Interface S2SDecisionSource

All Known Implementing Classes:
S2SConnectionLevelDecisionSource, S2SServiceLevelDecisionSource
public interface S2SDecisionSource
Pluggable decision source for the S2S AuthZ provider.

Two implementations exist: S2SConnectionLevelDecisionSource (the L2 deny-overlay GATE, evaluated on the cert SPIFFE-ID) and S2SServiceLevelDecisionSource (the L3b VERDICT, grant-capable, evaluated on the system-LAT sub SPIFFE-ID). Both are the integration point with the SRJ Cedar library.

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Interface
    Description
    static enum 
    S2SDecisionSource.Decision
     
    static final class 
    S2SDecisionSource.Result
    Outcome of evaluate(EvaluationInput), widened beyond the tri-state S2SDecisionSource.Decision with the diagnostic detail the observability layer needs: an outcome label (one of allow/deny/continue/abstain, layer-specific — see S2SConnectionLevelDecisionSource / S2SServiceLevelDecisionSource), and the SRJ Decision's determining policy IDs (reasons) and passName, when the underlying SRJ authorizer actually ran (both are empty when no authorizer is installed, i.e.

  • Method Summary

    Modifier and Type
    Method
    Description
    S2SDecisionSource.Result
    evaluate(EvaluationInput input)
     
    default void
    reload()
    Dynamic-reload lifecycle hook invoked on every config reload, AFTER the backing store has swapped in the new snapshot.
    default void
    start()
    Cold-start lifecycle hook invoked once at broker/controller startup AFTER the config snapshot has been loaded into any backing store.

  • Method Details

    • evaluate

      S2SDecisionSource.Result evaluate(EvaluationInput input)

    • start

      default void start()
      Cold-start lifecycle hook invoked once at broker/controller startup AFTER the config snapshot has been loaded into any backing store. Implementations pre-build/validate state (e.g., hand policies to an underlying evaluator).

      Fail-closed: a present-but-unbuildable policy set MUST throw here so broker startup fails. A fresh process has no last-good state to fall back on, so coming up with enforcement silently disabled/degraded is not an option. Default is no-op.

    • reload

      default void reload()
      Dynamic-reload lifecycle hook invoked on every config reload, AFTER the backing store has swapped in the new snapshot. Unlike start(), a build failure here MUST NOT throw: the broker is already serving, so it keeps the last-good state in place rather than being taken down by a bad live update (which validateReconfiguration() should have rejected upstream anyway). Default is no-op.