Documentation
¶
Overview ¶
Package auth authenticates the platform's callers (§13.2). Seats present a projected ServiceAccount token whose only audience is steadmesh-gateway; the controller presents its own ServiceAccount token with the default audience. Both are verified with a Kubernetes TokenReview, and the principal is derived from the verified username, never from request content.
Index ¶
Constants ¶
const PodUIDExtra = "authentication.kubernetes.io/pod-uid"
PodUIDExtra is the TokenReview extra field carrying the bound Pod UID.
Variables ¶
var ( ErrUnauthenticated = errors.New("unauthenticated") ErrForbidden = errors.New("forbidden") )
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authenticator interface {
// Seat resolves a gateway-audience token to an active seat.
Seat(ctx context.Context, token string) (Seat, error)
// Controller verifies the controller's token.
Controller(ctx context.Context, token string) error
// Console verifies the console's token. It is forbidden when no console
// identity is configured.
Console(ctx context.Context, token string) error
}
Authenticator verifies bearer tokens.
type Fake ¶
type Fake struct {
// contains filtered or unexported fields
}
Fake is an in-memory Authenticator for tests.
func (*Fake) Controller ¶
Controller implements Authenticator.
func (*Fake) SetConsole ¶
SetConsole makes token authenticate on the console API.
type SeatResolver ¶
type SeatResolver interface {
SeatByServiceAccount(ctx context.Context, namespace, serviceAccount string) (string, error)
}
SeatResolver maps a verified ServiceAccount to its active seat id.
type TaskRunResolver ¶ added in v0.6.0
type TaskRunResolver interface {
TaskRunByServiceAccount(ctx context.Context, namespace, serviceAccount string) (seatID, taskRunID string, err error)
}
TaskRunResolver optionally resolves a disposable worker's separate identity.
type TokenReview ¶
type TokenReview struct {
// contains filtered or unexported fields
}
TokenReview is the production Authenticator.
func NewTokenReview ¶
func NewTokenReview(client kubernetes.Interface, seats SeatResolver, controllerUsername, consoleUsername string) *TokenReview
NewTokenReview returns an Authenticator using client for TokenReviews. controllerUsername is the only identity accepted on the internal API, e.g. system:serviceaccount:steadmesh-system:steadmesh-controller. consoleUsername is the only identity accepted on the console API; empty accepts none.
func (*TokenReview) Console ¶
func (a *TokenReview) Console(ctx context.Context, token string) error
Console implements Authenticator.
func (*TokenReview) Controller ¶
func (a *TokenReview) Controller(ctx context.Context, token string) error
Controller implements Authenticator.
Source Files