Documentation
¶
Overview ¶
Package execcredential builds Kubernetes client-go ExecCredential payloads from scafctl auth tokens. It deliberately hand-rolls the tiny JSON schema so that scafctl core never imports client-go.
The ExecCredential is the response format of a kubectl/oc exec credential plugin: kubectl invokes the plugin, the plugin prints this JSON to stdout, and kubectl reads status.token as the bearer token for the API server. See https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
Index ¶
Constants ¶
const ( // Kind is the ExecCredential resource kind. Kind = "ExecCredential" // DefaultAPIVersion is the client.authentication.k8s.io API version used // when kubectl does not advertise one via KUBERNETES_EXEC_INFO. DefaultAPIVersion = "client.authentication.k8s.io/v1" // ExecInfoEnv is the environment variable kubectl sets when it invokes an // exec credential plugin. Its presence signals that exec-credential output // is expected even without an explicit flag. ExecInfoEnv = "KUBERNETES_EXEC_INFO" )
Variables ¶
This section is empty.
Functions ¶
func APIVersionFromExecInfo ¶
APIVersionFromExecInfo extracts the client.authentication.k8s.io API version that kubectl requested from a KUBERNETES_EXEC_INFO payload. It returns DefaultAPIVersion when the payload is empty, unparseable, or advertises an apiVersion outside the client.authentication.k8s.io group. Echoing the requested version keeps the plugin compatible with both v1 and v1beta1 clusters without importing client-go.
func ClusterServerFromExecInfo ¶ added in v0.31.0
ClusterServerFromExecInfo extracts spec.cluster.server (the target API server URL) from a KUBERNETES_EXEC_INFO payload. kubectl/oc only populate the cluster block when the kubeconfig exec entry sets provideClusterInfo: true. The returned value is the exact server string from the kubeconfig cluster entry, so it matches the hostname a cluster-aware handler stored at login time and can be used verbatim as a per-cluster token selector. It returns "" when the payload is empty, unparseable, or carries no cluster server.
Types ¶
type ExecCredential ¶
type ExecCredential struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
Status Status `json:"status"`
}
ExecCredential is the client-go credential plugin response envelope.
func NewWithAPIVersion ¶
func NewWithAPIVersion(apiVersion, token string, expiresAt time.Time) ExecCredential
NewWithAPIVersion builds an ExecCredential with an explicit API version. An empty apiVersion falls back to DefaultAPIVersion.
func (ExecCredential) JSON ¶
func (e ExecCredential) JSON() ([]byte, error)
JSON marshals the ExecCredential to its on-the-wire JSON form.
Source Files