Expiration of Authz Policies

[erictune]

Add expiration time/date field to type policy in pkg/auth/authorizer/abac/abac.go and to the match() function there.

[derekwaynecarr]

Just wondering if we will use expiration TTL in etcd for this?

[erictune]

The policy object will have an expiration date in it. Whether we use etcd
TTL or our own GC is not something I had given thought. In any case we
might want to keep the objects around after authorization expiry for
debugging so there need to be two kinds of expiration dates.
On Nov 7, 2014 8:06 AM, "Derek Carr" notifications@github.com wrote:

Just wondering if we will use expiration TTL in etcd for this?

—
Reply to this email directly or view it on GitHub
#2204 (comment)
.

[erictune]

I should have also said that the authorizer would verify the expiration
date explicitly rather than relying on absence in storage.
On Nov 7, 2014 8:53 AM, "Eric Tune" etune@google.com wrote:

The policy object will have an expiration date in it. Whether we use etcd
TTL or our own GC is not something I had given thought. In any case we
might want to keep the objects around after authorization expiry for
debugging so there need to be two kinds of expiration dates.
On Nov 7, 2014 8:06 AM, "Derek Carr" notifications@github.com wrote:

Just wondering if we will use expiration TTL in etcd for this?

—
Reply to this email directly or view it on GitHub
#2204 (comment)
.

[liggitt]

closing for lack of movement. could be implemented on top of RBAC with a binding-removing controller, or via a webhook authorizer.