Documentation
¶
Overview ¶
Package consoleauth is how a controller proves itself to the console.
In a cluster it is the pod's projected ServiceAccount token, read afresh on every call. On Lambda there is none, and the proof is the function role's outbound web identity token (`sts:GetWebIdentityToken`), scoped to the console's own audience (distinct from the token exchange's), and reused for under four minutes (the issuer refuses a token older than its maxAge) so a pass that calls the console many times asks STS once.
The issuer verifies the token against the account's published key set, with the same verifier token exchange uses, and the policy's `aws` matchers decide what the role may do (docs/reference/sluis/lambda.md).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Interceptor ¶
Interceptor presents the source's token as the bearer of every call.
func Unary ¶
func Unary(src Source) connect.UnaryInterceptorFunc
Unary is Interceptor as the interceptor itself.
Types ¶
type AWS ¶
type AWS struct {
// contains filtered or unexported fields
}
AWS is the function role's web identity token, for one audience.
func NewAWS ¶
NewAWS connects with the function's role. The audience must equal the issuer's `console.awsAudience`, not the AWS federation file's.
The source is shared by audience for the life of the process: a function assembles its controller per invocation, and a warm execution environment should reuse the token, not ask STS again.
func NewAWSWith ¶
NewAWSWith is NewAWS over a client and a clock the caller made.
type File ¶
type File string
File reads a projected token afresh each time: the kubelet rotates it under the pod.
Source Files