Documentation
¶
Overview ¶
Package utils contains small utility functions without much logic wrapping the major APIs of the core auth package for ease of use in the controllers. These functions also import the provider packages to wrap switch-case choice of provider implementations. Because of that, these functions cannot be placed in the core package as they would cause a cyclic dependency given that the provider packages also import the core package.
Index ¶
- func GetArtifactRegistryCredentials(ctx context.Context, providerName string, artifactRepository string, ...) (authn.Authenticator, error)
- func GetGitCredentials(ctx context.Context, providerName string, opts ...auth.Option) (*auth.GitCredentials, error)
- func GetRESTConfig(ctx context.Context, kubeConfigRef meta.KubeConfigReference, ...) (*rest.Config, error)
- func ProviderByName[T any](name string) (T, error)
- type Option
- type RESTConfigFetcher
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GetArtifactRegistryCredentials ¶
func GetArtifactRegistryCredentials(ctx context.Context, providerName string, artifactRepository string, opts ...auth.Option) (authn.Authenticator, error)
GetArtifactRegistryCredentials retrieves the registry credentials for the specified artifact repository and provider.
The caller is responsible for resolving the ServiceAccount and validating its configuration with github.com/fluxcd/pkg/apis/crypto before calling this function, including cryptov1.WithOCI(true). When object-level workload identity is in use, the ServiceAccount and the options derived from the validated configuration must be passed through opts, e.g. with auth.WithServiceAccount and auth.OptionsFromSpec.
func GetGitCredentials ¶ added in v0.14.0
func GetGitCredentials(ctx context.Context, providerName string, opts ...auth.Option) (*auth.GitCredentials, error)
GetGitCredentials looks up the implemented providers that support Git and returns the credentials for the specified provider.
The caller is responsible for resolving the ServiceAccount and validating its configuration with github.com/fluxcd/pkg/apis/crypto before calling this function. When object-level workload identity is in use, the ServiceAccount and the options derived from the validated configuration must be passed through opts, e.g. with auth.WithServiceAccount and auth.OptionsFromSpec.
func GetRESTConfig ¶ added in v0.21.0
func GetRESTConfig(ctx context.Context, kubeConfigRef meta.KubeConfigReference, ctrlClient client.Client, opts ...Option) (*rest.Config, error)
GetRESTConfig retrieves a *rest.Config for the given meta.KubeConfigReference, controller-runtime client and options. It's a convenience wrapper for auth.GetRESTConfig so controllers can pass a meta.KubeConfigReference object directly without converting it to auth.Option(s).
The namespace of the kubeconfig ConfigMap and the ServiceAccount is read from the object reference in the auth options, so it must be set, e.g. with auth.WithObject.
It reads the kubeconfig ConfigMap and validates the configuration with the github.com/fluxcd/pkg/apis/crypto package. When a ServiceAccount is configured (either in the ConfigMap or via WithDefaultServiceAccount), it is fetched and validated with its annotations; otherwise only the ConfigMap inputs (e.g. the cluster resource) are validated.
Additionally, the resulting *rest.Config will call auth.GetRESTConfig for every HTTP request to the remote cluster. This is needed for long-running operations that wait on resources until a potentially long timeout is reached, like kstatus health checks, and whatever Helm does. The timeout may be longer than a token's lifetime, so tokens can expire during such operations. auth.GetRESTConfig will create a fresh token if that happens.
With the resulting *rest.Config, if a cache is not set in the options, a fresh token will be created for every HTTP request sent to the remote cluster.
func ProviderByName ¶
ProviderByName looks up the implemented providers by name and type.
Types ¶
type Option ¶ added in v0.64.0
type Option func(*options)
Option is a functional option for the utils package.
func WithAuthOptions ¶ added in v0.64.0
WithAuthOptions appends the auth options to use when retrieving credentials.
func WithDefaultServiceAccount ¶ added in v0.64.0
WithDefaultServiceAccount sets the default ServiceAccount name to use for object-level workload identity when the kubeconfig ConfigMap does not specify one. Controllers pass the value of the flag relevant to the operation being performed.
type RESTConfigFetcher ¶ added in v0.21.0
type RESTConfigFetcher func(ctx context.Context, ref meta.KubeConfigReference, ctrlClient client.Client) (*rest.Config, error)
RESTConfigFetcher is a function that retrieves a *rest.Config for a given meta.KubeConfigReference and a controller-runtime client. The namespace is read from the object reference in the auth options.
func GetRESTConfigFetcher ¶ added in v0.21.0
func GetRESTConfigFetcher(opts ...Option) RESTConfigFetcher
GetRESTConfigFetcher is a convenience function for controllers that use the runtime/client.(*Impersonator) to create controller-runtime clients. To keep runtime decoupled from auth, this function closes over the controller-provided options and returns a function that can be called by runtime without runtime needing to know about the option types. Usage example:
provider := authutils.GetRESTConfigFetcher(opts...) impersonatorOpts = append(impersonatorOpts, runtimeclient.WithKubeConfig(ref, kubeConfOpts, namespace, provider))
Controllers that don't use the runtime/client.(*Impersonator) can simply call GetRESTConfig directly, passing the options as variadic arguments.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cijwt provides an http.RoundTripper that authenticates outbound requests on a per-host basis with a JWT, sourcing the token from a CI/CD platform's OIDC integration or signing it locally.
|
Package cijwt provides an http.RoundTripper that authenticates outbound requests on a per-host basis with a JWT, sourcing the token from a CI/CD platform's OIDC integration or signing it locally. |