Documentation
¶
Overview ¶
Package workloadidentity owns the production provider-action workload capability exchange. The hub does not parse or trust JWTs locally: an Attestor performs the provider-owned bootstrap review, after which this package asks the service-account manager for a short-lived, audience-bound TokenRequest credential.
Index ¶
Constants ¶
const ( // PathExchange is the only production workload-identity route. There is // intentionally no compatibility alias for the prototype action endpoint. PathExchange = "/api/provider-actions/workload/exchange" // InfrastructureProviderName is the provider that owns bootstrap review and // runtime identity attestation. Its URL is looked up from the catalog, not // hardcoded in this package. InfrastructureProviderName = "infrastructure" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Attestor ¶
Attestor verifies the bootstrap bearer and identity tuple. Implementations must perform online/provider-owned verification; the hub never performs offline JWT signature or claim validation itself.
type AttestorFunc ¶
AttestorFunc adapts a function to Attestor and keeps focused handler tests independent of provider networking.
func (AttestorFunc) Verify ¶
func (f AttestorFunc) Verify(ctx context.Context, bearer string, req ExchangeRequest) (Review, error)
Verify implements Attestor.
type ExchangeRequest ¶
type ExchangeRequest struct {
TenantPath string `json:"tenantPath"`
Project string `json:"project"`
ProjectUID string `json:"projectUID"`
Environment string `json:"environment"`
Instance string `json:"instance"`
}
ExchangeRequest is the frozen v1 body accepted by POST PathExchange. The body is strict: unknown fields are rejected so callers cannot smuggle an alternate audience, action, or resource selector into the review.
type HTTPAttestor ¶
type HTTPAttestor struct {
// contains filtered or unexported fields
}
HTTPAttestor is the hub-side online attestor. It resolves the Infrastructure provider's declared virtual-workspace URL from the catalog and forwards the same bearer/body to /workload-identities/review. It does not parse JWTs or retain provider credentials.
func NewHTTPAttestor ¶
func NewHTTPAttestor(opts HTTPAttestorOptions) *HTTPAttestor
NewHTTPAttestor constructs an online Infrastructure review client.
func (*HTTPAttestor) Verify ¶
func (a *HTTPAttestor) Verify(ctx context.Context, bearer string, req ExchangeRequest) (Review, error)
Verify implements Attestor.
type HTTPAttestorOptions ¶
type HTTPAttestorOptions struct {
Registry ProviderLookup
Client *http.Client
Timeout time.Duration
}
HTTPAttestorOptions configures HTTPAttestor.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler serves POST PathExchange.
type KCPProjectScopeResolver ¶
type KCPProjectScopeResolver struct {
// contains filtered or unexported fields
}
KCPProjectScopeResolver reads tenant Project objects through a child workspace config. The config builder is the same hub bootstrap seam used by ServiceAccount issuance, so no provider credential or static secret is introduced.
func NewKCPProjectScopeResolver ¶
func NewKCPProjectScopeResolver(config serviceaccounts.WorkspaceConfigBuilder) *KCPProjectScopeResolver
NewKCPProjectScopeResolver constructs a KCP-backed resolver.
func NewProjectScopeResolverForClient ¶
func NewProjectScopeResolverForClient(client dynamic.Interface) *KCPProjectScopeResolver
NewProjectScopeResolverForClient is a focused test/in-process seam. The production hub uses NewKCPProjectScopeResolver so each request targets the selected child workspace; this constructor never changes the verification rules and is useful for deterministic resolver tests.
func (*KCPProjectScopeResolver) Resolve ¶
func (r *KCPProjectScopeResolver) Resolve(ctx context.Context, orgUUID, wsUUID string, req ExchangeRequest) (serviceaccounts.WorkloadIdentityScope, error)
Resolve verifies Project UID, environment, and instance membership, then returns providerReference (plus the matching owned instance binding) scopes.
type Options ¶
type Options struct {
Attestor Attestor
Issuer TokenIssuer
ScopeResolver ProjectScopeResolver
ReviewTimeout time.Duration
Logger logr.Logger
}
Options configures the exchange handler.
type ProjectScopeResolver ¶
type ProjectScopeResolver interface {
Resolve(context.Context, string, string, ExchangeRequest) (serviceaccounts.WorkloadIdentityScope, error)
}
ProjectScopeResolver verifies the request's Project object and derives the exact provider-resource references authorized by the selected environment. The exchange never accepts provider GVR/name data from the caller.
type ProviderLookup ¶
ProviderLookup is the minimal catalog seam needed by HTTPAttestor.
type Review ¶
type Review struct {
Authenticated bool `json:"authenticated"`
Subject string `json:"subject"`
Namespace string `json:"namespace"`
ServiceAccount string `json:"serviceAccount"`
}
Review is the provider-owned bootstrap-attestation result. The provider must authenticate the bearer and verify every field in ExchangeRequest; the hub only accepts an authenticated result with a complete source identity.
type TokenIssuer ¶
type TokenIssuer interface {
EnsureWorkloadIdentity(context.Context, string, string, serviceaccounts.WorkloadIdentityScope) (*serviceaccounts.WorkloadIdentityToken, error)
}
TokenIssuer is the narrow service-account seam used by the exchange. The concrete serviceaccounts.Manager creates the deterministic SA, reconciles scoped GET-only RBAC, and calls TokenRequest with a fixed audience/TTL.
Source Files