Documentation
¶
Overview ¶
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
Everything else an operator sees — the internal groups, what they add, the lifetimes, the clients, the intervals — is deployment configuration, shown read-only.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDeclared = errors.New("settings: declared by the deployment")
ErrDeclared is returned when the deployment owns what is being changed.
Functions ¶
This section is empty.
Types ¶
type Lazy ¶ added in v1.75.0
type Lazy struct {
// contains filtered or unexported fields
}
Lazy is a Store over a client read from the secrets the deployment names: on the first request that asks for it, and again once ttl has passed, so that opening the store reads no secret and a rotated secret takes effect without a restart. A read that fails is an error to that request and is tried again by the next.
func NewLazy ¶ added in v1.75.0
NewLazy returns a store that calls read when the client is first wanted.
func (*Lazy) OAuthClient ¶ added in v1.75.0
func (l *Lazy) OAuthClient(ctx context.Context) (OAuthClient, error)
OAuthClient implements Store.
type Memory ¶
type Memory struct {
// contains filtered or unexported fields
}
Memory is a Store in process memory: the prototype's, and the fake behind tests of the one that persists.
func NewMemory ¶
func NewMemory(declared OAuthClient) *Memory
NewMemory returns a store, optionally seeded with a declared client.
func (*Memory) OAuthClient ¶
func (m *Memory) OAuthClient(_ context.Context) (OAuthClient, error)
OAuthClient implements Store.
type OAuthClient ¶
type OAuthClient struct {
ID string
Secret string
// Declared marks a client the chart named, which the console shows
// but cannot change.
Declared bool
}
OAuthClient is the client an installation registered once with its directory backend: it drives both admin consent and operator sign-in.
func (OAuthClient) Configured ¶
func (c OAuthClient) Configured() bool
Configured reports whether both halves are present.
type Store ¶
type Store interface {
// OAuthClient returns the client, which may be unconfigured.
OAuthClient(ctx context.Context) (OAuthClient, error)
}
Store keeps what the deployment configured for the console to read.
It used to keep what the console WROTE — the OAuth client somebody pasted in, and the memberships layer. Neither is written any more: the client is a Secret, delivered the way every other credential in the estate is, and who is in which internal group is the policy, rendered from the installation's own access model and reviewed in git.
Source Files