Documentation
¶
Overview ¶
Package oidc implements OIDC authentication for Kubernetes clusters. It provides a native exec credential plugin that replaces kubelogin, using the authorization code flow with PKCE for secure token acquisition.
Index ¶
- Variables
- func CacheDir() (string, error)
- func CacheKey(issuerURL, clientID string, scopes []string) string
- func ExecCredentialJSON(idToken string, expiry time.Time) ([]byte, error)
- func SaveCachedToken(cacheDir, key string, token *TokenResult) error
- type Authenticator
- type CachedToken
- type TokenResult
Constants ¶
This section is empty.
Variables ¶
var ErrAuthenticationFailed = errors.New("OIDC authentication failed")
ErrAuthenticationFailed is returned when the OIDC authentication flow fails.
var ErrUnsupportedPlatform = errors.New("unsupported platform")
ErrUnsupportedPlatform is returned when the runtime OS is not supported for browser opening.
Functions ¶
func CacheDir ¶
CacheDir returns the default token cache directory. Returns an error if the user's home directory cannot be determined.
func CacheKey ¶
CacheKey generates a deterministic cache key from the OIDC parameters. Scopes are sorted to ensure consistent keys regardless of input order. Fields are separated with null bytes to prevent collision between adjacent values.
func ExecCredentialJSON ¶
ExecCredentialJSON generates the ExecCredential JSON output for kubectl.
func SaveCachedToken ¶
func SaveCachedToken(cacheDir, key string, token *TokenResult) error
SaveCachedToken persists a token result to the cache directory.
Types ¶
type Authenticator ¶
Authenticator handles the OIDC authorization code flow with PKCE.
func (*Authenticator) Authenticate ¶
func (a *Authenticator) Authenticate(ctx context.Context) (*TokenResult, error)
Authenticate performs the OIDC authorization code flow with PKCE. It starts a local HTTP server, opens the browser to the OIDC provider, and waits for the callback with the authorization code.
func (*Authenticator) RefreshToken ¶
func (a *Authenticator) RefreshToken( ctx context.Context, refreshToken string, ) (*TokenResult, error)
RefreshToken attempts to refresh an expired token using the refresh token.
type CachedToken ¶
type CachedToken struct {
IDToken string `json:"idToken"`
RefreshToken string `json:"refreshToken,omitempty"`
Expiry time.Time `json:"expiry"`
}
CachedToken represents a cached OIDC token on disk.
func LoadCachedToken ¶
func LoadCachedToken(cacheDir, key string) *CachedToken
LoadCachedToken loads a cached token from disk. Returns nil if no cached token exists or it cannot be read.
Source Files