Documentation
¶
Overview ¶
Package identity is the controller for KindIdentity (ADR-0135, FEAT-0008/F100): a user-assigned managed identity whose reconciler issues a revocable SigV4 credential — a stable access key (IdentityAccessKey) plus a generated, rotatable secret written to an owned Secret. The S3 gateway's store-backed ExternalKeys (this package's storeExternalKeys) resolves an Identity-issued key back to its secret so the caller authenticates and resolves to the Identity::"<ns>/<name>" Cedar principal. Issuing a credential is authentication only; authorization is a separate RolesAssignment (ADR-0136).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewExternalKeys ¶
func NewExternalKeys(s store.Store) s3gateway.ExternalKeys
NewExternalKeys builds the store-backed ExternalKeys for the S3 gateway's Deps.External seam.
Types ¶
type Reconciler ¶
type Reconciler struct {
// contains filtered or unexported fields
}
Reconciler is the controller.Reconciler for KindIdentity.
func NewReconciler ¶
func NewReconciler(d ReconcilerDeps) (*Reconciler, error)
NewReconciler builds the Identity reconciler. Store is required.
func (*Reconciler) Reconcile ¶
func (r *Reconciler) Reconcile(ctx context.Context, req controller.Request) (controller.Result, error)
Reconcile issues/rotates an Identity's credential (idempotent, at-least-once). A deleted Identity (NotFound) needs no teardown — the owner garbage collector deletes its Secret (ADR-0170), and the store-backed ExternalKeys lookup naturally fails for a missing Identity, so the credential stops authenticating.
type ReconcilerDeps ¶
type ReconcilerDeps struct {
Store store.Store
Logger *slog.Logger
// SupervisionPeriod requeues an Identity refused a Secret it does not own; 0 ⇒ controller.SupervisionPeriod.
SupervisionPeriod time.Duration
}
ReconcilerDeps configures the Identity reconciler. Store is required.
Source Files