auth

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 19, 2021 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CreateSvc 

func CreateSvc(ctx context.Context, cs SecureStackCreator, oClient *OIDCClient, opts ProxyOpts) (*corev1.Service, error)

func GetGoCloakClient 

func GetGoCloakClient(ctx context.Context, cs SecureStackCreator, ns, chartName, ingPrefix string) (gocloak.GoCloak, *gocloak.JWT, string, error)

GetGoCloakClient can return a gocloak "client" (gocloak.GoCloak) based on the keycloak installation provided by the bitnami keycloak

func ReplaceWithOauth2Proxy 

func ReplaceWithOauth2Proxy(ctx context.Context, cs SecureStackCreator, ing *networkv1.Ingress, oid OIDCCreator, opts ProxyOpts) error

ReplaceWithOauth2Proxy replaces an ingress with the oauth2 proxy.

Types

type BitnamiHelmKCCreator 

type BitnamiHelmKCCreator struct {
	Kube          SecureStackCreator
	Namespace     string `json:"namespace"`
	Name          string `json:"name"`
	IngressPrefix string `json:"ingressPrefix"`
	Realm         string `json:"realm"`
}

func (*BitnamiHelmKCCreator) CreateOIDCClient 

func (bh *BitnamiHelmKCCreator) CreateOIDCClient(ctx context.Context, c *gocloak.Client) (*OIDCClient, error)

type DeploymentCreator 

type DeploymentCreator interface {
	CreateDeployment(ctx context.Context, dep *appsv1.Deployment) (*appsv1.Deployment, error)
}

A DeploymentCreator can create a k8s deployment

type HelmRedis 

type HelmRedis struct {
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

HelmRedis indicates the namespace and helm template name prefix used to create the redis.

type IngressCreator 

type IngressCreator interface {
	CreateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)
	UpdateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)
}

A IngressCreator can create a k8s ingress

type IngressLister 

type IngressLister interface {
	ListIngresses(ctx context.Context, ns string) (*networkv1.IngressList, error)
}

IngressLister can list ingresses in a namespace

type KubeClientCreator 

type KubeClientCreator struct {
	Kube kubernetes.Interface
}

A KubeClientCreator implements SecureStackCreator with the kubernetes.Interface

func (*KubeClientCreator) CreateDeployment 

func (k *KubeClientCreator) CreateDeployment(ctx context.Context, dep *appsv1.Deployment) (*appsv1.Deployment, error)

func (*KubeClientCreator) CreateIngress 

func (k *KubeClientCreator) CreateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)

func (*KubeClientCreator) CreateSecret 

func (k *KubeClientCreator) CreateSecret(ctx context.Context, sec *corev1.Secret) (*corev1.Secret, error)

func (*KubeClientCreator) CreateService 

func (k *KubeClientCreator) CreateService(ctx context.Context, svc *corev1.Service) (*corev1.Service, error)

func (*KubeClientCreator) GetSecret 

func (k *KubeClientCreator) GetSecret(ctx context.Context, ns string, name string) (*corev1.Secret, error)

func (*KubeClientCreator) ListIngresses 

func (k *KubeClientCreator) ListIngresses(ctx context.Context, ns string) (*networkv1.IngressList, error)

func (*KubeClientCreator) UpdateIngress 

func (k *KubeClientCreator) UpdateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)

type OIDCClient 

type OIDCClient struct {
	IssuerURL string
	// Redirects    []string
	ClientID     string
	ClientSecret string
}

OIDCClient represents the critical data to be able to connect with an openid connect client that supports the discovery endpoints.

type OIDCCreator 

type OIDCCreator interface {
	CreateOIDCClient(ctx context.Context, c *gocloak.Client) (*OIDCClient, error)
}

An OIDCCreator can takes a context and client spec, and returns a clientid and clientsecret or error.

type PlainRedis 

type PlainRedis struct {
	Password string `json:"password,omitempty"`
	URL      string `json:"url,omitempty"`
}

PlainRedis holds the URL and password to a redis instance. The URL must start with `redis://`.

type ProxyOpts 

type ProxyOpts struct {
	SessionStore ProxySessionStore `json:"sessionStore"`
	CustomBanner string            `json:"customBanner,omitempty"`
	EmailDomain  string            `json:"emailDomain,omitempty"`
	Annotations  map[string]string `json:"annotations,omitempty"`
	Target       Target            `json:"target"`
}

ProxyOpts are used to set up both the kubernetes objects (secrets) and the env/args for the oauth2-proxy

func (ProxyOpts) Args 

func (po ProxyOpts) Args(ctx context.Context) ([]string, error)

Args turns the ProxyOpts into an argument list for the oauth2-proxy pod

func (ProxyOpts) SetupEnv 

func (po ProxyOpts) SetupEnv(ctx context.Context, cs SecureStackCreator, oClient *OIDCClient) ([]corev1.EnvVar, error)

SetupEnv does the work to set up secrets, and returns the kubernetes Env spec for accessing the values it set up, with the varialbe names the oauth2-proxy container expects them in. It takes a context, a kubernetes client interface implementation, and oidcclient metadata.

type ProxySessionStore 

type ProxySessionStore struct {
	Redis *RedisSessionStore `json:"redis,omitempty"`
}

ProxySessionStore is required, and configures the way that the oauth2-proxy stores session data.

type RedisSessionStore 

type RedisSessionStore struct {
	Helm  *HelmRedis  `json:"helm,omitempty"`
	Plain *PlainRedis `json:"plain,omitempty"`
}

A RedisSessionStore configures the session to be stored in a redis instance. It supports both the known helm chart conventions from bitnami's redis server, and a pre-known redis server endpoint and password.

type RuntimeCreator 

type RuntimeCreator struct {
	Client client.Client
}

A RuntimeCreator implements SecureStackCreator with the kubernetes sig-runtime client.Client interface

func (*RuntimeCreator) CreateDeployment 

func (r *RuntimeCreator) CreateDeployment(ctx context.Context, dep *appsv1.Deployment) (*appsv1.Deployment, error)

func (*RuntimeCreator) CreateIngress 

func (r *RuntimeCreator) CreateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)

func (*RuntimeCreator) CreateSecret 

func (r *RuntimeCreator) CreateSecret(ctx context.Context, sec *corev1.Secret) (*corev1.Secret, error)

func (*RuntimeCreator) CreateService 

func (r *RuntimeCreator) CreateService(ctx context.Context, svc *corev1.Service) (*corev1.Service, error)

func (*RuntimeCreator) GetSecret 

func (r *RuntimeCreator) GetSecret(ctx context.Context, ns string, name string) (*corev1.Secret, error)

func (*RuntimeCreator) ListIngresses 

func (r *RuntimeCreator) ListIngresses(ctx context.Context, ns string) (*networkv1.IngressList, error)

func (*RuntimeCreator) UpdateIngress 

func (r *RuntimeCreator) UpdateIngress(ctx context.Context, ing *networkv1.Ingress) (*networkv1.Ingress, error)

type SecretCreator 

type SecretCreator interface {
	CreateSecret(ctx context.Context, sec *corev1.Secret) (*corev1.Secret, error)
	GetSecret(ctx context.Context, ns, name string) (*corev1.Secret, error)
}

A SecretCreator can create a k8s secret

type SecureServiceCreator 

type SecureServiceCreator interface {
	SecretCreator
	DeploymentCreator
	ServiceCreator
}

A SecureServiceCreator can create a deployment with secrets held in a secret, and a service to expose the deployment.

type SecureStackCreator 

type SecureStackCreator interface {
	SecureServiceCreator
	IngressCreator
	IngressLister
}

A SecureServiceCreator can create a deployment with secrets held in a secret, a service to expose the deployment, and an ingress to expose the service outside the cluster.

type Service 

type Service struct {
	Service *corev1.Service `json:"service"`
	// Optional ingress to use to expose the service
	IngressDNS string `json:"ingressDNS,omitempty"`
}

type ServiceCreator 

type ServiceCreator interface {
	CreateService(ctx context.Context, svc *corev1.Service) (*corev1.Service, error)
}

A ServiceCreator can create a k8s service

type Target 

type Target struct {
	Ingress *networkv1.Ingress `json:"ingress"`
	SvIng   *Service           `json:"svIng"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.