Documentation
¶
Index ¶
- func GetClientAssertionCredentialOptions() *azidentity.ClientAssertionCredentialOptions
- func GetClientSecret(ctx context.Context, cl client.Client, secretRef *corev1.SecretReference) (string, error)
- func GetClientSecretCredentialOptions() *azidentity.ClientSecretCredentialOptions
- type SecretReferenceValidator
- type TokenExpiry
- type TokenProvider
- func NewAzureClientSecretTokenProvider(tenantID, clientID, clientSecret string, ...) (TokenProvider, error)
- func NewAzureTokenProvider(_ context.Context, tenantID, clientID string, tokenProvider TokenProvider, ...) (TokenProvider, error)
- func NewGCPTokenProvider(ctx context.Context, gcpCredentialLiteral []byte) (TokenProvider, error)
- func NewMockTokenProvider(mockToken string, mockExpireAt time.Time, err error) TokenProvider
- func NewOidcTokenProvider(ctx context.Context, client client.Client, oidcConfig *egv1a1.OIDC, ...) (TokenProvider, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GetClientAssertionCredentialOptions ¶
func GetClientAssertionCredentialOptions() *azidentity.ClientAssertionCredentialOptions
func GetClientSecret ¶
func GetClientSecret(ctx context.Context, cl client.Client, secretRef *corev1.SecretReference) (string, error)
GetClientSecret retrieves the client secret from a Kubernetes secret.
func GetClientSecretCredentialOptions ¶
func GetClientSecretCredentialOptions() *azidentity.ClientSecretCredentialOptions
Types ¶
type SecretReferenceValidator ¶ added in v1.2.0
type SecretReferenceValidator func(ctx context.Context, fromNamespace, toNamespace, secretName string) error
SecretReferenceValidator authorizes a cross-namespace Secret reference, e.g. via a Gateway API ReferenceGrant. It returns a non-nil error when the resource in fromNamespace is not permitted to reference the Secret named secretName in toNamespace.
type TokenExpiry ¶
type TokenExpiry struct {
Token string // The token string.
ExpiresAt time.Time // The expiration time of the token.
}
TokenExpiry represents a token and its expiration time.
type TokenProvider ¶
type TokenProvider interface {
// GetToken retrieves a token and its expiration time.
GetToken(ctx context.Context) (TokenExpiry, error)
}
TokenProvider is an interface for retrieving tokens.
func NewAzureClientSecretTokenProvider ¶
func NewAzureClientSecretTokenProvider(tenantID, clientID, clientSecret string, tokenOption policy.TokenRequestOptions) (TokenProvider, error)
NewAzureClientSecretTokenProvider creates a new TokenProvider with the given tenant ID, client ID, client secret, and token request options.
func NewAzureTokenProvider ¶
func NewAzureTokenProvider(_ context.Context, tenantID, clientID string, tokenProvider TokenProvider, tokenOption policy.TokenRequestOptions) (TokenProvider, error)
NewAzureTokenProvider creates a new TokenProvider with the given tenant ID, client ID, tokenProvider, and token request options.
func NewGCPTokenProvider ¶ added in v0.3.0
func NewGCPTokenProvider(ctx context.Context, gcpCredentialLiteral []byte) (TokenProvider, error)
NewGCPTokenProvider creates a new TokenProvider with GCP service account key JSON string.
func NewMockTokenProvider ¶
func NewMockTokenProvider(mockToken string, mockExpireAt time.Time, err error) TokenProvider
NewMockTokenProvider creates a new MockTokenProvider with the given token, expiration time, and error.
func NewOidcTokenProvider ¶
func NewOidcTokenProvider(ctx context.Context, client client.Client, oidcConfig *egv1a1.OIDC, ownerNamespace string, validateSecretRef SecretReferenceValidator) (TokenProvider, error)
NewOidcTokenProvider creates a new TokenProvider with the given OIDC configuration.
ownerNamespace is the namespace of the resource that owns this OIDC configuration (e.g. the BackendSecurityPolicy). validateSecretRef, when non-nil, is consulted to authorize a cross-namespace read of oidcConfig.ClientSecret (e.g. via a Gateway API ReferenceGrant); when nil, a cross-namespace reference is always rejected.
Source Files