Documentation
¶
Overview ¶
Package modserve is the listener a GitHub or Slack module answers the issuer on, on Kubernetes (docs/decisions/0071): `POST /rpc` with a projected ServiceAccount token that a TokenReview accepts for the module's audience and that belongs to the issuer's ServiceAccount. It is what the Cloudflare module's listener is, with the caller's class decided by who the subject is and not by what its ServiceAccount is called.
Index ¶
- Constants
- func Address(s *config.ModuleServe) string
- func Audience(module string, s *config.ModuleServe) string
- func Mux(s *modcall.Server, verify modcall.Verifier, issuers []string) http.Handler
- func NewVerifier(audience string) (modcall.Verifier, error)
- func Reviewer(...) modcall.Verifier
- func Serve(ctx context.Context, serve *config.ModuleServe, s *modcall.Server, ...) error
Constants ¶
const DefaultAddress = ":8081"
DefaultAddress is the listener when the document names none: the chart's `modules.<m>.rpcPort`.
const HealthPath = "/healthz"
HealthPath answers 200 on the listener, for the probes.
Variables ¶
This section is empty.
Functions ¶
func Audience ¶
func Audience(module string, s *config.ModuleServe) string
Audience is the audience a caller's token must have been minted for.
func Mux ¶
Mux is the module's listener: the calls at modcall.RPCPath, which verify refuses before they reach a method and which only the issuers may make, and a health endpoint that needs no credential and tells nothing.
func NewVerifier ¶
NewVerifier checks a caller's projected ServiceAccount token with a TokenReview for the audience: a token minted for another audience, such as the pod's default one, is refused.
Types ¶
This section is empty.
Source Files