Documentation
¶
Overview ¶
Package ateapiauth authenticates clients of the ateapi gRPC server, and provides a matching client dial helper. The server interceptor takes identity from the transport-layer mTLS credentials when the client presented a certificate, and otherwise requires an authorization header `Bearer <JWT Token>`. Requests with no credentials are rejected.
Index ¶
- Constants
- func DialOptions(cfg ClientConfig) ([]grpc.DialOption, error)
- func StreamServerInterceptor(cfg ServerConfig) grpc.StreamServerInterceptor
- func UnaryServerInterceptor(cfg ServerConfig) grpc.UnaryServerInterceptor
- func ValidateAuthenticationConfig(cfg *AuthenticationConfig) error
- func ValidateServerConfig(cfg ServerConfig) error
- type AuthenticationConfig
- type ClientConfig
- type JWTProvider
- type JWTProviderConfig
- type ServerConfig
Constants ¶
const DefaultServiceAccountCAFile = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
Variables ¶
This section is empty.
Functions ¶
func DialOptions ¶
func DialOptions(cfg ClientConfig) ([]grpc.DialOption, error)
DialOptions returns the grpc.DialOption set described by cfg, suitable to pass to grpc.NewClient.
func StreamServerInterceptor ¶
func StreamServerInterceptor(cfg ServerConfig) grpc.StreamServerInterceptor
StreamServerInterceptor returns a gRPC stream interceptor enforcing cfg.
func UnaryServerInterceptor ¶
func UnaryServerInterceptor(cfg ServerConfig) grpc.UnaryServerInterceptor
UnaryServerInterceptor returns a gRPC unary interceptor enforcing cfg.
func ValidateAuthenticationConfig ¶
func ValidateAuthenticationConfig(cfg *AuthenticationConfig) error
ValidateAuthenticationConfig validates fields that do not require I/O.
func ValidateServerConfig ¶
func ValidateServerConfig(cfg ServerConfig) error
Types ¶
type AuthenticationConfig ¶
type AuthenticationConfig struct {
ActorIdentityJWTProvider string `json:"actorIdentityJWTProvider"`
JWTProviders []JWTProviderConfig `json:"jwtProviders"`
}
AuthenticationConfig configures JWT authentication for ateapi.
func LoadAuthenticationConfig ¶
func LoadAuthenticationConfig(path string) (*AuthenticationConfig, error)
LoadAuthenticationConfig strictly parses and validates a YAML or JSON file.
type ClientConfig ¶
type ClientConfig struct {
// CAFile is a PEM file containing CA certs that sign the server cert.
// Required.
CAFile string
// ServerName overrides SNI / hostname verification. Optional.
ServerName string
// ClientCredBundle is a PEM file containing the client certificate chain
// and PKCS8 private key presented to the server. Required.
ClientCredBundle string
// K8sClient is an optional Kubernetes client. When provided, an EndpointSlice
// resolver builder using this client will be attached to DialOptions.
K8sClient kubernetes.Interface
}
ClientConfig configures how to dial the ateapi gRPC server with mutual TLS. The credential bundle is re-read on every handshake so in-place pod-certificate rotations are picked up.
type JWTProvider ¶
type JWTProvider struct {
Name string
Issuer string
Verify func(context.Context, string) (string, error)
}
JWTProvider verifies bearer tokens from one trusted issuer.
type JWTProviderConfig ¶
type JWTProviderConfig struct {
Name string `json:"name"`
Issuer string `json:"issuer"`
Audiences []string `json:"audiences"`
CertificateAuthorityFile string `json:"certificateAuthorityFile,omitempty"`
DiscoveryTokenFile string `json:"discoveryTokenFile,omitempty"`
}
JWTProviderConfig configures one trusted OIDC issuer.
type ServerConfig ¶
type ServerConfig struct {
// JWTProviders authenticate clients that did not present a certificate
// identity (e.g. kubectl-ate).
JWTProviders []JWTProvider
}
ServerConfig configures the server-side auth interceptor.
Source Files