per_container_roles

Documentation

Index

• Constants
• Variables
• func AllIssuesHandlers(e *Endpoint) (http.HandlerFunc, http.HandlerFunc, http.HandlerFunc)
• func DenyXForwardedFor(w http.ResponseWriter, r *http.Request) bool
• func GenerateCredentials(token string, upstreamRoleName string, roleArn string, roleSessionName string) (*stsTypes.Credentials, error)
• func GetRemoteIP(r *http.Request) (string, error)
• func GetRemoteIPFromRequest(r *http.Request) (string, error)
• func Serve(port int, listenAddress string, dockerNetwork string)
• func VerifyToken(w http.ResponseWriter, r *http.Request) (string, string, error)
• type ContainerWithCreds
  • func (c *ContainerWithCreds) UpdateCreds(creds RefreshableCred)
• type Endpoint
  • func (e *Endpoint) AddContainer(id string, role string, ip string) error
  • func (e *Endpoint) ConfigureFromDocker(cli *client.Client, ctx context.Context) (chan string, chan error)
  • func (e *Endpoint) CredsByIP(ip string) (*ContainerWithCreds, bool)
  • func (e *Endpoint) LoadContainersFromDocker(cli *client.Client, ctx context.Context) error
  • func (e *Endpoint) MonitorNetworkEvents(cli *client.Client, ctx context.Context)
  • func (e *Endpoint) RemoveAllContainers()
  • func (e *Endpoint) RemoveContainer(id string)
• type RefreshableCred
  • func GetUpstreamCreds(token string, upstreamRoleName string) (RefreshableCred, error)

Constants

const DEFAULT_TOKEN_TTL_SECONDS = "21600"

const DefaultDockerNetwork = "bridge"

const DefaultLocalHostAddress = "127.0.0.1"

const DefaultPort = 9912

const EC2_METADATA_TOKEN_HEADER = "x-aws-ec2-metadata-token"

const EC2_METADATA_TOKEN_TTL_HEADER = "x-aws-ec2-metadata-token-ttl-seconds"

const REFRESHABLE_CRED_CODE = "Success"

const REFRESHABLE_CRED_TYPE = "AWS-HMAC"

const SECURITY_CREDENTIALS_RESOURCE_PATH = "/latest/meta-data/iam/security-credentials/"

const TOKEN_RESOURCE_PATH = "/latest/api/token"

const X_FORWARDED_FOR_HEADER = "X-Forwarded-For"

Variables

var RefreshTime = time.Minute * time.Duration(5)

Functions

func AllIssuesHandlers

func AllIssuesHandlers(e *Endpoint) (http.HandlerFunc, http.HandlerFunc, http.HandlerFunc)

func DenyXForwardedFor

func DenyXForwardedFor(w http.ResponseWriter, r *http.Request) bool

func GenerateCredentials

func GenerateCredentials(token string, upstreamRoleName string, roleArn string, roleSessionName string) (*stsTypes.Credentials, error)

func GetRemoteIP

func GetRemoteIP(r *http.Request) (string, error)

func GetRemoteIPFromRequest

func GetRemoteIPFromRequest(r *http.Request) (string, error)

func Serve

func Serve(port int, listenAddress string, dockerNetwork string)

func VerifyToken

func VerifyToken(w http.ResponseWriter, r *http.Request) (string, string, error)

Types

type ContainerWithCreds

type ContainerWithCreds struct {
	IPAddress       string
	RoleARN         string
	RoleName        string
	RoleSessionName string
	Creds           RefreshableCred
	Mutex           sync.Mutex
}

func (*ContainerWithCreds) UpdateCreds

func (c *ContainerWithCreds) UpdateCreds(creds RefreshableCred)

type Endpoint

type Endpoint struct {
	PortNum          int
	Server           *http.Server
	NetworkID        string
	ByContainer      map[string]*ContainerWithCreds
	ByContainerMutex sync.Mutex
}

func (*Endpoint) AddContainer

func (e *Endpoint) AddContainer(id string, role string, ip string) error

func (*Endpoint) ConfigureFromDocker

func (e *Endpoint) ConfigureFromDocker(cli *client.Client, ctx context.Context) (chan string, chan error)

func (*Endpoint) CredsByIP

func (e *Endpoint) CredsByIP(ip string) (*ContainerWithCreds, bool)

func (*Endpoint) LoadContainersFromDocker

func (e *Endpoint) LoadContainersFromDocker(cli *client.Client, ctx context.Context) error

func (*Endpoint) MonitorNetworkEvents

func (e *Endpoint) MonitorNetworkEvents(cli *client.Client, ctx context.Context)

func (*Endpoint) RemoveAllContainers

func (e *Endpoint) RemoveAllContainers()

func (*Endpoint) RemoveContainer

func (e *Endpoint) RemoveContainer(id string)

type RefreshableCred

type RefreshableCred struct {
	AccessKeyId     string
	SecretAccessKey string
	Token           string    // SessionToken
	Code            string    // REFRESHABLE_CRED_CODE
	Type            string    // REFRESHABLE_CRED_TYPE
	Expiration      time.Time // time.Parse(time.RFC3339, credentialProcessOutput.Expiration)
	LastUpdated     time.Time // time.Now()
}

func GetUpstreamCreds

func GetUpstreamCreds(token string, upstreamRoleName string) (RefreshableCred, error)