Documentation
¶
Overview ¶
Package credprovider implements outbound credential brokering for Agent Mesh egress destinations (static secrets, RFC 8693 OIDC federation with optional Google Service Account impersonation, AWS STS AssumeRoleWithWebIdentity with inline IAM session policy compilation, and platform metadata identity) as well as TaskAuthorizationRule scope/permission/resource narrowing.
Index ¶
- func CallerBiscuitFromContext(ctx context.Context) []byte
- func CompileAWSSessionPolicy(templateJSON, destName string, rules []*api.TaskAuthorizationRule) (string, error)
- func IntersectTaskPermissionsAndResources(destName string, rules []*api.TaskAuthorizationRule) (perms []string, resources []string, err error)
- func NarrowOIDCScopes(policyScopes []string, destName string, rules []*api.TaskAuthorizationRule) ([]string, error)
- func WithCallerBiscuit(ctx context.Context, biscuitBytes []byte) context.Context
- type AWSAssumeRoleExchanger
- type BorderJWTMintFunc
- type Exchanger
- type OIDCFederationExchanger
- type PlatformIdentityExchanger
- type StaticSecretExchanger
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CallerBiscuitFromContext ¶
CallerBiscuitFromContext returns the caller Biscuit attached to ctx, or nil.
func CompileAWSSessionPolicy ¶
func CompileAWSSessionPolicy(templateJSON, destName string, rules []*api.TaskAuthorizationRule) (string, error)
CompileAWSSessionPolicy compiles an inline AWS IAM session policy JSON from the destination's session_policy template intersected with the TAR chain. It enforces the "TAR narrows, never selects" invariant: if templateJSON defines allowed Actions or Resources, the TAR chain can only narrow them to a subset, never add Actions or Resources outside the template.
func IntersectTaskPermissionsAndResources ¶
func IntersectTaskPermissionsAndResources(destName string, rules []*api.TaskAuthorizationRule) (perms []string, resources []string, err error)
IntersectTaskPermissionsAndResources computes the intersection of allowed_permissions and allowed_resources across all TaskAuthorizationRules in rules that match egress://<destName>. If two TARs in the chain specify disjoint permissions or disjoint resources, an error is returned.
func NarrowOIDCScopes ¶
func NarrowOIDCScopes(policyScopes []string, destName string, rules []*api.TaskAuthorizationRule) ([]string, error)
NarrowOIDCScopes computes the intersection of policyScopes with any OAuth scope constraints carried in the TaskAuthorizationRule chain for destName. It enforces the "TAR narrows, never selects" invariant:
- A TAR can shrink policyScopes to a subset.
- A TAR can never add a scope that is not in policyScopes.
- If a TAR specifies scope constraints that have an empty intersection with policyScopes, NarrowOIDCScopes returns an error so the exchange fails closed.
func WithCallerBiscuit ¶
WithCallerBiscuit attaches a verified caller Biscuit (such as a narrowed Task Biscuit or an exchanged Delegated Session Biscuit) to ctx so outbound credential brokers key their caches and STS mint requests by the caller's exact token.
Types ¶
type AWSAssumeRoleExchanger ¶
type AWSAssumeRoleExchanger struct {
// contains filtered or unexported fields
}
AWSAssumeRoleExchanger exchanges a Control-Plane-issued ES256 JWT at AWS STS AssumeRoleWithWebIdentity, compiling the intersected TAR chain into an inline IAM session policy intersected with the destination's session_policy template.
func NewAWSAssumeRoleExchanger ¶
func NewAWSAssumeRoleExchanger(destName string, cfg *api.AWSAssumeRole, mintJWT BorderJWTMintFunc, httpClient *http.Client) *AWSAssumeRoleExchanger
NewAWSAssumeRoleExchanger constructs an AWSAssumeRoleExchanger for destName.
type BorderJWTMintFunc ¶
type BorderJWTMintFunc func(ctx context.Context, destination, audience string) (jwt string, expiry time.Time, err error)
BorderJWTMintFunc mints an outbound ES256 border JWT from the Control Plane (or a test double) for a destination and audience.
type Exchanger ¶
type Exchanger interface {
Exchange(ctx context.Context, principal string, rules []*api.TaskAuthorizationRule) (bearerToken string, expiry time.Time, err error)
}
Exchanger translates a verified Agent Mesh principal and its intersected TaskAuthorizationRule chain into a downscoped upstream credential.
type OIDCFederationExchanger ¶
type OIDCFederationExchanger struct {
// contains filtered or unexported fields
}
OIDCFederationExchanger exchanges a Control-Plane-issued ES256 JWT at a cloud or third-party RFC 8693 STS endpoint (e.g. Google Workload/Workforce Identity Federation or generic OAuth 2.0 token exchange), with optional Google Service Account impersonation and scope narrowing from the TAR chain.
func NewOIDCFederationExchanger ¶
func NewOIDCFederationExchanger(destName string, cfg *api.OIDCFederation, mintJWT BorderJWTMintFunc, httpClient *http.Client) *OIDCFederationExchanger
NewOIDCFederationExchanger constructs an OIDCFederationExchanger for destName.
func (*OIDCFederationExchanger) Exchange ¶
func (e *OIDCFederationExchanger) Exchange(ctx context.Context, principal string, rules []*api.TaskAuthorizationRule) (string, time.Time, error)
Exchange mints a border JWT and exchanges it at the configured STS endpoint, narrowing scopes by the TAR chain while never selecting a broker, audience, service account, or scope outside the destination policy.
type PlatformIdentityExchanger ¶
type PlatformIdentityExchanger struct {
// contains filtered or unexported fields
}
PlatformIdentityExchanger fetches an access token from the node's own cloud metadata server (e.g. GKE Workload Identity / GCE instance metadata).
func NewPlatformIdentityExchanger ¶
func NewPlatformIdentityExchanger(destName string, cfg *api.PlatformIdentity, httpClient *http.Client) *PlatformIdentityExchanger
NewPlatformIdentityExchanger constructs a PlatformIdentityExchanger.
type StaticSecretExchanger ¶
type StaticSecretExchanger struct {
// contains filtered or unexported fields
}
StaticSecretExchanger reads a static secret file from the node's secrets directory. A TaskAuthorizationRule cannot alter or replace a static secret.
func NewStaticSecretExchanger ¶
func NewStaticSecretExchanger(secretsDir, secretName string) *StaticSecretExchanger
NewStaticSecretExchanger constructs a StaticSecretExchanger for secretName in secretsDir.
Source Files