https://github.com/grepplabs/casbin-kube
Kubernetes adapter for Casbin
https://github.com/grepplabs/casbin-kube
access-control acl auth authz autorization casbin casbin-adapter crd gitops k8s kubernetes rbac
Last synced: 27 days ago
JSON representation
Kubernetes adapter for Casbin
- Host: GitHub
- URL: https://github.com/grepplabs/casbin-kube
- Owner: grepplabs
- License: apache-2.0
- Created: 2025-09-28T23:08:31.000Z (6 months ago)
- Default Branch: main
- Last Pushed: 2026-02-16T09:55:00.000Z (about 1 month ago)
- Last Synced: 2026-02-16T17:58:35.890Z (about 1 month ago)
- Topics: access-control, acl, auth, authz, autorization, casbin, casbin-adapter, crd, gitops, k8s, kubernetes, rbac
- Language: Go
- Homepage:
- Size: 158 KB
- Stars: 2
- Watchers: 0
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Casbin Kube
====
[](https://github.com/grepplabs/casbin-kube/actions/workflows/ci.yml)
[](https://pkg.go.dev/github.com/grepplabs/casbin-kube)
[](https://github.com/grepplabs/casbin-kube/releases)
Casbin Kube is the [Kubernetes](https://kubernetes.io/) adapter for [Casbin](https://github.com/casbin/casbin). This library allows Casbin to load policies from Kubernetes and save policies back to it
The adapter integrates with the Kubernetes **Informer** mechanism to notify about policy changes.
## Kubernetes
You need to install the `rules.casbin.grepplabs.com` custom resource and grant access to this CRD
```
kubectl apply -k config/crds
kubectl apply -k config/rbac
```
or
```
helm install casbin-kube oci://ghcr.io/grepplabs/helm/casbin-kube:0.0.1
```
## Tools
### [casbin-kube-converter](tools/cmd/casbin-kube-converter/README.md)
## Installation
go get github.com/grepplabs/casbin-kube
## Usage Examples
### Sample data
```yaml
apiVersion: casbin.grepplabs.com/v1alpha1
kind: Rule
metadata:
name: rule-sample
spec:
ptype: "p"
v0: "alice"
v1: "data"
v2: "read"
```
### Policy editor / admin
```go
package main
import (
"github.com/casbin/casbin/v3"
casbinkube "github.com/grepplabs/casbin-kube"
)
func main() {
// Initialize a casbin kube adapter and use it in a Casbin enforcer:
kubeconfig := casbinkube.KubeConfig{}
a, _ := casbinkube.NewAdapter(&casbinkube.AdapterConfig{KubeConfig: kubeconfig})
e, _ := casbin.NewSyncedEnforcer("examples/rbac_model.conf", a)
// Load the policy from Kubernetes.
e.LoadPolicy()
// Check the permission.
e.Enforce("alice", "data1", "read")
// Modify the policy.
// e.AddPolicy(...)
// e.RemovePolicy(...)
// Save the policy back to Kubernetes.
e.SavePolicy()
}
```
### Policy reader / enforcer
Casbin provides a [watcher](https://casbin.org/docs/watchers) mechanism to maintain consistency between multiple Casbin enforcer instances.
Watchers can still be used with the adapter, but `Casbin Kube` natively supports the Kubernetes `Informer` mechanism to notify about policy changes,
which eliminates the need for a watcher.
The Informer will automatically disable auto-save (`e.EnableAutoSave(false)`) and auto-notify watcher (`e.EnableAutoNotifyWatcher(false)`).
```go
package main
import (
"context"
"os"
"os/signal"
"syscall"
"github.com/casbin/casbin/v3"
casbinkube "github.com/grepplabs/casbin-kube"
"github.com/grepplabs/loggo/zlog"
ctrl "sigs.k8s.io/controller-runtime"
)
func main() {
ctrl.SetLogger(zlog.Logger)
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
defer stop()
// Initialize a casbin kube adapter and use it in a Casbin enforcer:
kubeconfig := casbinkube.KubeConfig{}
a, _ := casbinkube.NewAdapter(&casbinkube.AdapterConfig{KubeConfig: kubeconfig})
e, _ := casbin.NewSyncedEnforcer("examples/rbac_model.conf", a)
i, _ := casbinkube.NewInformer(&casbinkube.InformerConfig{KubeConfig: kubeconfig}, e)
defer i.Close()
i.Start(ctx)
// Check the permission.
e.Enforce("alice", "data1", "read")
}
```