Skip to content
RunningLake
Company Console ↗ Request early access
Contents: Reference

RUNNING

ColumnMask

A ColumnMask as RunningLake's configuration repository declares it, at policies/columnmasks/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.

File: policies/columnmasks/<name>.yaml

Fields

FieldTypeRequiredMeaning
apiVersion string Yes

The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version).

Values: runninglake.io/v1alpha1
kind string Yes

The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch).

Values: ColumnMask
metadata object Yes
No description
metadata.name string Yes

The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch).
metadata.labels map of string No
No description
metadata.annotations map of string No
No description
spec object No
No description
spec.on object No

On is the table the column is in: a layer, the schema in it when the table sits in one, and the table. A table nested deeper than a schema cannot be named yet.
spec.on.layer string No
No description
spec.on.schema string No
No description
spec.on.table string No
No description
spec.column string No

Column is the name of the column the mask is to cover, once something applies it, which nothing does yet, as the table spells it: letters, digits, underscore, hyphen and spaces between words (a dot would name a nested field, which cannot be masked yet). At most one mask covers a column, compared without regard to case. A column the table's declared schema does not have is refused, naming the columns it does have; a table that declares no schema (its columns come from the catalog) is not checked.
spec.function string No

Function is what a reader who is not exempt is to see in place of the value, once something applies it, which nothing does yet. A closed list, and today it holds one function: nullify, which is meant to read as NULL and needs no key. Others are added by the row that makes the engines apply them, each with its conformance case, which nullify does not have yet.
spec.exempt array of string No

Exempt lists the principals the mask does NOT apply to, each user:<email>, role:<one of the five roles> or team:<name>; everyone else is to see the masked value once something applies it, which nothing does yet. A user is an email address and a team a name, in plain characters: no wildcard. A team: principal matches nobody until teams exist and then exempts that team's members. A service or an agent has no form here, so the mask applies to it. Leave it out to mask for everyone.

A nested field is written with its parents, spec.a.b; an item of a list is [] and a value of a map is *. Required means the parent object must carry the field; the rules a schema cannot express, such as a field that is required only inside spec, are checked by rl diff.

The schema

This page is read from the kind’s published schema, at https://runninglake.com/schema/v1alpha1/columnmask.json. An editor that follows it checks a file of this kind as you type. To see the fields of a kind’s spec from the command line, run rl schema with the kind’s name: it works offline and prints what the gate accepts. The command reference has the rest.

All kinds