Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContextWithUserInfo ¶
ContextWithUserInfo returns a new context with the user's identity attached.
func NewMiddleware ¶
func NewMiddleware(cfg MiddlewareConfig) func(http.Handler) http.Handler
NewMiddleware creates net/http middleware that authenticates requests via Kubernetes TokenReview with LRU caching.
Types ¶
type AuditLogger ¶
type AuthMetrics ¶
type AuthMetrics struct {
Latency *prometheus.HistogramVec // provider, result
CacheHits prometheus.Counter
CacheMisses prometheus.Counter
Attempts *prometheus.CounterVec // provider, result
}
AuthMetrics holds Prometheus metrics for the auth middleware.
type AuthProvider ¶
AuthProvider authenticates a bearer token and returns user identity.
type MiddlewareConfig ¶
type MiddlewareConfig struct {
Provider AuthProvider
Cache *TokenCache
Logger *slog.Logger
AuditLogger AuditLogger
Metrics *AuthMetrics
// ExemptPaths are paths that bypass authentication (e.g., /healthz)
ExemptPaths []string
}
MiddlewareConfig configures the auth middleware.
type TokenCache ¶
type TokenCache struct {
// contains filtered or unexported fields
}
TokenCache is a bounded LRU cache for authenticated TokenReview results. Keys are SHA-256 hashes of tokens — raw tokens are never stored.
func NewTokenCache ¶
func NewTokenCache(maxSize int, ttl time.Duration) *TokenCache
NewTokenCache creates a cache with the given maximum size and entry TTL. A maxSize <= 0 creates a no-op cache that never stores entries.
func (*TokenCache) Get ¶
func (c *TokenCache) Get(token string) *UserInfo
Get looks up a cached user identity by token. Returns nil if not found or expired. Promotes the entry to newest on hit (LRU).
func (*TokenCache) Set ¶
func (c *TokenCache) Set(token string, user *UserInfo)
Set stores an authenticated user identity keyed by token hash. Only cache successful authentications — never cache failures. If the key already exists, it is updated in-place without eviction.
type TokenReviewProvider ¶
type TokenReviewProvider struct {
// contains filtered or unexported fields
}
TokenReviewProvider authenticates tokens via the Kubernetes TokenReview API.
func NewTokenReviewProvider ¶
func NewTokenReviewProvider(client kubernetes.Interface, audiences []string) *TokenReviewProvider
NewTokenReviewProvider creates a provider that validates tokens against the kube-apiserver.
func (*TokenReviewProvider) Authenticate ¶
type UserInfo ¶
type UserInfo struct {
Username string
UID string
Groups []string
Extra map[string]authorizationv1.ExtraValue
}
UserInfo represents the authenticated user's identity from a Kubernetes TokenReview.
func UserInfoFromContext ¶
UserInfoFromContext extracts the authenticated user's identity from the context.
Source Files