Documentation
¶
Overview ¶
Package extauth implements an Envoy ext_authz gRPC service for TxToken generation and verification. It handles both entry-point token generation and downstream service verification via the standard ext_authz v3 protocol.
Index ¶
- func RegisterGenerationServer(gs *grpc.Server, s *GenerationServer)
- type GenerationServer
- type IdentityResolver
- func (r *IdentityResolver) DeletePod(pod *corev1.Pod)
- func (r *IdentityResolver) Resolve(principal, sourceIP string) (*WorkloadIdentity, error)
- func (r *IdentityResolver) ResolveFromPodIP(podIP string) (*WorkloadIdentity, error)
- func (r *IdentityResolver) ResolveFromPrincipal(principal string) (*WorkloadIdentity, error)
- func (r *IdentityResolver) UpdatePod(pod *corev1.Pod)
- type Server
- type WorkloadIdentity
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterGenerationServer ¶
func RegisterGenerationServer(gs *grpc.Server, s *GenerationServer)
RegisterGenerationServer registers the generation server with a gRPC server.
Types ¶
type GenerationServer ¶
type GenerationServer struct {
authv3.UnimplementedAuthorizationServer
// contains filtered or unexported fields
}
GenerationServer implements ext_authz for TxToken generation at entry points. It handles both external traffic (with OAuth AT) and internal traffic (identity resolved from CheckRequest metadata).
func NewGenerationServer ¶
func NewGenerationServer(ttsClient *sdktts.Client, resolver *IdentityResolver) *GenerationServer
NewGenerationServer creates a new ext auth server in generation mode.
func (*GenerationServer) Check ¶
func (s *GenerationServer) Check(ctx context.Context, req *authv3.CheckRequest) (*authv3.CheckResponse, error)
Check implements the ext_authz v3 Authorization/Check RPC for token generation.
func (*GenerationServer) SetGenerationRules ¶
func (s *GenerationServer) SetGenerationRules(rules []controller.GenerationRule)
SetGenerationRules updates the generation rules (from TransactionType CRDs).
type IdentityResolver ¶
type IdentityResolver struct {
// contains filtered or unexported fields
}
IdentityResolver resolves the source workload identity from the ext_authz CheckRequest. In Istio ambient mode, it parses the SPIFFE principal from source.principal. In standalone mode, it resolves the source pod IP to a service account via an informer cache.
func NewIdentityResolver ¶
func NewIdentityResolver() *IdentityResolver
NewIdentityResolver creates a new identity resolver.
func (*IdentityResolver) DeletePod ¶
func (r *IdentityResolver) DeletePod(pod *corev1.Pod)
DeletePod removes a pod from the informer cache.
func (*IdentityResolver) Resolve ¶
func (r *IdentityResolver) Resolve(principal, sourceIP string) (*WorkloadIdentity, error)
Resolve attempts to resolve a workload identity using all available information. It tries SPIFFE principal first (cryptographically authenticated), then falls back to pod IP resolution (network-level identity).
func (*IdentityResolver) ResolveFromPodIP ¶
func (r *IdentityResolver) ResolveFromPodIP(podIP string) (*WorkloadIdentity, error)
ResolveFromPodIP resolves a workload identity from a pod IP address using the local informer cache.
func (*IdentityResolver) ResolveFromPrincipal ¶
func (r *IdentityResolver) ResolveFromPrincipal(principal string) (*WorkloadIdentity, error)
ResolveFromPrincipal extracts the workload identity from a SPIFFE principal URI. Format: spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>
func (*IdentityResolver) UpdatePod ¶
func (r *IdentityResolver) UpdatePod(pod *corev1.Pod)
UpdatePod adds or updates a pod in the informer cache.
type Server ¶
type Server struct {
authv3.UnimplementedAuthorizationServer
// contains filtered or unexported fields
}
Server implements the Envoy ext_authz v3 Authorization gRPC service.
func (*Server) Check ¶
func (s *Server) Check(ctx context.Context, req *authv3.CheckRequest) (*authv3.CheckResponse, error)
Check implements the ext_authz v3 Authorization/Check RPC.
func (*Server) SetTTSClient ¶
SetTTSClient sets the TTS client for auto-narrowing support.
func (*Server) SetVerificationRules ¶
func (s *Server) SetVerificationRules(rules []controller.VerificationRule)
SetVerificationRules updates the verification rules (from ServiceTokenRequirement CRDs).
type WorkloadIdentity ¶
type WorkloadIdentity struct {
// Subject is the workload identifier (e.g., "system:serviceaccount:team-alpha:my-agent").
Subject string
// Namespace is the workload's Kubernetes namespace.
Namespace string
// ServiceAccount is the workload's Kubernetes service account name.
ServiceAccount string
}
WorkloadIdentity represents a resolved workload identity.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ruleclient implements a gRPC streaming client that receives generation and verification rules from the kontxt controller's RuleDiscoveryService.
|
Package ruleclient implements a gRPC streaming client that receives generation and verification rules from the kontxt controller's RuleDiscoveryService. |