Documentation
¶
Overview ¶
Package identity builds the cross-workspace ServiceAccount identity railgrid authorizes foreign SAs under.
kcp ServiceAccount usernames ("system:serviceaccount:{ns}:{name}") are logical-cluster-scoped — the same string means a DIFFERENT principal in every workspace, so binding RBAC to it in a tenant workspace would also match a same-named SA the tenant created themselves.
kcp already defines the disambiguated form: the GlobalServiceAccount feature gate (beta, default-on since kube 1.35 in the kcp fork) makes kcp's RBAC resolution alias every SA to
system:kcp:serviceaccount:{cluster}:{ns}:{name}
(see EffectiveUsers in the fork's pkg/registry/rbac/validation/kcp.go and kcp's e2e TestAPIResourceSchemaVirtualWorkspaceAuthorization, which binds exactly this subject across workspaces). Railgrid emits the same format — after verifying the home cluster via TokenReview — so the grant objects created on tenant Enable use kcp-native subjects: the same binding that satisfies railgrid's delegated SAR also authorizes the SA on kcp-native paths.
Both sides — the SAR caller in pkg/virtual/builder and the grant writer in pkg/hub/kcp — MUST use these helpers so the encodings cannot drift.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LocalFromQualified ¶
LocalFromQualified strips the home-cluster segment from a global SA username ("system:kcp:serviceaccount:{cluster}:{ns}:{name}") to produce the plain local form ("system:serviceaccount:{ns}:{name}") — the form kcp uses when it does NOT qualify a ServiceAccount to a home cluster (e.g. the token carries no verified cluster claim). Grant writers bind this ALONGSIDE the qualified form so a cross-workspace provider SA is authorized whether or not kcp qualified it on the request path. Returns false if s is not a global SA username.
func QualifiedServiceAccount ¶
QualifiedServiceAccount builds the global username from parts. Used by the grant writer, which knows the SA's coordinates rather than holding a TokenReview result.
func QualifyServiceAccount ¶
QualifyServiceAccount converts a TokenReview-resolved ServiceAccount username ("system:serviceaccount:{ns}:{name}") plus its verified home logical cluster into kcp's global form "system:kcp:serviceaccount:{homeCluster}:{ns}:{name}".
Returns false when saUsername is not a ServiceAccount username.
Types ¶
type StaticToken ¶
type StaticToken struct {
// Sub is the 63-char value stored in the User CR's
// tenants.railgrid.ai/sub label (a label value's maximum length).
Sub string
// UID is the short hash kcp's token-auth file records as the uid.
UID string
// RBACIdentity is the kcp username the token authenticates as,
// "railgrid:static:<uid>". It is also the User's display name.
RBACIdentity string
// UserName is the User CR name, "static-user-<uid>".
UserName string
}
StaticToken is everything railgrid derives from a static bearer token. Every field is a hash of the token, never the token text: the User CR and its email/display name are readable by fellow org members, so anything built from the token itself would hand them a working credential.
The hub proxy (pkg/server/proxy), the embedded kcp token-auth file (pkg/hub/kcp) and the dev setup (pkg/cli/cmd/dev/plugin) MUST all use this so the User CR, the kcp-authenticated username and --admin-users agree.
func NewStaticToken ¶
func NewStaticToken(token string) StaticToken
NewStaticToken derives the identity for a static bearer token.
Source Files