tokenstorage

Documentation

Index

• Variables
• type NotifyingTokenStorage
  • func (n NotifyingTokenStorage) Delete(ctx context.Context, owner *api.SPIAccessToken) error
  • func (n NotifyingTokenStorage) Get(ctx context.Context, owner *api.SPIAccessToken) (token *api.Token, err error)
  • func (n NotifyingTokenStorage) Initialize(ctx context.Context) error
  • func (n NotifyingTokenStorage) Store(ctx context.Context, owner *api.SPIAccessToken, token *api.Token) error
• type TestTokenStorage
  • func (t TestTokenStorage) Delete(ctx context.Context, owner *api.SPIAccessToken) error
  • func (t TestTokenStorage) Get(ctx context.Context, owner *api.SPIAccessToken) (*api.Token, error)
  • func (t TestTokenStorage) Initialize(ctx context.Context) error
  • func (t TestTokenStorage) Store(ctx context.Context, owner *api.SPIAccessToken, token *api.Token) error
• type TokenStorage
  • func CreateTestVaultTokenStorage(t vtesting.T) (*vault.TestCluster, TokenStorage)
  • func CreateTestVaultTokenStorageWithAuthAndMetrics(t vtesting.T, metricsRegistry *prometheus.Registry) (*vault.TestCluster, TokenStorage, string, string)
  • func NewSecretsStorage(cl client.Client) (TokenStorage, error)
  • func NewVaultStorage(vaultTokenStorageConfig *VaultStorageConfig) (TokenStorage, error)
• type VaultAuthMethod
• type VaultCliArgs
• type VaultStorageConfig
  • func VaultStorageConfigFromCliArgs(args *VaultCliArgs) *VaultStorageConfig

Variables

var (
	VaultError = errors.New("error in Vault")
)

var VaultUnknownAuthMethodError = errors.New("unknown Vault authentication method")

Types

type NotifyingTokenStorage

type NotifyingTokenStorage struct {
	// Client is the kubernetes client to use to create the v1beta1.SPIAccessTokenDataUpdate objects.
	Client client.Client

	// TokenStorage is the token storage to delegate the actual storage operations to.
	TokenStorage TokenStorage
}

NotifyingTokenStorage is a wrapper around TokenStorage that also automatically creates the v1beta1.SPIAccessTokenDataUpdate objects.

func (NotifyingTokenStorage) Delete

func (n NotifyingTokenStorage) Delete(ctx context.Context, owner *api.SPIAccessToken) error

func (NotifyingTokenStorage) Get

func (n NotifyingTokenStorage) Get(ctx context.Context, owner *api.SPIAccessToken) (token *api.Token, err error)

func (NotifyingTokenStorage) Initialize

func (n NotifyingTokenStorage) Initialize(ctx context.Context) error

func (NotifyingTokenStorage) Store

func (n NotifyingTokenStorage) Store(ctx context.Context, owner *api.SPIAccessToken, token *api.Token) error

type TestTokenStorage

type TestTokenStorage struct {
	InitializeImpl func(context.Context) error
	StoreImpl      func(context.Context, *api.SPIAccessToken, *api.Token) error
	GetImpl        func(ctx context.Context, token *api.SPIAccessToken) (*api.Token, error)
	DeleteImpl     func(context.Context, *api.SPIAccessToken) error
}

func (TestTokenStorage) Delete

func (t TestTokenStorage) Delete(ctx context.Context, owner *api.SPIAccessToken) error

func (TestTokenStorage) Get

func (t TestTokenStorage) Get(ctx context.Context, owner *api.SPIAccessToken) (*api.Token, error)

func (TestTokenStorage) Initialize

func (t TestTokenStorage) Initialize(ctx context.Context) error

func (TestTokenStorage) Store

func (t TestTokenStorage) Store(ctx context.Context, owner *api.SPIAccessToken, token *api.Token) error

type TokenStorage

type TokenStorage interface {
	Initialize(ctx context.Context) error
	Store(ctx context.Context, owner *api.SPIAccessToken, token *api.Token) error
	Get(ctx context.Context, owner *api.SPIAccessToken) (*api.Token, error)
	Delete(ctx context.Context, owner *api.SPIAccessToken) error
}

TokenStorage is a simple interface on top of Kubernetes client to perform CRUD operations on the tokens. This is done so that we can provide either secret-based or Vault-based implementation.

func CreateTestVaultTokenStorage

func CreateTestVaultTokenStorage(t vtesting.T) (*vault.TestCluster, TokenStorage)

func CreateTestVaultTokenStorageWithAuthAndMetrics

func CreateTestVaultTokenStorageWithAuthAndMetrics(t vtesting.T, metricsRegistry *prometheus.Registry) (*vault.TestCluster, TokenStorage, string, string)

func NewSecretsStorage

func NewSecretsStorage(cl client.Client) (TokenStorage, error)

NewSecretsStorage creates a new `TokenStorage` instance using the provided Kubernetes client.

func NewVaultStorage

func NewVaultStorage(vaultTokenStorageConfig *VaultStorageConfig) (TokenStorage, error)

NewVaultStorage creates a new `TokenStorage` instance using the provided Vault instance.

type VaultAuthMethod

type VaultAuthMethod string

const (
	VaultAuthMethodKubernetes VaultAuthMethod = "kubernetes"
	VaultAuthMethodApprole    VaultAuthMethod = "approle"
)

type VaultCliArgs

type VaultCliArgs struct {
	VaultHost                      string          `arg:"--vault-host, env" help:"Mandatory Vault host URL."`
	VaultInsecureTLS               bool            `` /* 150-byte string literal not displayed */
	VaultAuthMethod                VaultAuthMethod `` /* 135-byte string literal not displayed */
	VaultApproleRoleIdFilePath     string          `` /* 131-byte string literal not displayed */
	VaultApproleSecretIdFilePath   string          `` /* 137-byte string literal not displayed */
	VaultKubernetesSATokenFilePath string          `` /* 274-byte string literal not displayed */
	VaultKubernetesRole            string          `` /* 132-byte string literal not displayed */
}

type VaultStorageConfig

type VaultStorageConfig struct {
	Host     string
	AuthType VaultAuthMethod
	Insecure bool

	Role                        string
	ServiceAccountTokenFilePath string

	RoleIdFilePath   string
	SecretIdFilePath string

	MetricsRegisterer prometheus.Registerer
}

func VaultStorageConfigFromCliArgs

func VaultStorageConfigFromCliArgs(args *VaultCliArgs) *VaultStorageConfig

VaultStorageConfigFromCliArgs returns an instance of the VaultStorageConfig with some fields initialized from the corresponding CLI arguments. Notably, the VaultStorageConfig.MetricsRegisterer is NOT configured, because this cannot be done using just the CLI arguments.