authentication

Nov 26, 2025

Changes in this version

+ func ForbidSystemUsernames(delegate authenticator.Request) authenticator.Request

+ func NewIndex(lifecycleCtx context.Context, baseAudiences authenticator.Audiences) *state

+ func NewShardWatcher(ctx context.Context, shardName string, ...) (*shardWatcher, error)

+ func NewStandaloneWorkspaceAuthenticator(clusterIndex *index.State, authIndex AuthenticatorIndex) authenticator.Request

+ func NewWorkspaceAuthenticator() authenticator.Request

+ func WithWorkspaceAuthResolver(handler http.Handler, authIndex AuthenticatorIndex) http.Handler

+ func WithWorkspaceAuthenticator(parent context.Context, authenticator authenticator.Request) context.Context

+ func WorkspaceAuthenticatorFrom(ctx context.Context) (authenticator.Request, bool)

+ type AuthenticatorIndex interface

+ Lookup func(wsType logicalcluster.Path) (authenticator.Request, bool)

+ type ClusterClientGetter func(shard *corev1alpha1.Shard) (kcpclientset.ClusterInterface, error)

+ type Controller struct

+ func NewController(ctx context.Context, shardInformer corev1alpha1informers.ShardInformer, ...) (*Controller, error)

+ func (c *Controller) Lookup(wsType logicalcluster.Path) (authenticator.Request, bool)

+ func (c *Controller) Start(ctx context.Context, numThreads int)

+ type ExtraFilter struct

+ AllowExtraKeys []string

+ Authenticator authenticator.Request

+ DropExtraKeyContains []string

+ func (a *ExtraFilter) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

+ type GroupFilter struct

+ Authenticator authenticator.Request

+ DropGroupPrefixes []string

+ DropGroups sets.Set[string]

+ PassOnGroupPrefixes []string

+ PassOnGroups sets.Set[string]

+ func (a *GroupFilter) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

Jun 1, 2022 GO-2024-3325 +2 more

  GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

  GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

  GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

Jun 1, 2022 GO-2024-3325 +2 more

  GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

  GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

  GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

May 3, 2022 GO-2024-3325 +2 more

  GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

  GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

  GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

Apr 1, 2022 GO-2024-3325 +2 more

  GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

  GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

  GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

Mar 28, 2022 GO-2024-3325 +2 more

  GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

  GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

  GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp