Documentation
¶
Overview ¶
Package kubeexchange implements the Kubernetes-backed half of the agent token-exchange transport (ADR 0055 Fix #3): validating a pod's projected ServiceAccount token via the apiserver TokenReview API, and resolving the reviewed pod to the task-instance identity the control plane stamped on it. Both satisfy the mockable interfaces in internal/agentrpc, so the exchange handler is unit-tested without a cluster; this concrete code is the Pro/K8s implementation the owed real-cluster e2e exercises.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type PodResolver ¶
type PodResolver struct {
// contains filtered or unexported fields
}
PodResolver maps a reviewed pod to the task-instance identity the control plane stamped on it at dispatch. It implements agentrpc.PodTaskResolver.
func NewPodResolver ¶
func NewPodResolver(client kubernetes.Interface, namespace string) *PodResolver
NewPodResolver builds a resolver that reads pods from the task namespace (falling back to it when the reviewed pod carries no namespace).
func (*PodResolver) ResolveAgent ¶
func (r *PodResolver) ResolveAgent(ctx context.Context, pod agentrpc.ReviewedPod) (auth.AgentIdentity, error)
ResolveAgent fetches the reviewed pod once and resolves it to an agent identity, branching on the warm-worker LABEL (ADR 0058 D1): a pod carrying executor.WarmWorkerLabel resolves to a WORKER-scoped identity (its dag_version pool + tenant from labels, its worker id from the pod name, no task claims); any other pod resolves to the task instance the executor stamped on it, exactly as ResolveTaskInstance does. A UID mismatch (a name reused by a newer pod) fails closed for both flavors.
func (*PodResolver) ResolveTaskInstance ¶
func (r *PodResolver) ResolveTaskInstance(ctx context.Context, pod agentrpc.ReviewedPod) (auth.AgentIdentity, error)
ResolveTaskInstance resolves the reviewed pod to the task instance the executor stamped on it (the shared executor.AgentIdentityAnnotation contract), so the minted JWT is scoped to the true attempt rather than a lossy label read. It is the pure task path — a warm pod has no task instance and is an error here; the exchange takes the warm branch via ResolveAgent instead. A UID mismatch or a missing annotation fails closed.
type TokenReviewer ¶
type TokenReviewer struct {
// contains filtered or unexported fields
}
TokenReviewer validates a projected SA token against a fixed audience via the apiserver TokenReview API. It implements agentrpc.TokenReviewer.
func NewTokenReviewer ¶
func NewTokenReviewer(client kubernetes.Interface, audience string) *TokenReviewer
NewTokenReviewer builds a reviewer that asks the apiserver to validate tokens for the given control-plane audience. A token not valid for that audience is rejected by the apiserver (authenticated=false), so audience separation is enforced server-side, not by string comparison here.
func (*TokenReviewer) ReviewProjectedToken ¶
func (r *TokenReviewer) ReviewProjectedToken(ctx context.Context, token string) (agentrpc.ReviewedPod, error)
ReviewProjectedToken submits the token to the apiserver's TokenReview API, scoped to the control-plane audience, and returns the pod it was bound to. This is the single apiserver call in the exchange, made once per pod at bootstrap.
Source Files