Documentation
¶
Overview ¶
Package identity carries the authenticated caller through a request: who the OAuth layer validated (subject, email, groups) and, when the server acts on the caller's behalf towards the Kubernetes API, the caller's own IdP token. agent-manager does nothing without a caller — every Kubernetes call belongs to a request — so a context without an identity only exists in tests and in a server that runs without OAuth (the ServiceAccount then).
Index ¶
- func Caller(ctx context.Context) string
- func ContextWith(ctx context.Context, id *Identity) context.Context
- func ContextWithToken(ctx context.Context, token string) context.Context
- func LogAttr(ctx context.Context) slog.Attr
- func TokenExpiry(token string) time.Time
- func TokenFromContext(ctx context.Context) (string, bool)
- type Identity
- type Source
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContextWith ¶
ContextWith returns ctx carrying id.
func ContextWithToken ¶
ContextWithToken returns ctx carrying the caller's IdP token for downstream Kubernetes API calls. Only set when the server runs with downstream OAuth on.
func LogAttr ¶
LogAttr is the structured-log attribute every mutation carries: the caller, or the ServiceAccount marker when the server runs without OAuth.
func TokenExpiry ¶
TokenExpiry reads the `exp` claim of a JWT without verifying it — the token was validated when the request came in; this only bounds how long the per-caller Kubernetes clients built from it are worth keeping. Zero when the token is not a JWT or carries no exp.
Types ¶
type Identity ¶
type Identity struct {
// Subject is the IdP's stable user id (the `sub` claim).
Subject string
// Email is the caller's email when the IdP provided one.
Email string
// Name is the display name when the IdP provided one.
Name string
// Groups are the IdP group claims (Dex `groups`; empty for Google).
Groups []string
// Source is how the token was validated.
Source Source
}
Identity is the authenticated caller.
func FromContext ¶
FromContext returns the caller, if any.
type Source ¶
type Source string
Source says how the caller was authenticated.
const ( // SourceSSO is an IdP id_token forwarded by a trusted aggregator (muster) // or sent by the portal through the gateway, validated against the IdP's // JWKS. SourceSSO Source = "sso" // SourceOAuth is an access token issued by this server's own OAuth 2.1 // flow (a client that authenticated directly, e.g. mcp-debug). SourceOAuth Source = "oauth" )
Source Files