Skip to content
RunningLake
Company Console ↗ Request early access
Contents: Reference

RUNNING

RowFilter

A RowFilter as RunningLake's configuration repository declares it, at policies/rowfilters/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.

File: policies/rowfilters/<name>.yaml

Fields

FieldTypeRequiredMeaning
apiVersion string Yes

The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version).

Values: runninglake.io/v1alpha1
kind string Yes

The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch).

Values: RowFilter
metadata object Yes
No description
metadata.name string Yes

The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch).
metadata.labels map of string No
No description
metadata.annotations map of string No
No description
spec object No
No description
spec.on object No

On is the table the filter is to cover, once something applies it, which nothing does yet: a layer, the schema in it when the table sits in one, and the table. Structured, never a dotted string, and the same names a Grant's target uses. A table nested deeper than a schema cannot be named yet.
spec.on.layer string No
No description
spec.on.schema string No
No description
spec.on.table string No
No description
spec.predicate string No

Predicate is a boolean expression over the table's own columns; a row is to be read only where it is true, once something applies it, which nothing does yet. It is recorded as written. A change set's SQL dialect check reads its form when it is committed (one expression over the table's own columns, inside the restricted dialect), and nothing yet reads its meaning, so a mistake in what it selects is found when a policy compiler first applies it.
spec.exempt array of string No

Exempt lists the principals the filter does NOT apply to, each user:<email>, role:<one of the five roles> or team:<name>; everyone else is to be filtered once something enforces it, which nothing does yet. A user is an email address and a team a name, in plain characters: no wildcard. A team: principal matches nobody until teams exist and then exempts that team's members. A service or an agent has no form here, so the filter applies to it. Leave it out to filter everyone.

A nested field is written with its parents, spec.a.b; an item of a list is [] and a value of a map is *. Required means the parent object must carry the field; the rules a schema cannot express, such as a field that is required only inside spec, are checked by rl diff.

The schema

This page is read from the kind’s published schema, at https://runninglake.com/schema/v1alpha1/rowfilter.json. An editor that follows it checks a file of this kind as you type. To see the fields of a kind’s spec from the command line, run rl schema with the kind’s name: it works offline and prints what the gate accepts. The command reference has the rest.

All kinds