Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

chore: improve rbac and add benchmark tooling#18584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
ssncferreira merged 9 commits intomainfromssncferreira/chore-rbac-improvements
Jun 27, 2025

Conversation

ssncferreira
Copy link
Contributor

@ssncferreirassncferreira commentedJun 25, 2025•
edited
Loading

Description

This PR improves the RBAC package by refactoring the policy, enhancing documentation, and adding utility scripts.

Changes

  • Refactoredpolicy.rego for clarity and readability
  • Updated README with OPA section
  • Addedbenchmark_authz.sh script for authz performance testing and comparison
  • Addedgen_input.go to generate input foropa eval testing

@ssncferreirassncferreira changed the titlechore: rbac improvements and benchmark toolingchore: improve rbac and add benchmark toolingJun 25, 2025
@ssncferreirassncferreiraforce-pushed thessncferreira/chore-rbac-improvements branch 2 times, most recently fromca7deed toc1fe8e3CompareJune 25, 2025 19:26
@ssncferreirassncferreiraforce-pushed thessncferreira/chore-rbac-improvements branch fromc1fe8e3 to29222a1CompareJune 26, 2025 09:29
@ssncferreirassncferreira marked this pull request as ready for reviewJune 26, 2025 10:06
Copy link
Member

@johnstcnjohnstcn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Wow! Thanks for all of the work you put into this!

Out of curiousity, I wonder if your changes to the policy had any measurable benchmark difference? I would assume that it remains basically the same, but it could be interesting to see the benchmark results now that we have the tools 😁

@ssncferreira
Copy link
ContributorAuthor

Wow! Thanks for all of the work you put into this!

Thank you! 🫶 I had some of these things stashed and thought they would be a good addition for future reference.

Out of curiousity, I wonder if your changes to the policy had any measurable benchmark difference? I would assume that it remains basically the same, but it could be interesting to see the benchmark results now that we have the tools 😁

I was a bit worried about breaking something 😅 so I ran the tests yesterday, it was slightly better, but nothing significantly different:

  • RBACAuthorize: -2.23%
  • RBACAuthorizeGroups: +0.18%
  • RBACFilter: -1.29%

benchstat results attached for reference:

Copy link
Member

@EmyrkEmyrk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This is all excellent!

Comment on lines -34 to 40
bool_flip(b) :=flipped if {
bool_flip(b) :=false if {
b
flipped = false
}

bool_flip(b) :=flipped if {
bool_flip(b) :=true if {
not b
flipped = true
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Very nice 👍

ssncferreira reacted with heart emoji
Comment on lines -53 to 61
number(set) := c if {
# Return -1 if the set contains any 'false' value (i.e., an explicit deny)
number(set) := -1 if {
false in set
c := -1
}

number(set) := c if {
# Return 0 if the set is empty (no matching permissions)
number(set) := 0 if {
count(set) == 0
}

# Return 1 if the set is non-empty and contains no 'false' values (i.e., only allows)
number(set) := 1 if {
not false in set
set[_]
c := 1
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

👍

Comment on lines 44 to 45
// TODO: support arguments for subject, action and object
funcmain() {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

totally fine to start with this 👍

ssncferreira reacted with thumbs up emoji
@ssncferreirassncferreira merged commit3cb9b20 intomainJun 27, 2025
35 checks passed
@ssncferreirassncferreira deleted the ssncferreira/chore-rbac-improvements branchJune 27, 2025 11:05
@github-actionsgithub-actionsbot locked and limited conversation to collaboratorsJun 27, 2025
Sign up for freeto subscribe to this conversation on GitHub. Already have an account?Sign in.
Reviewers

@johnstcnjohnstcnjohnstcn left review comments

@EmyrkEmyrkEmyrk approved these changes

Assignees

@ssncferreirassncferreira

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

3 participants
@ssncferreira@johnstcn@Emyrk
[8]ページ先頭
©2009-2025 Movatter.jp