auth

Documentation

Overview

Package auth contains structures, interfaces and utility functions useful for both server and client authentication agents.

Index

• Constants
• func GenerateToken() (string, error)
• func GetToken(ctx context.Context, c client.Client, namespace string) (string, error)
• func GetTokenFromSecret(secret *v1.Secret) (string, error)
• type AWSIdentityInfo
• type CertificateIdentityRequest
  • func NewCertificateIdentityRequest(cluster discoveryv1alpha1.ClusterIdentity, originClusterToken, token string, ...) *CertificateIdentityRequest
  • func (certIdentityRequest *CertificateIdentityRequest) GetClusterIdentity() discoveryv1alpha1.ClusterIdentity
  • func (certIdentityRequest *CertificateIdentityRequest) GetPath() string
  • func (certIdentityRequest *CertificateIdentityRequest) GetToken() string
• type CertificateIdentityResponse
  • func NewCertificateIdentityResponse(namespace string, identityResponse *responsetypes.SigningRequestResponse, ...) (*CertificateIdentityResponse, error)
  • func (resp *CertificateIdentityResponse) HasAWSValues() bool
• type ClusterInfo
• type IdentityRequest
• type ServiceAccountIdentityRequest
  • func (saIdentityRequest *ServiceAccountIdentityRequest) GetClusterIdentity() discoveryv1alpha1.ClusterIdentity
  • func (saIdentityRequest *ServiceAccountIdentityRequest) GetPath() string
  • func (saIdentityRequest *ServiceAccountIdentityRequest) GetToken() string

Constants

const (
	// IdsURI is the path where to contact the Authentication Service to get the clusterID.
	IdsURI = "/ids"
	// IdentityURI is the path where to contact the Authentication Service
	// to have a ServiceAccont Identity.
	IdentityURI = "/identity"
	// CertIdentityURI is the path where to contact the Authentication Service
	// to have a Certificate Identity.
	CertIdentityURI = "/identity/certificate"
)

const (
	// TokenSecretName is the name of the secret containing the authentication token for the local cluster.
	TokenSecretName = "auth-token"
)

Functions

func GenerateToken

func GenerateToken() (string, error)

GenerateToken generates a random authentication token.

func GetToken

func GetToken(ctx context.Context, c client.Client, namespace string) (string, error)

GetToken retrieves the token for the local cluster.

func GetTokenFromSecret

func GetTokenFromSecret(secret *v1.Secret) (string, error)

GetTokenFromSecret retrieves the token for the local cluster given its secret.

Types

type AWSIdentityInfo

type AWSIdentityInfo struct {
	AccessKeyID     string `json:"accessKeyID"`
	SecretAccessKey string `json:"secretAccessKey"`
	Region          string `json:"region"`
	EKSClusterID    string `json:"eksClusterID"`
	IAMUserArn      string `json:"iamUserArn"`
}

AWSIdentityInfo contains the information required by a cluster to get a valied IAM-based identity.

type CertificateIdentityRequest

type CertificateIdentityRequest struct {
	ClusterIdentity discoveryv1alpha1.ClusterIdentity `json:"cluster"`
	// OriginClusterToken will be used by the remote cluster to obtain an identity to send us its ResourceOffers
	// and NetworkConfigs.
	OriginClusterToken        string `json:"originClusterToken,omitempty"`
	DestinationClusterToken   string `json:"destinationClusterToken"`
	CertificateSigningRequest string `json:"certificateSigningRequest"`
}

CertificateIdentityRequest is the request for a new certificate validation.

func NewCertificateIdentityRequest

func NewCertificateIdentityRequest(cluster discoveryv1alpha1.ClusterIdentity, originClusterToken, token string,
	certificateSigningRequest []byte) *CertificateIdentityRequest

NewCertificateIdentityRequest creates and returns a new CertificateIdentityRequest.

func (*CertificateIdentityRequest) GetClusterIdentity

func (certIdentityRequest *CertificateIdentityRequest) GetClusterIdentity() discoveryv1alpha1.ClusterIdentity

GetClusterIdentity returns the ClusterIdentity.

func (*CertificateIdentityRequest) GetPath

func (certIdentityRequest *CertificateIdentityRequest) GetPath() string

GetPath returns the absolute path of the endpoint to contact to send a new CertificateIdentityRequest.

func (*CertificateIdentityRequest) GetToken

func (certIdentityRequest *CertificateIdentityRequest) GetToken() string

GetToken returns the token.

type CertificateIdentityResponse

type CertificateIdentityResponse struct {
	Namespace    string `json:"namespace"`
	Certificate  string `json:"certificate,omitempty"`
	APIServerURL string `json:"apiServerUrl"`
	APIServerCA  string `json:"apiServerCA,omitempty"`

	AWSIdentityInfo AWSIdentityInfo `json:"aws,omitempty"`
}

CertificateIdentityResponse is the response on a certificate identity request.

func NewCertificateIdentityResponse

func NewCertificateIdentityResponse(
	namespace string, identityResponse *responsetypes.SigningRequestResponse,
	apiServerConfig apiserver.Config) (*CertificateIdentityResponse, error)

NewCertificateIdentityResponse makes a new CertificateIdentityResponse.

func (*CertificateIdentityResponse) HasAWSValues

func (resp *CertificateIdentityResponse) HasAWSValues() bool

HasAWSValues checks if the response has all the required AWS fields set.

type ClusterInfo

type ClusterInfo struct {
	ClusterID   string `json:"clusterId"`
	ClusterName string `json:"clusterName,omitempty"`
}

ClusterInfo contains the information to be shared to a remote cluster to make the peering possible.

type IdentityRequest

type IdentityRequest interface {
	GetClusterIdentity() discoveryv1alpha1.ClusterIdentity
	GetToken() string
	GetPath() string
}

IdentityRequest is the common interface for Certificate and ServiceAccount identity request.

type ServiceAccountIdentityRequest

type ServiceAccountIdentityRequest struct {
	ClusterIdentity discoveryv1alpha1.ClusterIdentity `json:"cluster"`
	Token           string                            `json:"token"`
}

ServiceAccountIdentityRequest is the request for a new ServiceAccount validation.

func (*ServiceAccountIdentityRequest) GetClusterIdentity

func (saIdentityRequest *ServiceAccountIdentityRequest) GetClusterIdentity() discoveryv1alpha1.ClusterIdentity

GetClusterIdentity returns the ClusterIdentity.

func (*ServiceAccountIdentityRequest) GetPath

func (saIdentityRequest *ServiceAccountIdentityRequest) GetPath() string

GetPath returns the absolute path of the endpoint to contact to send a new ServiceAccountIdentityRequest.

func (*ServiceAccountIdentityRequest) GetToken

func (saIdentityRequest *ServiceAccountIdentityRequest) GetToken() string

GetToken returns the token.