security

Documentation

Index

• Constants
• type ACL
  • func NewACL(aclStr string) (ACL, error)
  • func (a ACL) CheckAccess(userObj UserGroup) bool
• type UserGroup
• type UserGroupCache
  • func GetUserGroupCache(resolver string) *UserGroupCache
  • func GetUserGroupCacheOS() *UserGroupCache
  • func GetUserGroupCacheTest() *UserGroupCache
  • func GetUserGroupNoResolve() *UserGroupCache
  • func (c *UserGroupCache) ConvertUGI(ugi *si.UserGroupInformation) (UserGroup, error)
  • func (c *UserGroupCache) GetUserGroup(userName string) (UserGroup, error)

Constants

const (
	WildCard  = "*"
	Separator = ","
	Space     = " "
)

Types

type ACL

type ACL struct {
	// contains filtered or unexported fields
}

func NewACL

func NewACL(aclStr string) (ACL, error)

create a new ACL from scratch

func (ACL) CheckAccess

func (a ACL) CheckAccess(userObj UserGroup) bool

Check if the user has access

type UserGroup

type UserGroup struct {
	User   string
	Groups []string
	// contains filtered or unexported fields
}

The structure of the entry in the cache.

type UserGroupCache

type UserGroupCache struct {
	// contains filtered or unexported fields
}

Cache for the user entries.

func GetUserGroupCache

func GetUserGroupCache(resolver string) *UserGroupCache

Get the resolver for the user and group info. Current setup allows three resolvers: * NO resolver: default, no user or group resolution just return the info (k8s use case) * OS resolver: uses the OS libraries to resolve user and group memberships * Test resolver: fake resolution for testing TODO need to make this fully configurable and look at reflection etc

func GetUserGroupCacheOS

func GetUserGroupCacheOS() *UserGroupCache

Get the cache and use that to resolve all user requests

func GetUserGroupCacheTest

func GetUserGroupCacheTest() *UserGroupCache

Get the cache with a test resolver cleaner runs every second

func GetUserGroupNoResolve

func GetUserGroupNoResolve() *UserGroupCache

Get the cache without a resolver. In k8shim we currently have internal users to K8s which might not resolve against anything. Just echo the object in the correct format based on the user passed in.

func (*UserGroupCache) ConvertUGI

func (c *UserGroupCache) ConvertUGI(ugi *si.UserGroupInformation) (UserGroup, error)

func (*UserGroupCache) GetUserGroup

func (c *UserGroupCache) GetUserGroup(userName string) (UserGroup, error)

Get the user group information. An error will still return a UserGroup. The Failed flag in the object will be set to true for any failures. The information is cached, negatively and positively.