Documentation
¶
Overview ¶
Package policy represents the athenz policy updater fetching and verify logic and provide an interface to verify the policy data.
Index ¶
- Variables
- type Assertion
- type Daemon
- type Fetcher
- type Option
- func WithAthenzDomains(doms ...string) Option
- func WithAthenzURL(url string) Option
- func WithExpiryMargin(d string) Option
- func WithHTTPClient(c *http.Client) Option
- func WithPubKeyProvider(pkp pubkey.Provider) Option
- func WithPurgePeriod(d string) Option
- func WithRefreshPeriod(d string) Option
- func WithRetryAttempts(c int) Option
- func WithRetryDelay(d string) Option
- type SignedPolicy
- type SignedPolicyVerifier
Constants ¶
This section is empty.
Variables ¶
var ( // ErrDomainMismatch "Access denied due to domain mismatch between Resource and RoleToken" ErrDomainMismatch = errors.New("Access denied due to domain mismatch between Resource and RoleToken") // ErrDomainNotFound "Access denied due to domain not found in library cache" ErrDomainNotFound = errors.New("Access denied due to domain not found in library cache") // ErrNoMatch "Access denied due to no match to any of the assertions defined in domain policy file" ErrNoMatch = errors.New("Access denied due to no match to any of the assertions defined in domain policy file") // ErrInvalidPolicyResource "Access denied due to invalid/empty policy resources" ErrInvalidPolicyResource = errors.New("Access denied due to invalid/empty policy resources") // ErrDenyByPolicy "Access Check was explicitly denied" ErrDenyByPolicy = errors.New("Access Check was explicitly denied") // ErrDomainExpired "Access denied due to expired domain policy file" ErrDomainExpired = errors.New("Access denied due to expired domain policy file") // ErrFetchPolicy "Error fetching athenz policy" ErrFetchPolicy = errors.New("Error fetching athenz policy") )
Functions ¶
This section is empty.
Types ¶
type Assertion ¶
type Assertion struct {
ResourceDomain string `json:"resource_domain"`
ActionRegexp *regexp.Regexp `json:"-"`
ResourceRegexp *regexp.Regexp `json:"-"`
Effect error `json:"effect"`
Action string `json:"action"`
Resource string `json:"resource"`
ActionRegexpString string `json:"action_regexp_string"`
ResourceRegexpString string `json:"resource_regexp_string"`
}
Assertion represents the refined assertion data use in policy checking
func NewAssertion ¶
NewAssertion returns the Assertion object or error
type Daemon ¶
type Daemon interface {
Start(context.Context) <-chan error
Update(context.Context) error
CheckPolicy(ctx context.Context, domain string, roles []string, action, resource string) error
CheckPolicyRoles(ctx context.Context, domain string, roles []string, action, resource string) ([]string, error)
GetPolicyCache(context.Context) map[string]interface{}
}
Daemon represents the daemon to retrieve policy data from Athenz.
type Fetcher ¶
type Fetcher interface {
Domain() string
Fetch(context.Context) (*SignedPolicy, error)
FetchWithRetry(context.Context) (*SignedPolicy, error)
}
Fetcher represents fetcher object for fetching signed policy
type Option ¶
type Option func(*policyd) error
Option represents a functional option
func WithAthenzDomains ¶
WithAthenzDomains represents an AthenzDomain functional option
func WithAthenzURL ¶
WithAthenzURL returns an AthenzURL functional option
func WithExpiryMargin ¶
WithExpiryMargin returns an ExpiryMargin functional option
func WithHTTPClient ¶
WithHTTPClient returns a HttpClient functional option
func WithPubKeyProvider ¶
WithPubKeyProvider returns a PubKeyProvider functional option
func WithPurgePeriod ¶
WithPurgePeriod returns a PurgePeriod functional option
func WithRefreshPeriod ¶
WithRefreshPeriod returns a RefreshPeriod functional option
func WithRetryAttempts ¶
WithRetryAttempts returns an RetryAttempts functional option
func WithRetryDelay ¶
WithRetryDelay returns an RetryDelay functional option
type SignedPolicy ¶
type SignedPolicy struct {
util.DomainSignedPolicyData
}
SignedPolicy represents the signed policy data
type SignedPolicyVerifier ¶
type SignedPolicyVerifier func(*SignedPolicy) error
SignedPolicyVerifier type defines the function signature to verify a signed policy.
Source Files