Documentation
¶
Overview ¶
Package policy includes objects used to define, instantiate, and enforce policies.
Index ¶
- func DecisionNames(selected ...string) model.DecisionSelector
- func UnfinalizedDecisions(values []model.DecisionValue) model.DecisionSelector
- type Engine
- func (e *Engine) AddInstance(inst *model.Instance) error
- func (e *Engine) CompileEnv(src *model.Source) (*model.Env, *Issues)
- func (e *Engine) CompileInstance(src *model.Source) (*model.Instance, *Issues)
- func (e *Engine) CompileTemplate(src *model.Source) (*model.Template, *Issues)
- func (e *Engine) Eval(vars map[string]interface{}, selector model.DecisionSelector) ([]model.DecisionValue, error)
- func (e *Engine) EvalAll(vars map[string]interface{}) ([]model.DecisionValue, error)
- func (e *Engine) SetTemplate(name string, tmpl *model.Template) error
- type EngineOption
- func EvaluatorDecisionLimit(limit int) EngineOption
- func EvaluatorProductionLimit(limit int) EngineOption
- func EvaluatorTermLimit(limit int) EngineOption
- func RangeLimit(limit int) EngineOption
- func RuleLimit(limit int) EngineOption
- func RuntimeTemplateOptions(rtOpts ...runtime.TemplateOption) EngineOption
- func Selectors(selectors ...Selector) EngineOption
- func StandardExprEnv(exprEnv *cel.Env) EngineOption
- func ValidatorProductionLimit(limit int) EngineOption
- func ValidatorTermLimit(limit int) EngineOption
- type Issues
- type Selector
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecisionNames ¶
func DecisionNames(selected ...string) model.DecisionSelector
DecisionNames filters the decision set which can be produced by the engine to a specific set of named decisions.
func UnfinalizedDecisions ¶
func UnfinalizedDecisions(values []model.DecisionValue) model.DecisionSelector
UnfinalizedDecisions filters the decisions down to the set of decisions which has not yet been finalized.
Note, it is up to the caller to determine whether the policy instances have been completely evaluated as it is possible to shard the instances into different Engine instances and use the output of one evaluation as a filter into the next shard.
Types ¶
type Engine ¶
Engine evaluates context against policy instances to produce decisions.
func NewEngine ¶
func NewEngine(opts ...EngineOption) (*Engine, error)
NewEngine instantiates a policy.Engine with a set of configurable options.
Custom functions and policy instance selectors must be provided as functional options to the engine construction if either is intended to be supported within the configured templates and instances.
func (*Engine) AddInstance ¶
AddInstance configures the engine with a given instance.
Instances are grouped together by their 'kind' field which corresponds to a template metadata.name value.
func (*Engine) CompileEnv ¶
CompileEnv parses and compiles an input source into a model.Env.
func (*Engine) CompileInstance ¶
CompileInstance parses, compiles, and validates an input source into a model.Instance. Note, the template referenced in the model.Instance 'kind' field must be configured within the engine before its instances can be compiled.
func (*Engine) CompileTemplate ¶
CompileTemplate parses and compiles an input source into a model.Template.
func (*Engine) Eval ¶
func (e *Engine) Eval(vars map[string]interface{}, selector model.DecisionSelector) ([]model.DecisionValue, error)
Eval accepts an input context and produces a set of decisions as output.
Which decisions are produced depends on the active set of policy instances and whether any rules within these policies apply to the context.
func (*Engine) EvalAll ¶
func (e *Engine) EvalAll(vars map[string]interface{}) ([]model.DecisionValue, error)
EvalAll accepts an input context and produces a set of decisions as output.
Which decisions are produced depends on the active set of policy instances and whether any rules within these policies apply to the context.
type EngineOption ¶
EngineOption is a functional option for configuring the policy engine.
func EvaluatorDecisionLimit ¶
func EvaluatorDecisionLimit(limit int) EngineOption
EvaluatorDecisionLimit set the evaluator decision limit within a single production supported by the compilation and runtime components.
func EvaluatorProductionLimit ¶
func EvaluatorProductionLimit(limit int) EngineOption
EvaluatorProductionLimit set the evaluator production limit supported by the compilation and runtime components.
func EvaluatorTermLimit ¶
func EvaluatorTermLimit(limit int) EngineOption
EvaluatorTermLimit sets the evaluator term limit supported by the compilation and runtime components.
func RangeLimit ¶
func RangeLimit(limit int) EngineOption
RangeLimit sets the range limit supported by the compilation and runtime components.
func RuleLimit ¶
func RuleLimit(limit int) EngineOption
RuleLimit sets the rule limit within a policy instance supported by the compilation and runtime components.
func RuntimeTemplateOptions ¶
func RuntimeTemplateOptions(rtOpts ...runtime.TemplateOption) EngineOption
RuntimeTemplateOptions collects a set of runtime specific options to be configured on runtime templates.
func Selectors ¶
func Selectors(selectors ...Selector) EngineOption
Selectors is a functional option which may be configured to select a subset of policy instances which are applicable to the current evaluation context.
func StandardExprEnv ¶
func StandardExprEnv(exprEnv *cel.Env) EngineOption
StandardExprEnv configures the CEL expression environment to be used as the basis for all other environment derivations within templates.
func ValidatorProductionLimit ¶
func ValidatorProductionLimit(limit int) EngineOption
ValidatorProductionLimit set the validator production limit supported by the compilation and runtime components.
func ValidatorTermLimit ¶
func ValidatorTermLimit(limit int) EngineOption
ValidatorTermLimit sets the validator term limit supported by the compilation and runtime components.
type Selector ¶
type Selector func(model.Selector, interpreter.Activation) bool
Selector functions take a compiled representation of a policy instance 'selector' and the input argument set to determine whether the policy instance is applicable to the current evaluation context.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package compiler contains a suite of tools for covering parsed representations of CEL Policy Template sources into type-checked and validated in-memory representations.
|
Package compiler contains a suite of tools for covering parsed representations of CEL Policy Template sources into type-checked and validated in-memory representations. |
|
Package limits defines the set of operational limits which developers may configure to control the compute and memory impact of the policies they support.
|
Package limits defines the set of operational limits which developers may configure to control the compute and memory impact of the policies they support. |
|
Package model contains abstract representations of policy template and instance config objects.
|
Package model contains abstract representations of policy template and instance config objects. |
|
Package parser defines the primary interfaces for parsing different data formats which can be represented within the CPT policy model.
|
Package parser defines the primary interfaces for parsing different data formats which can be represented within the CPT policy model. |
|
yml
Package yml defines tools for parsing and encoding CPT sources written in YAML.
|
Package yml defines tools for parsing and encoding CPT sources written in YAML. |
|
Package runtime implements the evaluation model for templates / instances.
|
Package runtime implements the evaluation model for templates / instances. |