auth

Documentation

Index

• func AuthGate(kubeappsNamespace string) negroni.HandlerFunc
• func ExtractToken(headerValue string) string
• type Action
  • func ParseForbiddenActions(message string) []Action
• type Checker
  • func AuthCheckerForRequest(req *http.Request) (Checker, error)
• type CheckerForRequest
• type UserAuth
  • func NewAuth(token string) (*UserAuth, error)
  • func (u *UserAuth) GetForbiddenActions(namespace, action, manifest string) ([]Action, error)
  • func (u *UserAuth) ValidateForNamespace(namespace string) (bool, error)

Functions

func AuthGate

func AuthGate(kubeappsNamespace string) negroni.HandlerFunc

AuthGate implements middleware to check if the user has access to read from the specific namespace before continuing.

• If the path being handled by the AuthGate middleware does not include the 'namespace' mux var, or the value is _all, then the check is for cluster-wide access.
• If the namespace is the global chart namespace (ie. kubeappsNamespace) then we allow read access regardless.

func ExtractToken

func ExtractToken(headerValue string) string

ExtractToken extracts the token from a correctly formatted Authorization header.

Types

type Action

type Action struct {
	APIVersion  string   `json:"apiGroup"`
	Resource    string   `json:"resource"`
	Namespace   string   `json:"namespace"`
	ClusterWide bool     `json:"clusterWide"`
	Verbs       []string `json:"verbs"`
}

Action represents a specific set of verbs against a resource

func ParseForbiddenActions

func ParseForbiddenActions(message string) []Action

ParseForbiddenActions parses a forbidden error returned by the Kubernetes API and return the list of forbidden actions

type Checker

type Checker interface {
	ValidateForNamespace(namespace string) (bool, error)
	GetForbiddenActions(namespace, action, manifest string) ([]Action, error)
}

Checker for the exported funcs

func AuthCheckerForRequest

func AuthCheckerForRequest(req *http.Request) (Checker, error)

type CheckerForRequest

type CheckerForRequest func(req *http.Request) (Checker, error)

CheckerForRequest defines a function type so we can also inject a fake for tests rather than setting a context value.

type UserAuth

type UserAuth struct {
	// contains filtered or unexported fields
}

UserAuth contains information to check user permissions

func NewAuth

func NewAuth(token string) (*UserAuth, error)

NewAuth creates an auth agent

func (*UserAuth) GetForbiddenActions

func (u *UserAuth) GetForbiddenActions(namespace, action, manifest string) ([]Action, error)

GetForbiddenActions parses a K8s manifest and checks if the current user can do the action given over all the elements of the manifest. It return the list of forbidden Actions if any.

func (*UserAuth) ValidateForNamespace

func (u *UserAuth) ValidateForNamespace(namespace string) (bool, error)

ValidateForNamespace checks if the user can access secrets in the given namespace, as a check of whether they can view the namespace.