Documentation
¶
Overview ¶
Package ateletauth authenticates RPCs that arrive from an atelet, for the ateapi services served only to atelet.
Index ¶
Constants ¶
const ( TrustDomain = "cluster.local" Namespace = "ate-system" ServiceAccount = "atelet" )
The SPIFFE identity that atelet client certs carry, as minted by the podidentity signer (cmd/podcertcontroller/internal/podidentitysigner).
These mirror the constants the atelet dialer verifies against in cmd/ateapi/internal/controlapi/dialer.go, duplicated rather than imported so that this package does not depend on controlapi for three strings.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Caller ¶
Caller is the verified identity of an atelet.
func Authenticate ¶
Authenticate verifies that the RPC arrived over mTLS from an atelet, and returns the identity that atelet's certificate asserts.
The certificate chain is already verified by the TLS layer against the pod-identity CA (see buildServerCreds in cmd/ateapi/main.go), so the extensions read here are trustworthy: only the pod-identity signer can mint a certificate carrying a given pod's node name.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ateletauthtest builds the peer contexts that the ateapi services served only to atelet authenticate against.
|
Package ateletauthtest builds the peer contexts that the ateapi services served only to atelet authenticate against. |