authn

Documentation

Index

• type AuthnConfig
• type AuthnHeaderConfig
• type DelegatingAuthenticator
  • func NewDelegatingAuthenticator(client authenticationclient.AuthenticationV1Interface, authn *AuthnConfig) (*DelegatingAuthenticator, error)
  • func (a *DelegatingAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)
  • func (a *DelegatingAuthenticator) Run(ctx context.Context)
• type OIDCAuthenticator
  • func NewOIDCAuthenticator(ctx context.Context, config *OIDCConfig) (*OIDCAuthenticator, error)
  • func (o *OIDCAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)
  • func (o *OIDCAuthenticator) Run(ctx context.Context)
• type OIDCConfig
• type TokenConfig
• type X509Config

Types

type AuthnConfig

type AuthnConfig struct {
	X509   *X509Config
	Header *AuthnHeaderConfig
	OIDC   *OIDCConfig
	Token  *TokenConfig
}

AuthnConfig holds all configurations related to authentication options

type AuthnHeaderConfig

type AuthnHeaderConfig struct {
	// When set to true, kube-rbac-proxy adds auth-related fields to the headers of http requests sent to the upstream
	Enabled bool
	// Corresponds to the name of the field inside a http(2) request header
	// to tell the upstream server about the user's name
	UserFieldName string
	// Corresponds to the name of the field inside a http(2) request header
	// to tell the upstream server about the user's groups
	GroupsFieldName string
	// The separator string used for concatenating multiple group names in a groups header field's value
	GroupSeparator string
}

AuthnHeaderConfig contains authentication header settings which enable more information about the user identity to be sent to the upstream

type DelegatingAuthenticator

type DelegatingAuthenticator struct {
	// contains filtered or unexported fields
}

func NewDelegatingAuthenticator

func NewDelegatingAuthenticator(client authenticationclient.AuthenticationV1Interface, authn *AuthnConfig) (*DelegatingAuthenticator, error)

NewDelegatingAuthenticator creates an authenticator compatible with the kubelet's needs

func (*DelegatingAuthenticator) AuthenticateRequest

func (a *DelegatingAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

func (*DelegatingAuthenticator) Run

func (a *DelegatingAuthenticator) Run(ctx context.Context)

type OIDCAuthenticator

type OIDCAuthenticator struct {
	// contains filtered or unexported fields
}

func NewOIDCAuthenticator

func NewOIDCAuthenticator(ctx context.Context, config *OIDCConfig) (*OIDCAuthenticator, error)

NewOIDCAuthenticator returns OIDC authenticator

func (*OIDCAuthenticator) AuthenticateRequest

func (o *OIDCAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

func (*OIDCAuthenticator) Run

func (o *OIDCAuthenticator) Run(ctx context.Context)

type OIDCConfig

type OIDCConfig struct {
	IssuerURL            string
	ClientID             string
	CAFile               string
	UsernameClaim        string
	UsernamePrefix       string
	GroupsClaim          string
	GroupsPrefix         string
	SupportedSigningAlgs []string
}

OIDCConfig represents configuration used for JWT request authentication

type TokenConfig

type TokenConfig struct {
	Audiences []string
}

TokenConfig holds configuration as to how token authentication is to be done

type X509Config

type X509Config struct {
	ClientCAFile              string
	UpstreamClientCertificate string
	UpstreamClientKey         string
}

X509Config holds public client certificate used for authentication requests if specified