Documentation
¶
Overview ¶
Package kube builds the Kubernetes clients agent-manager reads and writes with, and hides them behind an interface so the identity a call runs under is a deployment choice: one shared client authenticated as the pod's ServiceAccount (a server nothing but a trusted proxy can reach), or — with OAuth and downstream OAuth on — a client per caller that presents the caller's own IdP token, so the apiserver authenticates the real user and the user's RBAC decides. In that mode the ServiceAccount holds no permissions (the chart renders no RBAC for it) and nothing runs without a caller.
Index ¶
Constants ¶
const ( // IdentityServiceAccount: every call is the pod's ServiceAccount. IdentityServiceAccount = "serviceAccount" // IdentityCaller: every call presents the caller's IdP token. IdentityCaller = "caller" )
Identities a Provider reports through GET /info.
Variables ¶
var ErrNoCallerToken = errors.New("no caller token on the request")
ErrNoCallerToken is returned by the caller provider when the request carries no IdP token: the server runs as the caller only, and there is no other credential to fall back to.
Functions ¶
func DiscoverVersion ¶
func DiscoverVersion(dc discovery.DiscoveryInterface, group, resource string) (string, error)
DiscoverVersion returns the API version of group that serves resource, preferring the server's preferred version. Used for kagent.dev (agents, modelconfigs) and the Flux groups (helmreleases, ocirepositories), whose versions differ between installations. Discovery is what every authenticated principal may read, so the ServiceAccount answers it even when it holds no other permission.
Types ¶
type CallerProvider ¶ added in v0.2.0
type CallerProvider struct {
// contains filtered or unexported fields
}
CallerProvider hands out clients that present the caller's IdP token (put on the context by the OAuth layer with downstream OAuth on). There is no fallback: a request without a token gets ErrNoCallerToken, and a token that expires while its request is still running keeps being presented — the apiserver answers 401, the request fails attributed to the caller, and the operation stays bounded by the caller's own credential. Clients are cached per token until the token's exp.
func NewCallerProvider ¶ added in v0.2.0
func NewCallerProvider(base *Clients, log *slog.Logger) *CallerProvider
NewCallerProvider builds per-caller clients from base (its server address, CA and TLS settings; never its credentials).
func (*CallerProvider) Client ¶ added in v0.2.0
func (p *CallerProvider) Client(ctx context.Context) (Client, error)
Client implements Provider.
func (*CallerProvider) Identity ¶ added in v0.2.0
func (p *CallerProvider) Identity() string
Identity implements Provider.
type Client ¶
type Client interface {
Dynamic() dynamic.Interface
Typed() kubernetes.Interface
Discovery() discovery.DiscoveryInterface
}
Client is what the service needs from Kubernetes: the dynamic client for the custom resources (HelmRelease, OCIRepository, Agent, ModelConfig), the typed client for the namespace events get_agent_status reports and discovery for the served API versions.
type Clients ¶
type Clients struct {
// contains filtered or unexported fields
}
Clients is the concrete client set built from a rest.Config.
func FromInterfaces ¶
func FromInterfaces(dyn dynamic.Interface, typed kubernetes.Interface, disc discovery.DiscoveryInterface) *Clients
FromInterfaces wraps existing clients (tests use the fakes).
func (*Clients) Discovery ¶
func (c *Clients) Discovery() discovery.DiscoveryInterface
Discovery implements Client.
func (*Clients) ForToken ¶ added in v0.2.0
ForToken returns clients that authenticate to the API server with token (an OIDC id_token the apiserver trusts) instead of the ServiceAccount. Server address, CA and TLS settings are kept; every credential of the base config is dropped so nothing but the caller's token is presented.
type Config ¶
type Config struct {
// Kubeconfig is an explicit kubeconfig path; empty uses the default
// loading rules ($KUBECONFIG, ~/.kube/config).
Kubeconfig string
// Context overrides the kubeconfig's current context.
Context string
// InCluster forces in-cluster auth. When false and no kubeconfig is
// found, in-cluster auth is still tried if the pod environment is present.
InCluster bool
}
Config selects how to reach the API server.
type Provider ¶
type Provider interface {
// Client returns the client for this request.
Client(ctx context.Context) (Client, error)
// Identity names how calls are authenticated, reported by GET /info:
// IdentityServiceAccount or IdentityCaller.
Identity() string
}
Provider resolves the client a request runs with. The ServiceAccount provider always hands out the same shared client; the caller provider derives one per call from the IdP token on ctx.
type ServiceAccountProvider ¶
type ServiceAccountProvider struct {
// contains filtered or unexported fields
}
ServiceAccountProvider hands out one shared client: every call is authenticated as agent-manager's own ServiceAccount, and the proxy in front of the server (the agentgateway JWT policy, muster) is the trust boundary.
func NewServiceAccountProvider ¶
func NewServiceAccountProvider(c Client) *ServiceAccountProvider
NewServiceAccountProvider wraps c.
func (*ServiceAccountProvider) Client ¶
func (p *ServiceAccountProvider) Client(context.Context) (Client, error)
Client implements Provider.
func (*ServiceAccountProvider) Identity ¶
func (p *ServiceAccountProvider) Identity() string
Identity implements Provider.
Source Files