keystone

Documentation

Index

• Constants
• func GetToken(options gophercloud.AuthOptions) (*tokens3.Token, error)
• type Authenticator
  • func (a *Authenticator) AuthenticateToken(token string) (user.Info, bool, error)
• type Authorizer
  • func (a *Authorizer) Authorize(attributes authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
• type Config
  • func NewConfig() *Config
  • func (c *Config) AddFlags(fs *pflag.FlagSet)
  • func (c *Config) ValidateFlags() error
• type KeystoneAuth
  • func NewKeystoneAuth(c *Config) (*KeystoneAuth, error)
  • func (k *KeystoneAuth) Handler(w http.ResponseWriter, r *http.Request)
  • func (k *KeystoneAuth) Run()
• type Syncer

Constants

const (
	TypeUser    string = "user"
	TypeGroup   string = "group"
	TypeProject string = "project"
	TypeRole    string = "role"
)

Supported types for policy match.

const (
	Projects        = "projects"
	RoleAssignments = "role_assignments"
)

By now only project syncing is supported TODO(mfedosin): Implement syncing of role assignments, system role assignments, and user groups

Functions

func GetToken

func GetToken(options gophercloud.AuthOptions) (*tokens3.Token, error)

GetToken creates a token by authenticate with keystone.

Types

type Authenticator

type Authenticator struct {
	// contains filtered or unexported fields
}

Authenticator contacts openstack keystone to validate user's token passed in the request. The keystone endpoint is passed during apiserver startup

func (*Authenticator) AuthenticateToken

func (a *Authenticator) AuthenticateToken(token string) (user.Info, bool, error)

AuthenticateToken checks the token via Keystone call

type Authorizer

type Authorizer struct {
	// contains filtered or unexported fields
}

Authorizer contacts openstack keystone to check whether the user can perform requested operations. The keystone endpoint and policy list are passed during apiserver startup

func (*Authorizer) Authorize

func (a *Authorizer) Authorize(attributes authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)

Authorize checks whether the user can perform an operation

type Config

type Config struct {
	Address             string
	CertFile            string
	KeyFile             string
	KeystoneURL         string
	KeystoneCA          string
	PolicyFile          string
	PolicyConfigMapName string
	SyncConfigFile      string
	SyncConfigMapName   string
	Kubeconfig          string
}

Config configures a keystone webhook server

func NewConfig

func NewConfig() *Config

NewConfig returns a Config

func (*Config) AddFlags

func (c *Config) AddFlags(fs *pflag.FlagSet)

AddFlags adds flags for a specific AutoScaler to the specified FlagSet

func (*Config) ValidateFlags

func (c *Config) ValidateFlags() error

ValidateFlags validates whether flags are set up correctly

type KeystoneAuth

type KeystoneAuth struct {
	// contains filtered or unexported fields
}

KeystoneAuth manages authentication and authorization

func NewKeystoneAuth

func NewKeystoneAuth(c *Config) (*KeystoneAuth, error)

NewKeystoneAuth returns a new KeystoneAuth controller

func (*KeystoneAuth) Handler

func (k *KeystoneAuth) Handler(w http.ResponseWriter, r *http.Request)

Handler serves the http requests

func (*KeystoneAuth) Run

func (k *KeystoneAuth) Run()

Run starts the keystone webhook server.

type Syncer

type Syncer struct {
	// contains filtered or unexported fields
}

Syncer synchronizes auth data between Keystone and Kubernetes