abac

Documentation

Overview

Package abac authorizes Kubernetes API actions using an Attribute-based access control scheme.

Index

• type PolicyList
  • func NewFromFile(path string) (PolicyList, error)
  • func (pl PolicyList) Authorize(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error)
  • func (pl PolicyList) ConditionsAwareAuthorize(ctx context.Context, a authorizer.Attributes) authorizer.ConditionsAwareDecision
  • func (PolicyList) EvaluateConditions(_ context.Context, _ authorizer.ConditionsAwareDecision, ...) (authorizer.Decision, string, error)
  • func (pl PolicyList) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

Types

type PolicyList

type PolicyList []*abac.Policy

PolicyList is simply a slice of Policy structs.

func NewFromFile

func NewFromFile(path string) (PolicyList, error)

NewFromFile attempts to create a policy list from the given file.

TODO: Have policies be created via an API call and stored in REST storage.

func (PolicyList) Authorize

func (pl PolicyList) Authorize(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error)

Authorize implements authorizer.Authorize

func (PolicyList) ConditionsAwareAuthorize

func (pl PolicyList) ConditionsAwareAuthorize(ctx context.Context, a authorizer.Attributes) authorizer.ConditionsAwareDecision

ConditionsAwareAuthorize is not conditions-aware, converts the Authorize decision.

func (PolicyList) EvaluateConditions

func (PolicyList) EvaluateConditions(_ context.Context, _ authorizer.ConditionsAwareDecision, _ authorizer.ConditionsData) (authorizer.Decision, string, error)

EvaluateConditions is not supported by this authorizer.

func (PolicyList) RulesFor

func (pl PolicyList) RulesFor(ctx context.Context, user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error)

RulesFor returns rules for the given user and namespace.