Documentation
¶
Index ¶
- Constants
- func DiscoverKubernetesOIDCConfig(token, audienceOverride string) (string, string, error)
- func ExtractNodeNameFromSAToken(token string) (string, error)
- func GenerateHMACKey() ([]byte, error)
- type Claims
- type KubernetesOIDCVerifier
- type KubernetesServiceAccountIdentity
- type KubernetesTokenReviewVerifier
- type PodBoundTokenVerifier
- type PodBoundTokenVerifierOptions
- type TokenIssuer
- func (ti *TokenIssuer) IssueNodeToken(subject, nodeName string, lifetime time.Duration) (string, time.Time, error)
- func (ti *TokenIssuer) IssueViewerToken(subject string, groups []string, lifetime time.Duration) (string, time.Time, error)
- func (ti *TokenIssuer) Validate(tokenStr string) (*Claims, error)
Constants ¶
const ( // RoleNode is the role for node agent tokens. RoleNode = "node" // RoleViewer is the role for viewer tokens. RoleViewer = "viewer" // HMACKeySize is the minimum key size in bytes for HMAC-SHA256 signing. HMACKeySize = 32 )
Variables ¶
This section is empty.
Functions ¶
func DiscoverKubernetesOIDCConfig ¶ added in v0.9.0
DiscoverKubernetesOIDCConfig reads discovery hints from the controller's own trusted, mounted service account token. It must not be used on client tokens.
func ExtractNodeNameFromSAToken ¶
ExtractNodeNameFromSAToken decodes the node binding without verifying the JWT.
func GenerateHMACKey ¶
GenerateHMACKey returns HMACKeySize cryptographically random bytes suitable for use as an HMAC signing key.
Types ¶
type Claims ¶
type Claims struct {
Subject string `json:"sub"` // e.g. "system:serviceaccount:unbounded-net:unbounded-net-node"
Role string `json:"role"` // "node" or "viewer"
NodeName string `json:"node,omitempty"` // node name (node tokens only)
Groups []string `json:"groups,omitempty"` // user groups (for SAR checks)
IssuedAt int64 `json:"iat"` // Unix timestamp
ExpiresAt int64 `json:"exp"` // Unix timestamp
}
Claims holds the payload of an HMAC-signed token.
type KubernetesOIDCVerifier ¶ added in v0.9.0
type KubernetesOIDCVerifier struct {
// contains filtered or unexported fields
}
KubernetesOIDCVerifier validates Kubernetes service account JWTs locally using the cluster issuer's OIDC discovery document and JWKS.
func NewKubernetesOIDCVerifier ¶ added in v0.9.0
func NewKubernetesOIDCVerifier(ctx context.Context, issuerURL, audience string) (*KubernetesOIDCVerifier, error)
NewKubernetesOIDCVerifier initializes a verifier and loads its signing keys.
func (*KubernetesOIDCVerifier) Verify ¶ added in v0.9.0
func (v *KubernetesOIDCVerifier) Verify(ctx context.Context, tokenString string) (*KubernetesServiceAccountIdentity, error)
Verify validates a service account JWT and returns its authenticated node identity.
type KubernetesServiceAccountIdentity ¶ added in v0.9.0
type KubernetesServiceAccountIdentity struct {
Subject string
Namespace string
ServiceAccountName string
ServiceAccountUID string
PodName string
PodUID string
NodeName string
}
KubernetesServiceAccountIdentity is the authenticated identity and node binding carried by a Kubernetes service account token.
func DecodeKubernetesServiceAccountIdentity ¶ added in v0.9.0
func DecodeKubernetesServiceAccountIdentity(token string) (*KubernetesServiceAccountIdentity, error)
DecodeKubernetesServiceAccountIdentity decodes Kubernetes service account claims without verifying the JWT signature. Callers must authenticate the exact token through another trusted mechanism before using the result.
type KubernetesTokenReviewVerifier ¶ added in v0.9.0
type KubernetesTokenReviewVerifier struct {
// contains filtered or unexported fields
}
KubernetesTokenReviewVerifier authenticates service account tokens through Kubernetes before trusting their embedded node identity.
func NewKubernetesTokenReviewVerifier ¶ added in v0.9.0
func NewKubernetesTokenReviewVerifier(client authenticationclient.AuthenticationV1Interface) *KubernetesTokenReviewVerifier
NewKubernetesTokenReviewVerifier creates a verifier using the Kubernetes TokenReview API.
func (*KubernetesTokenReviewVerifier) Verify ¶ added in v0.9.0
func (v *KubernetesTokenReviewVerifier) Verify(ctx context.Context, token string) (*KubernetesServiceAccountIdentity, error)
type PodBoundTokenVerifier ¶ added in v0.9.0
type PodBoundTokenVerifier struct {
// contains filtered or unexported fields
}
PodBoundTokenVerifier checks bound objects after cryptographic verification. It deliberately supports only Pod-bound node agents, not every Kubernetes service account token type, and never caches an authorization decision.
func NewPodBoundTokenVerifier ¶ added in v0.9.0
func NewPodBoundTokenVerifier(verifier interface {
Verify(context.Context, string) (*KubernetesServiceAccountIdentity, error)
}, options PodBoundTokenVerifierOptions,
) *PodBoundTokenVerifier
NewPodBoundTokenVerifier decorates an OIDC verifier, not a TokenReview verifier.
func (*PodBoundTokenVerifier) Verify ¶ added in v0.9.0
func (v *PodBoundTokenVerifier) Verify(ctx context.Context, token string) (*KubernetesServiceAccountIdentity, error)
Verify authenticates the token and rechecks its Pod and service account in the caches on every request, including when the signing keys are already cached.
type PodBoundTokenVerifierOptions ¶ added in v0.9.0
type PodBoundTokenVerifierOptions struct {
Namespace string
ServiceAccount string
Pods corelisters.PodLister
ServiceAccounts corelisters.ServiceAccountLister
Ready func() bool
}
PodBoundTokenVerifierOptions supplies process-lifetime informer caches. Ready must reject unsynced or stopped caches. Informer reads are eventually consistent, not a strongly consistent substitute for TokenReview.
type TokenIssuer ¶
type TokenIssuer struct {
// contains filtered or unexported fields
}
TokenIssuer generates and validates HMAC-signed tokens.
func NewTokenIssuer ¶
func NewTokenIssuer(hmacKey []byte) (*TokenIssuer, error)
NewTokenIssuer creates a TokenIssuer after validating that the key is at least HMACKeySize bytes.
func (*TokenIssuer) IssueNodeToken ¶
func (ti *TokenIssuer) IssueNodeToken(subject, nodeName string, lifetime time.Duration) (string, time.Time, error)
IssueNodeToken creates an HMAC-signed token with RoleNode and the given node name. It returns the token string, its expiry time, and any error.
func (*TokenIssuer) IssueViewerToken ¶
func (ti *TokenIssuer) IssueViewerToken(subject string, groups []string, lifetime time.Duration) (string, time.Time, error)
IssueViewerToken creates an HMAC-signed token with RoleViewer. It returns the token string, its expiry time, and any error. Groups are included in the token claims so downstream SAR checks can evaluate group-based RBAC.
Source Files