Help us shape the future of Go! Take the 2026 Go Developer Survey

aclmodels

package
v1.25.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: Apache-2.0 Imports: 8 Imported by: 3

Documentation

Index

Constants

View Source 
const (
	VerbRead     = aclcaps.VerbRead
	VerbWrite    = aclcaps.VerbWrite
	VerbCreate   = aclcaps.VerbCreate
	VerbUpdate   = aclcaps.VerbUpdate
	VerbDelete   = aclcaps.VerbDelete
	VerbAdmin    = aclcaps.VerbAdmin
	VerbLogon    = aclcaps.VerbLogon
	VerbOwner    = aclcaps.VerbOwner
	VerbReadonly = aclcaps.VerbReadonly
)

Well-known verbs.

View Source 
const (
	CapRor              = aclcaps.CapRor
	CapRorMetadata      = aclcaps.CapRorMetadata
	CapRorVulnerability = aclcaps.CapRorVulnerability
	CapRorConfig        = aclcaps.CapRorConfig

	CapKubernetes              = aclcaps.CapKubernetes
	CapKubernetesArgocd        = aclcaps.CapKubernetesArgocd
	CapKubernetesArgocdProject = aclcaps.CapKubernetesArgocdProject
	CapKubernetesGrafana       = aclcaps.CapKubernetesGrafana

	CapVirtualmachine = aclcaps.CapVirtualmachine
)

Well-known capabilities (without verb).

Variables

This section is empty.

Functions

func ValidScope added in v1.19.0 

func ValidScope(scope aclscope.Scope) error

ValidScope checks if a scope is either a known resource kind or a known system. System scopes (e.g. "ror", "all", "spam") are owned by the aclscope package; resource kinds are resolved at runtime from rordefs.Resourcedefs.

func ValidateACLEntry added in v1.19.0 

func ValidateACLEntry(entry AclV3ListItem) error

ValidateACLEntry validates the scope and all access entries of an AclV3ListItem.

func ValidateAccess added in v1.19.0 

func ValidateAccess(access AccessTypeV3) error

ValidateAccess validates that an AccessTypeV3 string follows the system:component:verb convention and that the path and verb are registered in the capability registry.

Types

type AccessType 

type AccessType string
const (
	AccessTypeRead             AccessType = "read"
	AccessTypeCreate           AccessType = "create"
	AccessTypeUpdate           AccessType = "update"
	AccessTypeDelete           AccessType = "delete"
	AccessTypeOwner            AccessType = "owner"
	AccessTypeRorMetadata      AccessType = "rormetadata"
	AccessTypeRorVulnerability AccessType = "rorvulnerability"
	AccessTypeClusterLogon     AccessType = "clusterlogon"
)

func ParseAcl2AccessType added in v1.18.8 

func ParseAcl2AccessType(access string) (AccessType, bool)

type AccessTypeV3 added in v1.16.0 

type AccessTypeV3 = aclcaps.AccessTypeV3

Capability, Verb and AccessTypeV3 live in the aclcaps leaf package so they can be shared with rordefs without an import cycle. They are aliased here so the existing aclmodels.* API is unchanged. 

const (
	AccessRorRead  AccessTypeV3 = "ror:read"
	AccessRorWrite AccessTypeV3 = "ror:write"
	AccessRorOwner AccessTypeV3 = "ror:owner"

	AccessRorMetadataWrite      AccessTypeV3 = "ror:metadata:write"
	AccessRorVulnerabilityRead  AccessTypeV3 = "ror:vulnerability:read"
	AccessRorVulnerabilityWrite AccessTypeV3 = "ror:vulnerability:write"

	AccessRorConfigRead  AccessTypeV3 = "ror:config:read"
	AccessRorConfigWrite AccessTypeV3 = "ror:config:write"
)

Access type constants for the ror system 

const (
	AccessKubernetesLogon    AccessTypeV3 = "kubernetes:logon"
	AccessKubernetesAdmin    AccessTypeV3 = "kubernetes:admin"
	AccessKubernetesReadonly AccessTypeV3 = "kubernetes:readonly"

	AccessKubernetesArgocdAdmin        AccessTypeV3 = "kubernetes:argocd:admin"
	AccessKubernetesArgocdProjectAdmin AccessTypeV3 = "kubernetes:argocd:project:admin"
	AccessKubernetesGrafanaAdmin       AccessTypeV3 = "kubernetes:grafana:admin"
)

Access type constants for kubernetes 

const (
	AccessVirtualmachineDelete AccessTypeV3 = "virtualmachine:delete"
)

Access type constants for virtual machines

func AccessTypeV2ToV3 added in v1.24.0 

func AccessTypeV2ToV3(at AccessType) (AccessTypeV3, bool)

AccessTypeV2ToV3 converts a single V2 AccessType to its V3 AccessTypeV3 equivalent. The bool is false for access types that have no V3 representation (e.g. AccessTypeRorMetadata, AccessTypeRorVulnerability).

func CompileAccess added in v1.19.0 

func CompileAccess(entries []AclV3ListItem, scope aclscope.Scope, subject aclscope.Subject) []AccessTypeV3

CompileAccess merges access from multiple ACL entries that match the given scope and subject, returning the union of all granted access types.

func MergeAccess added in v1.19.0 

func MergeAccess(a, b []AccessTypeV3) []AccessTypeV3

MergeAccess returns the union of two access slices, deduplicated.

func ParseAccessTypeV3 added in v1.25.0 

func ParseAccessTypeV3(s string) (AccessTypeV3, error)

ParseAccessTypeV3 casts a string to an AccessTypeV3 and validates it against the access tree.

type Acl3LookupByScopeSubjectAccessGroup added in v1.24.0 

type Acl3LookupByScopeSubjectAccessGroup struct {
	Access AccessTypeV3 `json:"access"`
	Group  string       `json:"group"`
	// Provenance lists every resource in the tree (the queried resource and/or
	// its ancestors) on which this group has this access, one entry per level.
	Provenance []Acl3LookupProvenance `json:"provenance"`
}

type Acl3LookupByScopeSubjectResponse added in v1.24.0 

type Acl3LookupByScopeSubjectResponse struct {
	Scope      aclscope.Scope                        `json:"scope"`
	Subject    aclscope.Subject                      `json:"subject"`
	AccesGroup []Acl3LookupByScopeSubjectAccessGroup `json:"accessGroups"`
}

type Acl3LookupProvenance added in v1.24.1 

type Acl3LookupProvenance struct {
	Scope   aclscope.Scope   `json:"scope"`
	Subject aclscope.Subject `json:"subject"`
	Level   int              `json:"level"`
}

Acl3LookupProvenance is a single resource a grant is defined on. Level 0 is the queried resource itself; level 1 is its immediate parent, level 2 its grandparent, and so on.

type AclLookupResponse added in v1.18.8 

type AclLookupResponse struct {
	Scopes map[aclscope.Scope]AclLookupResponseScope `json:"scopes"`
}

type AclLookupResponseScope added in v1.18.8 

type AclLookupResponseScope struct {
	Subject map[aclscope.Subject]AclV2ListItemAccess `json:"subject"`
}

type AclV2ListItem 

type AclV2ListItem struct {
	Id         string                  `json:"id" bson:"_id,omitempty"`                   // Id
	Version    int                     `json:"version" default:"2" validate:"eq=2" `      // Acl Version, must be 2
	Group      string                  `json:"group" validate:"required,min=1,rortext" `  // The group which the acces is granted
	Scope      aclscope.Scope          `json:"scope" validate:"required,min=1,rortext"`   // Type of object ['cluster','project']
	Subject    aclscope.Subject        `json:"subject" validate:"required,min=1,rortext"` // The subject eg. clusterid, projectid (can be 'All')
	Access     AclV2ListItemAccess     `json:"access" validate:"required"`                // v2 access model for ror api
	Kubernetes AclV2ListItemKubernetes `json:"kubernetes" validate:""`                    // v2 access model for kubernetes
	Created    time.Time               `json:"created"`
	IssuedBy   string                  `json:"issuedBy,omitempty" validate:"email"` // expects an email
}

Full acl v2 model

func NewAclV2ListItem added in v1.11.0 

func NewAclV2ListItem(group string,
	scope aclscope.Scope,
	subject aclscope.Subject,
	access AclV2ListItemAccess,
	kubernetesLogon bool,
	issuedBy string,
) *AclV2ListItem

func V3ListToV2List added in v1.24.0 

func V3ListToV2List(v3list AclV3List) []AclV2ListItem

func V3ToV2 added in v1.19.0 

func V3ToV2(v3 AclV3ListItem) AclV2ListItem

V3ToV2 converts a V3 ACL entry to a V2 representation. Only V3 access types that have a corresponding v3 struct tag on the V2 struct are mapped. V3-only capabilities (e.g. "kubernetes:admin", "ror:config:read") are silently dropped since V2 has no way to represent them.

type AclV2ListItemAccess 

type AclV2ListItemAccess struct {
	Read            bool `json:"read" validate:"boolean" v3:"ror:read"`     // Read metadata of subject
	Create          bool `json:"create" validate:"boolean" v3:"ror:create"` // Write metadata of subject
	Update          bool `json:"update" validate:"boolean" v3:"ror:update"` // Update metadata of subject
	Delete          bool `json:"delete" validate:"boolean" v3:"ror:delete"` // Delete metadata of subject
	Owner           bool `json:"owner" validate:"boolean" v3:"ror:owner"`   // Delete metadata of subject
	KubernetesLogon bool `json:"kuberneteslogon" validate:"boolean"`        // Logon to cluster
}

v2 access model for ror api

func NewAclV2ListItemAccess added in v1.11.0 

func NewAclV2ListItemAccess(read, create, update, delete, owner bool) AclV2ListItemAccess

NewAclV2ListItemAccess construct a new AclV2ListItemAccess object.

func NewAclV2ListItemAccessAll added in v1.11.0 

func NewAclV2ListItemAccessAll() AclV2ListItemAccess

NewAclV2ListItemAccessAll gives you Read, Create, Update, Delete, and Owner access.

func NewAclV2ListItemAccessContributor added in v1.11.0 

func NewAclV2ListItemAccessContributor() AclV2ListItemAccess

NewAclV2ListItemAccessContributor gives you Read, Create, and Update access.

func NewAclV2ListItemAccessCreateOnly added in v1.11.0 

func NewAclV2ListItemAccessCreateOnly() AclV2ListItemAccess

NewAclV2ListItemAccessCreateOnly gives you Read and Create access.

func NewAclV2ListItemAccessEditor added in v1.11.0 

func NewAclV2ListItemAccessEditor() AclV2ListItemAccess

NewAclV2ListItemAccessEditor gives you Read and Update access.

func NewAclV2ListItemAccessOperator added in v1.11.0 

func NewAclV2ListItemAccessOperator() AclV2ListItemAccess

NewAclV2ListItemAccessContributor gives you Read, Create, Update, and Delete access.

func NewAclV2ListItemAccessReadOnly added in v1.11.0 

func NewAclV2ListItemAccessReadOnly() AclV2ListItemAccess

NewAclV2ListItemAccessReadOnly gives you Read access.

func (AclV2ListItemAccess) HasAccessType added in v1.18.8 

func (a AclV2ListItemAccess) HasAccessType(at AccessType) bool

type AclV2ListItemKubernetes 

type AclV2ListItemKubernetes struct {
	Logon bool `json:"logon,omitempty" validate:"boolean" v3:"kubernetes:logon"` // Logon to subject if 'cluster'
}

v2 access model for kubernetes

type AclV2ListItems 

type AclV2ListItems struct {
	Scope   aclscope.Scope      // Type of object ['cluster','project']
	Subject aclscope.Subject    // The subject eg. clusterid, projectid (can be 'All')
	Global  AclV2ListItemAccess //If global access granted
	Items   []AclV2ListItem     // v2 access model for ror api
}

type AclV3List added in v1.24.0 

type AclV3List []AclV3ListItem

func (AclV3List) ByGroup added in v1.24.0 

func (a AclV3List) ByGroup() AclV3ListByGroup

func (AclV3List) ByScopeSubject added in v1.24.0 

func (a AclV3List) ByScopeSubject() AclV3ListByScopeSubject

func (AclV3List) Filter added in v1.24.0 

func (l AclV3List) Filter(keep func(AclV3ListItem) bool) AclV3List

Filter returns a new list containing the entries for which keep returns true.

func (AclV3List) FilterScopeSubject added in v1.24.0 

func (l AclV3List) FilterScopeSubject(scope aclscope.Scope, subject aclscope.Subject) AclV3List

FilterScopeSubject returns the entries that apply to the given scope and subject: exact scope+subject, the "all" scope/subject wildcards, or a ror-scoped grant whose subject is the queried scope or the global subject. Scope and subject must be in Kind form (as stored).

func (AclV3List) Page added in v1.24.0 

func (l AclV3List) Page(offset, limit int) AclV3List

Page returns the offset/limit window of the list. A limit <= 0 returns all entries from offset onward. It returns a sub-slice of the receiver (no copy), so callers should page a list they own (e.g. the result of Sorted or Filter).

func (AclV3List) Sorted added in v1.24.0 

func (l AclV3List) Sorted(field string, asc bool) AclV3List

Sorted returns a sorted copy ordered by the given field, with the entry id as a unique tiebreaker so the order is a stable total order. The receiver is never mutated. Unknown fields sort by id only.

func (AclV3List) ToV2LookupResponse added in v1.24.0 

func (a AclV3List) ToV2LookupResponse() AclLookupResponse

ToV2LookupResponse groups the entries by scope+subject and converts each group to the legacy V2 AclLookupResponse. Callers filter the list beforehand. kubernetes:logon is surfaced on the Access model's KubernetesLogon field, since the response carries AclV2ListItemAccess (not the Kubernetes struct).

type AclV3ListByGroup added in v1.24.0 

type AclV3ListByGroup map[string]AclV3List

func (AclV3ListByGroup) Flatten added in v1.24.0 

func (a AclV3ListByGroup) Flatten() AclV3List

type AclV3ListByScopeSubject added in v1.24.0 

type AclV3ListByScopeSubject map[aclscope.Scope]map[aclscope.Subject]AclV3List

type AclV3ListItem added in v1.16.0 

type AclV3ListItem struct {
	Id       string           `json:"id" bson:"_id,omitempty"`
	Version  int              `json:"version" default:"3" validate:"eq=3"`
	Group    string           `json:"group" validate:"required,min=1,rortext"`
	Scope    aclscope.Scope   `json:"scope" validate:"required,min=1,rortext"`
	Subject  aclscope.Subject `json:"subject" validate:"required,min=1,rortext"`
	Access   []AccessTypeV3   `json:"access" bson:"access" validate:"required"`
	Created  time.Time        `json:"created"`
	IssuedBy string           `json:"issuedBy,omitempty" validate:"email"`
}

AclV3ListItem is the full ACL v3 model.

Scope is a resource kind or system identifier. Subject is the name/id of the object, e.g. clusterid, projectid, "All". Access is a list of granted capabilities — presence means granted, absence means denied.

Example: 

Group: "dev-team", Scope: "KubernetesCluster", Subject: "prod-cluster-1",
Access: ["ror:read", "ror:write", "kubernetes:logon", "ror:config:read"]

func V2ToV3 added in v1.19.0 

func V2ToV3(v2 AclV2ListItem) AclV3ListItem

V2ToV3 converts a V2 ACL entry to a V3 representation. The V3 access list is derived from the v3 struct tags on AclV2ListItemAccess and AclV2ListItemKubernetes. Only boolean fields that are true are included. V3 capabilities that have no V2 equivalent (e.g. "kubernetes:admin") cannot be represented and are absent from the result.

func (AclV3ListItem) FieldValue added in v1.24.0 

func (i AclV3ListItem) FieldValue(field string) string

FieldValue returns the string value of a top-level field by its json/bson name, used for sorting and filtering. Unknown fields return "" (so a filter on an absent field matches nothing, mirroring the storage query behavior).

func (*AclV3ListItem) HasAccess added in v1.19.0 

func (a *AclV3ListItem) HasAccess(access AccessTypeV3) bool

HasAccess checks if the given access type is granted in this ACL entry.

type AclV3LookupOwnerref added in v1.20.2 

type AclV3LookupOwnerref struct {
	Scope   aclscope.Scope   `json:"scope"`
	Subject aclscope.Subject `json:"subject"`
}

AclV3LookupOwnerref is a single scope+subject pair the caller has access to.

type AclV3LookupResponse added in v1.20.2 

type AclV3LookupResponse struct {
	Access       AccessTypeV3          `json:"access"`
	Unrestricted bool                  `json:"unrestricted"`
	Ownerrefs    []AclV3LookupOwnerref `json:"ownerrefs"`
}

AclV3LookupResponse is the response for GET /v2/acl/lookup. It lists the scope+subject pairs the caller has the requested access type for, resolved through the V3 ACL backend. When Unrestricted is true the caller has global access for the requested access type and Ownerrefs is empty.

type Capability added in v1.19.0 

type Capability = aclcaps.Capability

Capability, Verb and AccessTypeV3 live in the aclcaps leaf package so they can be shared with rordefs without an import cycle. They are aliased here so the existing aclmodels.* API is unchanged.

type Verb added in v1.19.0 

type Verb = aclcaps.Verb

Capability, Verb and AccessTypeV3 live in the aclcaps leaf package so they can be shared with rordefs without an import cycle. They are aliased here so the existing aclmodels.* API is unchanged.

Source Files

View all Source files

Directories

Path Synopsis
Package aclcaps holds the low-level capability, verb and access-type primitives shared by aclmodels and rordefs.
 Package aclcaps holds the low-level capability, verb and access-type primitives shared by aclmodels and rordefs.
Package aclprincipal builds the ROR-owned group names that identify principals (clusters, services, service accounts) in ACL grants.
 Package aclprincipal builds the ROR-owned group names that identify principals (clusters, services, service accounts) in ACL grants.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.