, error)

func (*Conf) Key

func (c *Conf) Key() string

func (*Conf) SetDefaults

func (c *Conf) SetDefaults()

func (*Conf) Validate

func (c *Conf) Validate() error

type EffectInfo

type EffectInfo struct {
	Policy string
	Scope  string
	Effect effectv1.Effect
}

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, components Components) (*Engine, error)

func NewEphemeral

func NewEphemeral(policyLoader PolicyLoader, schemaMgr schema.Manager) (*Engine, error)

func NewFromConf

func NewFromConf(ctx context.Context, conf *Conf, components Components) *Engine

func (*Engine) Check

func (engine *Engine) Check(ctx context.Context, inputs []*enginev1.CheckInput, opts ...CheckOpt) ([]*enginev1.CheckOutput, error)

func (*Engine) PlanResources

func (engine *Engine) PlanResources(ctx context.Context, input *enginev1.PlanResourcesInput, opts ...CheckOpt) (*enginev1.PlanResourcesOutput, error)

type Evaluator

type Evaluator interface {
	Evaluate(context.Context, tracer.Context, *enginev1.CheckInput) (*PolicyEvalResult, error)
}

func NewEvaluator

func NewEvaluator(rps *runtimev1.RunnablePolicySet, schemaMgr schema.Manager, eparams evalParams) Evaluator

type PolicyEvalResult

type PolicyEvalResult struct {
	Effects               map[string]EffectInfo
	EffectiveDerivedRoles map[string]struct{}

	AuditTrail       *auditv1.AuditTrail
	ValidationErrors []*schemav1.ValidationError
	Outputs          []*enginev1.OutputEntry
	// contains filtered or unexported fields
}

type PolicyLoader

type PolicyLoader interface {
	GetFirstMatch(context.Context, []namer.ModuleID) (*runtimev1.RunnablePolicySet, error)
}