auth

package module
v0.0.0-...-9b73029 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 27, 2026 License: MIT Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const AuthConnectTypeKubeConfig = "kubeconfig"
View Source 
const AuthConnectTypeKubeToken = "k8s-token"

Variables

This section is empty.

Functions

func NewKubeTokenAuthTokenRecord 

func NewKubeTokenAuthTokenRecord(portalProxy api.PortalProxy, token string) *api.TokenRecord

Types

type AWSIAMUserInfo 

type AWSIAMUserInfo struct {
	Cluster   string `json:"cluster"`
	AccessKey string `json:"accessKey"`
	SecretKey string `json:"secretKey"`
}

AWSIAMUserInfo is the user info needed to connect to AWS Kubernetes

func (*AWSIAMUserInfo) Retrieve 

func (c *AWSIAMUserInfo) Retrieve(context.Context) (aws.Credentials, error)

Retrieve implements the SDK v2 aws.CredentialsProvider interface.

The v1 implementation paired this with IsExpired() returning true, which forced the SDK to call Retrieve on every use. v2 has no such method and none is needed: these are static fields on this struct, so leaving CanExpire false lets the credentials cache keep what is returned here.

type AWSKubeAuth 

type AWSKubeAuth struct {
	// contains filtered or unexported fields
}

AWSKubeAuth is AWS IAM Authentication for Kubernetes

func (*AWSKubeAuth) AddAuthInfo 

func (c *AWSKubeAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*AWSKubeAuth) DoFlowRequest 

func (c *AWSKubeAuth) DoFlowRequest(cnsiRequest *api.CNSIRequest, req *http.Request) (*http.Response, error)

func (*AWSKubeAuth) FetchToken 

func (c *AWSKubeAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*AWSKubeAuth) GetName 

func (c *AWSKubeAuth) GetName() string

GetName returns the Auth Provider name

func (*AWSKubeAuth) GetUserFromToken 

func (c *AWSKubeAuth) GetUserFromToken(cnsiGUID string, cfTokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

func (*AWSKubeAuth) RefreshIAMToken 

func (c *AWSKubeAuth) RefreshIAMToken(skipSSLValidation bool, cnsiGUID, userGUID, client, clientSecret, tokenEndpoint string) (t api.TokenRecord, err error)

func (*AWSKubeAuth) RegisterJetstreamAuthType 

func (c *AWSKubeAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type AzureKubeAuth 

type AzureKubeAuth struct {
	CertKubeAuth
}

AzureKubeAuth is Azure Authentication with Certificates

func (*AzureKubeAuth) FetchToken 

func (p *AzureKubeAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*AzureKubeAuth) GetName 

func (c *AzureKubeAuth) GetName() string

GetName returns the provider name

func (*AzureKubeAuth) RegisterJetstreamAuthType 

func (c *AzureKubeAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type CertKubeAuth 

type CertKubeAuth struct {
	// contains filtered or unexported fields
}

CertKubeAuth is GKE Authentication with Certificates

func InitCertKubeAuth 

func InitCertKubeAuth(portalProxy api.PortalProxy) *CertKubeAuth

InitCertKubeAuth creates a GKEKubeAuth

func (*CertKubeAuth) AddAuthInfo 

func (c *CertKubeAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*CertKubeAuth) DoFlowRequest 

func (c *CertKubeAuth) DoFlowRequest(cnsiRequest *api.CNSIRequest, req *http.Request) (*http.Response, error)

func (*CertKubeAuth) FetchToken 

func (c *CertKubeAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*CertKubeAuth) GetName 

func (c *CertKubeAuth) GetName() string

GetName returns the provider name

func (*CertKubeAuth) GetUserFromToken 

func (c *CertKubeAuth) GetUserFromToken(cnsiGUID string, cfTokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

func (*CertKubeAuth) RefreshCertAuth 

func (c *CertKubeAuth) RefreshCertAuth(skipSSLValidation bool, cnsiGUID, userGUID, client, clientSecret, tokenEndpoint string) (t api.TokenRecord, err error)

func (*CertKubeAuth) RegisterJetstreamAuthType 

func (c *CertKubeAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type GKEConfig 

type GKEConfig struct {
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret"`
	RefreshToken string `json:"refresh_token"`
	Type         string `json:"type"`
	Email        string `json:"email"`
}

GKEConfig is the format of the config file we expect for GKE authentication

type GKEKubeAuth 

type GKEKubeAuth struct {
	// contains filtered or unexported fields
}

GKEKubeAuth is GKE Authentication for Kubernetes

func (*GKEKubeAuth) AddAuthInfo 

func (c *GKEKubeAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*GKEKubeAuth) DoFlowRequest 

func (c *GKEKubeAuth) DoFlowRequest(cnsiRequest *api.CNSIRequest, req *http.Request) (*http.Response, error)

func (*GKEKubeAuth) FetchToken 

func (c *GKEKubeAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

FetchToken will create a token for the GKE Authentication using the POSTed data

func (*GKEKubeAuth) GetName 

func (c *GKEKubeAuth) GetName() string

GetName returns the provider name

func (*GKEKubeAuth) GetUserFromToken 

func (c *GKEKubeAuth) GetUserFromToken(cnsiGUID string, tokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

GetUserFromToken gets the username from the GKE Token

func (*GKEKubeAuth) RefreshGKEToken 

func (c *GKEKubeAuth) RefreshGKEToken(skipSSLValidation bool, cnsiGUID, userGUID, client, clientSecret, tokenEndpoint string) (t api.TokenRecord, err error)

RefreshGKEToken will refresh a GKE token

func (*GKEKubeAuth) RegisterJetstreamAuthType 

func (c *GKEKubeAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type KubeAuthProvider 

type KubeAuthProvider interface {
	GetName() string
	AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error
	FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

	RegisterJetstreamAuthType(portal api.PortalProxy)
}

KubeAuthProvider is the interface for Kubernetes Authentication Providers

func InitAWSKubeAuth 

func InitAWSKubeAuth(portalProxy api.PortalProxy) KubeAuthProvider

InitAWSKubeAuth creates a GKEKubeAuth

func InitAzureKubeAuth 

func InitAzureKubeAuth(portalProxy api.PortalProxy) KubeAuthProvider

InitAzureKubeAuth creates a AzureKubeAuth

func InitGKEKubeAuth 

func InitGKEKubeAuth(portalProxy api.PortalProxy) KubeAuthProvider

InitGKEKubeAuth creates a GKEKubeAuth

func InitKubeConfigAuth 

func InitKubeConfigAuth(portalProxy api.PortalProxy) KubeAuthProvider

InitKubeConfigAuth

func InitKubeTokenAuth 

func InitKubeTokenAuth(portalProxy api.PortalProxy) KubeAuthProvider

InitKubeTokenAuth

type KubeBasicAuth 

type KubeBasicAuth struct {
	// contains filtered or unexported fields
}

KubeBasicAuth is HTTP Basic Authentication

func InitKubeBasicAuth 

func InitKubeBasicAuth(portalProxy api.PortalProxy) *KubeBasicAuth

InitKubeBasicAuth creates a GKEKubeAuth

func (*KubeBasicAuth) AddAuthInfo 

func (c *KubeBasicAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*KubeBasicAuth) FetchToken 

func (c *KubeBasicAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*KubeBasicAuth) GetName 

func (c *KubeBasicAuth) GetName() string

GetName returns the provider name

func (*KubeBasicAuth) GetUserFromToken 

func (c *KubeBasicAuth) GetUserFromToken(cnsiGUID string, cfTokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

func (*KubeBasicAuth) RegisterJetstreamAuthType 

func (c *KubeBasicAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type KubeCertificate 

type KubeCertificate struct {
	Certificate    string `json:"cert"`
	CertificateKey string `json:"certKey"`
	Token          string `json:"token,omitempty"`
}

KubeCertificate represents certificate infor for Kube Authentication

func (*KubeCertificate) GetCerticate 

func (k *KubeCertificate) GetCerticate() (tls.Certificate, error)

GetCerticate gets a certiciate from the info available

func (*KubeCertificate) GetJSON 

func (k *KubeCertificate) GetJSON() (string, error)

GetJSON persists the config to JSON

type KubeConfigAuth 

type KubeConfigAuth struct {
	OIDCKubeAuth
}

KubeConfigAuth is same as OIDC with different name

func (*KubeConfigAuth) AddAuthInfo 

func (c *KubeConfigAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*KubeConfigAuth) FetchToken 

func (c *KubeConfigAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*KubeConfigAuth) GetCertAuth 

func (c *KubeConfigAuth) GetCertAuth(cnsiRecord api.CNSIRecord, user *config.KubeConfigUser) (*api.TokenRecord, *api.CNSIRecord, error)

func (*KubeConfigAuth) GetName 

func (c *KubeConfigAuth) GetName() string

func (*KubeConfigAuth) RegisterJetstreamAuthType 

func (c *KubeConfigAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type KubeConfigAuthProviderOIDC 

type KubeConfigAuthProviderOIDC struct {
	ClientID     string `yaml:"client-id"`
	ClientSecret string `yaml:"client-secret"`
	IDToken      string `yaml:"id-token"`
	IdpIssuerURL string `yaml:"idp-issuer-url"`
	RefreshToken string `yaml:"refresh-token"`
	Expiry       time.Time
}

type KubeJetstreamAuthProvider 

type KubeJetstreamAuthProvider interface {
	DoFlowRequest(cnsiRequest *api.CNSIRequest, req *http.Request) (*http.Response, error)
	GetUserFromToken(cnsiGUID string, tokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)
}

KubeJetstreamAuthProvider is the optional interface that can be implemented if you want to control Jetstream Auth Registration

type KubeTokenAuth 

type KubeTokenAuth struct {
	// contains filtered or unexported fields
}

KubeTokenAuth uses a token (e.g. service account token)

func (*KubeTokenAuth) AddAuthInfo 

func (c *KubeTokenAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*KubeTokenAuth) FetchToken 

func (c *KubeTokenAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*KubeTokenAuth) GetName 

func (c *KubeTokenAuth) GetName() string

func (*KubeTokenAuth) GetUserFromToken 

func (c *KubeTokenAuth) GetUserFromToken(cnsiGUID string, tokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

func (*KubeTokenAuth) RegisterJetstreamAuthType 

func (c *KubeTokenAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

type OIDCKubeAuth 

type OIDCKubeAuth struct {
	// contains filtered or unexported fields
}

OIDCKubeAuth

func InitOIDCKubeAuth 

func InitOIDCKubeAuth(portalProxy api.PortalProxy) *OIDCKubeAuth

InitOIDCKubeAuth

func (*OIDCKubeAuth) AddAuthInfo 

func (c *OIDCKubeAuth) AddAuthInfo(info *clientcmdapi.AuthInfo, tokenRec api.TokenRecord) error

func (*OIDCKubeAuth) DoFlowRequest 

func (c *OIDCKubeAuth) DoFlowRequest(cnsiRequest *api.CNSIRequest, req *http.Request) (*http.Response, error)

func (*OIDCKubeAuth) FetchToken 

func (c *OIDCKubeAuth) FetchToken(cnsiRecord api.CNSIRecord, ec *echo.Context) (*api.TokenRecord, *api.CNSIRecord, error)

func (*OIDCKubeAuth) GetName 

func (c *OIDCKubeAuth) GetName() string

GetName returns the provider name

func (*OIDCKubeAuth) GetOIDCConfig 

func (c *OIDCKubeAuth) GetOIDCConfig(k *config.KubeConfigUser) (*KubeConfigAuthProviderOIDC, error)

func (*OIDCKubeAuth) GetTokenFromKubeConfigUser 

func (c *OIDCKubeAuth) GetTokenFromKubeConfigUser(cnsiRecord api.CNSIRecord, kubeConfigUser *config.KubeConfigUser) (*api.TokenRecord, *api.CNSIRecord, error)

func (*OIDCKubeAuth) GetUserFromToken 

func (c *OIDCKubeAuth) GetUserFromToken(cnsiGUID string, tokenRecord *api.TokenRecord) (*api.ConnectedUser, bool)

GetUserFromToken gets the username from the GKE Token

func (*OIDCKubeAuth) RegisterJetstreamAuthType 

func (c *OIDCKubeAuth) RegisterJetstreamAuthType(portal api.PortalProxy)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.