acl

Documentation

Index

• Constants
• func NamespaceValidator(ops ...string) func(*ACL, string) bool
• type ACL
  • func NewACL(management bool, policies []*Policy) (*ACL, error)
  • func (a *ACL) AllowAgentRead() bool
  • func (a *ACL) AllowAgentWrite() bool
  • func (a *ACL) AllowHostVolume(ns string) bool
  • func (a *ACL) AllowHostVolumeOperation(hv string, op string) bool
  • func (a *ACL) AllowNamespace(ns string) bool
  • func (a *ACL) AllowNamespaceOperation(ns string, op string) bool
  • func (a *ACL) AllowNodeRead() bool
  • func (a *ACL) AllowNodeWrite() bool
  • func (a *ACL) AllowNsOp(ns string, op string) bool
  • func (a *ACL) AllowNsOpFunc(ops ...string) func(string) bool
  • func (a *ACL) AllowOperatorRead() bool
  • func (a *ACL) AllowOperatorWrite() bool
  • func (a *ACL) AllowPluginList() bool
  • func (a *ACL) AllowPluginRead() bool
  • func (a *ACL) AllowQuotaRead() bool
  • func (a *ACL) AllowQuotaWrite() bool
  • func (a *ACL) AllowVariableOperation(ns, path, op string) bool
  • func (a *ACL) AllowVariableSearch(ns string) bool
  • func (a *ACL) IsManagement() bool
• type AgentPolicy
• type HostVolumePolicy
• type NamespacePolicy
• type NodePolicy
• type OperatorPolicy
• type PluginPolicy
• type Policy
  • func Parse(rules string) (*Policy, error)
  • func (p *Policy) IsEmpty() bool
• type QuotaPolicy
• type VariablesPathPolicy
• type VariablesPolicy

Constants

const (
	// The following levels are the only valid values for the `policy = "read"` stanza.
	// When policies are merged together, the most privilege is granted, except for deny
	// which always takes precedence and supersedes.
	PolicyDeny  = "deny"
	PolicyRead  = "read"
	PolicyList  = "list"
	PolicyWrite = "write"
	PolicyScale = "scale"
)

const (
	NamespaceCapabilityDeny                 = "deny"
	NamespaceCapabilityListJobs             = "list-jobs"
	NamespaceCapabilityParseJob             = "parse-job"
	NamespaceCapabilityReadJob              = "read-job"
	NamespaceCapabilitySubmitJob            = "submit-job"
	NamespaceCapabilityDispatchJob          = "dispatch-job"
	NamespaceCapabilityReadLogs             = "read-logs"
	NamespaceCapabilityReadFS               = "read-fs"
	NamespaceCapabilityAllocExec            = "alloc-exec"
	NamespaceCapabilityAllocNodeExec        = "alloc-node-exec"
	NamespaceCapabilityAllocLifecycle       = "alloc-lifecycle"
	NamespaceCapabilitySentinelOverride     = "sentinel-override"
	NamespaceCapabilityCSIRegisterPlugin    = "csi-register-plugin"
	NamespaceCapabilityCSIWriteVolume       = "csi-write-volume"
	NamespaceCapabilityCSIReadVolume        = "csi-read-volume"
	NamespaceCapabilityCSIListVolume        = "csi-list-volume"
	NamespaceCapabilityCSIMountVolume       = "csi-mount-volume"
	NamespaceCapabilityListScalingPolicies  = "list-scaling-policies"
	NamespaceCapabilityReadScalingPolicy    = "read-scaling-policy"
	NamespaceCapabilityReadJobScaling       = "read-job-scaling"
	NamespaceCapabilityScaleJob             = "scale-job"
	NamespaceCapabilitySubmitRecommendation = "submit-recommendation"
)

const (
	HostVolumeCapabilityDeny           = "deny"
	HostVolumeCapabilityMountReadOnly  = "mount-readonly"
	HostVolumeCapabilityMountReadWrite = "mount-readwrite"
)

const (
	// The following are the fine-grained capabilities that can be
	// granted for a variables path. When capabilities are
	// combined we take the union of all capabilities.
	VariablesCapabilityList    = "list"
	VariablesCapabilityRead    = "read"
	VariablesCapabilityWrite   = "write"
	VariablesCapabilityDestroy = "destroy"
	VariablesCapabilityDeny    = "deny"
)

const AllNamespacesSentinel = "*"

Redefine this value from structs to avoid circular dependency.

Functions

func NamespaceValidator

func NamespaceValidator(ops ...string) func(*ACL, string) bool

NamespaceValidator returns a func that wraps ACL.AllowNamespaceOperation in a list of operations. Returns true (allowed) if acls are disabled or if *any* capabilities match.

Types

type ACL

type ACL struct {
	// contains filtered or unexported fields
}

ACL object is used to convert a set of policies into a structure that can be efficiently evaluated to determine if an action is allowed.

var ManagementACL *ACL

ManagementACL is a singleton used for management tokens

func NewACL

func NewACL(management bool, policies []*Policy) (*ACL, error)

NewACL compiles a set of policies into an ACL object

func (*ACL) AllowAgentRead

func (a *ACL) AllowAgentRead() bool

AllowAgentRead checks if read operations are allowed for an agent

func (*ACL) AllowAgentWrite

func (a *ACL) AllowAgentWrite() bool

AllowAgentWrite checks if write operations are allowed for an agent

func (*ACL) AllowHostVolume

func (a *ACL) AllowHostVolume(ns string) bool

AllowHostVolume checks if any operations are allowed for a HostVolume

func (*ACL) AllowHostVolumeOperation

func (a *ACL) AllowHostVolumeOperation(hv string, op string) bool

AllowHostVolumeOperation checks if a given operation is allowed for a host volume

func (*ACL) AllowNamespace

func (a *ACL) AllowNamespace(ns string) bool

AllowNamespace checks if any operations are allowed for a namespace

func (*ACL) AllowNamespaceOperation

func (a *ACL) AllowNamespaceOperation(ns string, op string) bool

AllowNamespaceOperation checks if a given operation is allowed for a namespace.

func (*ACL) AllowNodeRead

func (a *ACL) AllowNodeRead() bool

AllowNodeRead checks if read operations are allowed for a node

func (*ACL) AllowNodeWrite

func (a *ACL) AllowNodeWrite() bool

AllowNodeWrite checks if write operations are allowed for a node

func (*ACL) AllowNsOp

func (a *ACL) AllowNsOp(ns string, op string) bool

AllowNsOp is shorthand for AllowNamespaceOperation

func (*ACL) AllowNsOpFunc

func (a *ACL) AllowNsOpFunc(ops ...string) func(string) bool

AllowNsOpFunc is a helper that returns a function that can be used to check namespace permissions.

func (*ACL) AllowOperatorRead

func (a *ACL) AllowOperatorRead() bool

AllowOperatorRead checks if read operations are allowed for a operator

func (*ACL) AllowOperatorWrite

func (a *ACL) AllowOperatorWrite() bool

AllowOperatorWrite checks if write operations are allowed for a operator

func (*ACL) AllowPluginList

func (a *ACL) AllowPluginList() bool

AllowPluginList checks if list operations are allowed for all plugins

func (*ACL) AllowPluginRead

func (a *ACL) AllowPluginRead() bool

AllowPluginRead checks if read operations are allowed for all plugins

func (*ACL) AllowQuotaRead

func (a *ACL) AllowQuotaRead() bool

AllowQuotaRead checks if read operations are allowed for all quotas

func (*ACL) AllowQuotaWrite

func (a *ACL) AllowQuotaWrite() bool

AllowQuotaWrite checks if write operations are allowed for quotas

func (*ACL) AllowVariableOperation

func (a *ACL) AllowVariableOperation(ns, path, op string) bool

func (*ACL) AllowVariableSearch

func (a *ACL) AllowVariableSearch(ns string) bool

AllowVariableSearch is a very loose check that the token has *any* access to a variables path for the namespace, with an expectation that the actual search result will be filtered by specific paths

func (*ACL) IsManagement

func (a *ACL) IsManagement() bool

IsManagement checks if this represents a management token

type AgentPolicy

type AgentPolicy struct {
	Policy string
}

type HostVolumePolicy

type HostVolumePolicy struct {
	Name         string `hcl:",key"`
	Policy       string
	Capabilities []string
}

HostVolumePolicy is the policy for a specific named host volume

type NamespacePolicy

type NamespacePolicy struct {
	Name         string `hcl:",key"`
	Policy       string
	Capabilities []string
	Variables    *VariablesPolicy `hcl:"variables"`
}

NamespacePolicy is the policy for a specific namespace

type NodePolicy

type NodePolicy struct {
	Policy string
}

type OperatorPolicy

type OperatorPolicy struct {
	Policy string
}

type PluginPolicy

type PluginPolicy struct {
	Policy string
}

type Policy

type Policy struct {
	Namespaces  []*NamespacePolicy  `hcl:"namespace,expand"`
	HostVolumes []*HostVolumePolicy `hcl:"host_volume,expand"`
	Agent       *AgentPolicy        `hcl:"agent"`
	Node        *NodePolicy         `hcl:"node"`
	Operator    *OperatorPolicy     `hcl:"operator"`
	Quota       *QuotaPolicy        `hcl:"quota"`
	Plugin      *PluginPolicy       `hcl:"plugin"`
	Raw         string              `hcl:"-"`
}

Policy represents a parsed HCL or JSON policy.

func Parse

func Parse(rules string) (*Policy, error)

Parse is used to parse the specified ACL rules into an intermediary set of policies, before being compiled into the ACL

func (*Policy) IsEmpty

func (p *Policy) IsEmpty() bool

IsEmpty checks to make sure that at least one policy has been set and is not comprised of only a raw policy.

type QuotaPolicy

type QuotaPolicy struct {
	Policy string
}

type VariablesPathPolicy

type VariablesPathPolicy struct {
	PathSpec     string `hcl:",key"`
	Capabilities []string
}

type VariablesPolicy

type VariablesPolicy struct {
	Paths []*VariablesPathPolicy `hcl:"path"`
}