Documentation
¶
Overview ¶
Package clientauth holds the auth and TLS plumbing shared by Berth components that talk to the central API server as clients: the operator, and the injected berth-acquire helper. It deliberately avoids controller-runtime and other heavy dependencies so it can be linked into the small, distroless berth-acquire image.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LoadTLSConfig ¶
LoadTLSConfig builds a *tls.Config for the Berth API client. The CA bundle file is appended to the system trust store so a private CA can coexist with publicly-trusted issuers (e.g. a corporate Ingress chain). An empty caBundleFile yields a config with no extra roots — the system trust store is used as-is. serverName, when non-empty, overrides the SNI / certificate name verification (useful when the API server is reached through a port-forward or a non-DNS hostname).
Types ¶
type FileTokenSource ¶
type FileTokenSource struct {
// contains filtered or unexported fields
}
FileTokenSource reads a bearer token from a file each time the cached value goes stale. It exists so the operator can present a refreshing JWT minted by an external sidecar (typically an OIDC token broker) without re-implementing the IdP integration in the operator itself.
The file is expected to contain just the raw token (whitespace is trimmed). On read errors the previously-cached token is returned; callers can detect prolonged staleness via the API server returning 401, which is handled by the standard reconciler retry/backoff.
func NewFileTokenSource ¶
func NewFileTokenSource(path string, cacheTTL time.Duration) (*FileTokenSource, error)
NewFileTokenSource returns a FileTokenSource that reads from path. cacheTTL bounds how often the file is re-read; a small value (e.g. 1s) is a safe default — file-system reads are cheap, and a fresh rotation written by a sidecar will be picked up within one TTL window.
func (*FileTokenSource) Get ¶
func (s *FileTokenSource) Get() string
Get returns the current token. It re-reads the file when the cached value is older than cacheTTL. On read error the previously-cached token is returned (the operator's reconcile retry will surface repeated failures via 401s).
Source Files