policy.example.yaml

rbac:
  roleresource:
    name: rolev2
    idprefix: permrv2
  rolebindingresource: 
    name: rolebinding
    idprefix: permrbn
  rolesubjecttypes:
    - user
    - client
  roleowners:
    - tenant
  rolebindingsubjects:
    - name: user
    - name: client
    - name: group
      subjectrelation: member

unions:
  - name: resourceowner
    resourcetypes:
      - name: tenant
  - name: resourcemanager
    resourcetypes:
      - name: tenant
      - name: group
  - name: subject
    resourcetypes:
      - name: user
      - name: client

resourcetypes:
  - name: user
    idprefix: idntusr
  - name: client
    idprefix: idntclt

  - name: role
    idprefix: permrol
    relationships:
      - relation: subject
        targettypes:
          - name: subject

  - name: tenant
    idprefix: tnntten
    rolebindingv2:
      &permsFromParent
      inheritpermissionsfrom:
        - parent
    relationships:
      - relation: parent
        targettypes:
          - name: tenant
      - &grantRel
        relation: grant
        targettypes:
          - name: rolebinding

  - name: group
    idprefix: idntgrp
    rolebindingv2:
      *permsFromParent
    relationships:
      - *grantRel
      - relation: parent
        targettypes:
          - name: group
          - name: tenant
      - relation: direct_member
        targettypes:
          - name: user
          - name: client
      - relation: subgroup
        targettypes:
          - name: group

  - name: loadbalancer
    idprefix: loadbal
    rolebindingv2:
      inheritpermissionsfrom:
        - owner
    relationships:
      - relation: owner
        targettypes:
          - name: resourceowner
      - relation: grant
        targettypes:
          - name: rolebinding

actions:
  - name: role_create
  - name: role_get
  - name: role_list
  - name: role_update
  - name: role_delete
  - name: loadbalancer_create
  - name: loadbalancer_get
  - name: loadbalancer_list
  - name: loadbalancer_update
  - name: loadbalancer_delete
  - name: member

actionbindings:
  # subgroup and group members
  - actionname: member
    typename: group
    conditions:
      - relationshipaction:
          relation: direct_member
      - relationshipaction:
          relation: subgroup
          actionname: member

  # role management - permissions on role
  - actionname: role_get
    typename: rolev2
    conditions:
      - relationshipaction:
          relation: owner
          actionname: role_get
  - actionname: role_update
    typename: rolev2
    conditions:
      - relationshipaction:
          relation: owner
          actionname: role_update
  - actionname: role_delete
    typename: rolev2
    conditions:
      - relationshipaction:
          relation: owner
          actionname: role_delete

  # role management - permissions on owners and managers
  - actionname: role_create
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: role_get
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: role_list
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: role_update
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: role_delete
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  # loadbalancer management - permissions on loadbalancer
  - actionname: loadbalancer_get
    typename: loadbalancer
    conditions:
      - rolebinding: {}
      - rolebindingv2: {}
  - actionname: loadbalancer_update
    typename: loadbalancer
    conditions:
      - rolebinding: {}
      - rolebindingv2: {}
  - actionname: loadbalancer_delete
    typename: loadbalancer
    conditions:
      - rolebinding: {}
      - rolebindingv2: {}

  # loadbalancer management - permissions on owners and managers
  - actionname: loadbalancer_create
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}
  
  - actionname: loadbalancer_get
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: loadbalancer_list
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: loadbalancer_update
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}

  - actionname: loadbalancer_delete
    typename: resourcemanager
    conditions:
      - rolebindingv2: {}
      - rolebinding: {}