common

Documentation

Overview

Copyright 2019, Verizon Media Inc. Licensed under the terms of the 3-Clause BSD license. See LICENSE file in github.com/yahoo/k8s-athenz-istio-auth for terms.

Copyright 2019, Verizon Media Inc. Licensed under the terms of the 3-Clause BSD license. See LICENSE file in github.com/yahoo/k8s-athenz-istio-auth for terms.

Copyright 2019, Verizon Media Inc. Licensed under the terms of the 3-Clause BSD license. See LICENSE file in github.com/yahoo/k8s-athenz-istio-auth for terms.

Index

• Constants
• func CheckAthenzMemberExpiry(member interface{}) (bool, error)
• func CheckAthenzSystemDisabled(member interface{}) (bool, error)
• func CheckIfMemberIsAllUsersFromDomain(member interface{}, domainName zms.DomainName) (string, error)
• func ConvertAthenzRoleNameToK8sName(roleName string) string
• func ConvertSliceToKeyedMap(in []model.Config) map[string]model.Config
• func Equal(c1, c2 model.Config) bool
• func GetMemberName(member interface{}) string
• func GetServiceRoleBindingSpec(athenzDomainName string, roleName string, k8sRoleName string, ...) (*v1alpha1.ServiceRoleBinding, error)
• func GetServiceRoleSpec(domainName zms.DomainName, roleName string, assertions []*zms.Assertion) (*v1alpha1.ServiceRole, error)
• func MemberToOriginJwtSubject(member interface{}) (string, error)
• func MemberToSpiffe(member interface{}) (string, error)
• func NewConfig(schema collection.Schema, namespace string, name string, spec proto.Message) model.Config
• func ParseAssertionAction(assertion *zms.Assertion) (string, error)
• func ParseAssertionEffect(assertion *zms.Assertion) (string, error)
• func ParseAssertionResource(domainName zms.DomainName, assertion *zms.Assertion) (string, string, error)
• func ParseRoleFQDN(domainName zms.DomainName, roleFQDN string) (string, error)
• func PrincipalToSpiffe(principal string) (string, error)
• func ReadConvertToModelConfig(serviceName, namespace, localDirPath string) (*model.Config, error)
• func ReadDirectoryConvertToModelConfig(namespace, localDirPath string) ([]model.Config, error)
• func RoleToSpiffe(athenzDomainName string, roleName string) (string, error)
• type ApiHandler
  • func (a *ApiHandler) Add(item *Item) error
  • func (a *ApiHandler) Delete(item *Item) error
  • func (a *ApiHandler) Update(item *Item) error
• type ComponentEnabled
  • func ParseComponentsEnabledAuthzPolicy(componentsList string) (*ComponentEnabled, error)
  • func (c *ComponentEnabled) IsEnabled(serviceName string, serviceNamespace string) bool
• type DryRunHandler
  • func (d *DryRunHandler) Add(item *Item) error
  • func (d *DryRunHandler) Delete(item *Item) error
  • func (d *DryRunHandler) Update(item *Item) error
• type EventHandler
• type Item
  • func ComputeChangeList(currentCRs []model.Config, desiredCRs []model.Config, cbHandler OnCompleteFunc, ...) []*Item
• type OnCompleteFunc

Constants

const (
	WildCardAll                  = "*"
	ServiceRoleKind              = "ServiceRole"
	AthenzJwtPrefix              = "athenz/"
	RequestAuthPrincipalProperty = "request.auth.principal"
	DryRunStoredFilesDirectory   = "/root/authzpolicy/"
)

const ConstraintSvcKey = "destination.labels[svc]"

Functions

func CheckAthenzMemberExpiry

func CheckAthenzMemberExpiry(member interface{}) (bool, error)

CheckAthenzMemberExpiry checks if Expiration field (timezone UTC) is set in the roleMember object, and then checks if expiration date surpasses current time

func CheckAthenzSystemDisabled

func CheckAthenzSystemDisabled(member interface{}) (bool, error)

CheckAthenzSystemDisabled checks if athenz domain is systematically disabled, if so, controller skips processing current role member

func CheckIfMemberIsAllUsersFromDomain

func CheckIfMemberIsAllUsersFromDomain(member interface{}, domainName zms.DomainName) (string, error)

CheckIfMemberIsAllUsersFromDomain returns namespace for Athenz domain when role/group member is of form '<athenz-domain>.*'. Example: domain.sub-domain.* -> domain-sub--domain

func ConvertAthenzRoleNameToK8sName

func ConvertAthenzRoleNameToK8sName(roleName string) string

ConvertAthenzRoleNameToK8sName replaces the '_' in the Athenz role name to a '--' as Kubernetes resource name needs to follow a DNS-1123 subdomain format which must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character

func ConvertSliceToKeyedMap

func ConvertSliceToKeyedMap(in []model.Config) map[string]model.Config

ConvertSliceToKeyedMap converts the input model.Config slice into a map with (type/namespace/name) formatted key

func Equal

func Equal(c1, c2 model.Config) bool

Equal compares the Spec of two model.Config items

func GetMemberName

func GetMemberName(member interface{}) string

GetMemberName computes the name of the member based on if the type of the member is *zms.GroupMember or *zms.RoleMember

func GetServiceRoleBindingSpec

func GetServiceRoleBindingSpec(athenzDomainName string, roleName string, k8sRoleName string, members []*zms.RoleMember, enableOriginJwtSubject bool) (*v1alpha1.ServiceRoleBinding, error)

GetServiceRoleBindingSpec returns the ServiceRoleBindingSpec for a given Athenz role and its members

func GetServiceRoleSpec

func GetServiceRoleSpec(domainName zms.DomainName, roleName string, assertions []*zms.Assertion) (*v1alpha1.ServiceRole, error)

GetServiceRoleSpec returns the ServiceRoleSpec for a given Athenz role and the associated assertions

func MemberToOriginJwtSubject

func MemberToOriginJwtSubject(member interface{}) (string, error)

MemberToOriginSubject parses the Athenz role/group member into the request.auth.principal jwt format. Example: athenz/example.domain.service

func MemberToSpiffe

func MemberToSpiffe(member interface{}) (string, error)

MemberToSpiffe parses the Athenz role/group member into a SPIFFE compliant name. Example: example.domain/sa/service

func NewConfig

func NewConfig(schema collection.Schema, namespace string, name string, spec proto.Message) model.Config

NewConfig returns a new model.Config resource for the passed-in type with the given namespace/name and spec

func ParseAssertionAction

func ParseAssertionAction(assertion *zms.Assertion) (string, error)

ParseAssertionAction parses the action of an assertion into a supported Istio RBAC HTTP method

func ParseAssertionEffect

func ParseAssertionEffect(assertion *zms.Assertion) (string, error)

ParseAssertionEffect parses the effect of an assertion into a supported Istio RBAC action

func ParseAssertionResource

func ParseAssertionResource(domainName zms.DomainName, assertion *zms.Assertion) (string, string, error)

ParseAssertionResource parses the resource of an action into the service name (AccessRule constraint) and the HTTP paths if specified (suffix :<path>)

func ParseRoleFQDN

func ParseRoleFQDN(domainName zms.DomainName, roleFQDN string) (string, error)

ParseRoleFQDN parses the Athenz role full name in the format <domainName>:role.<roleName> to roleName e.g. app-domain:role.reader -> reader

func PrincipalToSpiffe

func PrincipalToSpiffe(principal string) (string, error)

PrincipalToSpiffe converts the Athenz principal into a SPIFFE compliant format e.g. client-domain.frontend.some-app -> client-domain.frontend/sa/some-app

func ReadConvertToModelConfig

func ReadConvertToModelConfig(serviceName, namespace, localDirPath string) (*model.Config, error)

ReadConvertToModelConfig reads in the authorization policy yaml object and converts it into a model.Config struct

func ReadDirectoryConvertToModelConfig

func ReadDirectoryConvertToModelConfig(namespace, localDirPath string) ([]model.Config, error)

ReadDirectoryConvertToModelConfig reads in the subdirectory for one namespace and converts files under the directory to a list of model.Config struct

func RoleToSpiffe

func RoleToSpiffe(athenzDomainName string, roleName string) (string, error)

RoleToSpiffe reads athenz role name string, and generates the SPIFFE name of it SPIFFE name format: <athenz domain name>/ra/<role name>

Types

type ApiHandler

type ApiHandler struct {
	ConfigStoreCache model.ConfigStoreCache
}

func (*ApiHandler) Add

func (a *ApiHandler) Add(item *Item) error

func (*ApiHandler) Delete

func (a *ApiHandler) Delete(item *Item) error

func (*ApiHandler) Update

func (a *ApiHandler) Update(item *Item) error

type ComponentEnabled

type ComponentEnabled struct {
	// contains filtered or unexported fields
}

func ParseComponentsEnabledAuthzPolicy

func ParseComponentsEnabledAuthzPolicy(componentsList string) (*ComponentEnabled, error)

func (*ComponentEnabled) IsEnabled

func (c *ComponentEnabled) IsEnabled(serviceName string, serviceNamespace string) bool

type DryRunHandler

type DryRunHandler struct{}

func (*DryRunHandler) Add

func (d *DryRunHandler) Add(item *Item) error

func (*DryRunHandler) Delete

func (d *DryRunHandler) Delete(item *Item) error

func (*DryRunHandler) Update

func (d *DryRunHandler) Update(item *Item) error

type EventHandler

type EventHandler interface {
	Add(item *Item) error
	Update(item *Item) error
	Delete(item *Item) error
}

type Item

type Item struct {
	Operation model.Event
	Resource  model.Config
	// Handler function that should be invoked with the status of the current sync operation on the item
	// If the handler returns an error, the operation is retried up to `queueNumRetries`
	CallbackHandler OnCompleteFunc
}

func ComputeChangeList

func ComputeChangeList(currentCRs []model.Config, desiredCRs []model.Config, cbHandler OnCompleteFunc, checkFn additionalCheck) []*Item

ComputeChangeList checks if two set of config models have any differences, and return its changeList Controller which calls this function is required to pass its own callback handler checkFn is optional, can be set to nil if nothing needs to be checked

type OnCompleteFunc

type OnCompleteFunc func(err error, item *Item) error