// Copyright 2018 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

// $title: RBAC
// $description: Adapter that exposes Istio's Role-Based Access Control model.
// $location: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/rbac.html
// $aliases:
// $  - /docs/reference/config/adapters/rbac.html

// The `rbac` adapter provides Role-Based Access Control (RBAC) functionality for
// for services within the Istio mesh.
//
// This adapter supports the [authorization template](https://istio.io/docs/reference/config/policy-and-telemetry/templates/authorization/).
package adapter.rbac.config;

import "google/protobuf/duration.proto";
import "gogoproto/gogo.proto";

option go_package="config";
option (gogoproto.goproto_getters_all) = false;
option (gogoproto.equal_all) = false;
option (gogoproto.gostring_all) = false;

// Configuration format for the `rbac` adapter.
//
// For example, the following configuration defines a RBAC handler with
// configuration store URL pointing to Kubernetes etcd ("k8s://").
// If you want to run Mixer locally, you can set the configuration store
// URL to a local directory (e.g., "fs:///tmp/testdata/configroot").
//
// ```yaml
// apiVersion: "config.istio.io/v1alpha2"
// kind: rbac
// metadata:
//   name: rbachandler
//   namespace: istio-system
// spec:
//   config_store_url: "fs:///tmp/testdata/config"
// ```
message Params {
  // URL for the config store. It is used to initiate a new Store instance.
  // Following are some examples of the config store URL:
  // * "k8s://"
  // * "fs:///tmp/testdata/configroot"
  string config_store_url = 1;

  // The duration for which authorization results may be cached.
  google.protobuf.Duration cache_duration = 2 [(gogoproto.nullable) = false, (gogoproto.stdduration) = true];
}
