config

Documentation

Index

• type ACSConfig
• type Config
  • func LoadConfig(filePath string) (*Config, error)
• type DiscoverConfig
• type ForwardAuthConfig
• type HTTPConfig
• type IdPSectionConfig
  • func (i *IdPSectionConfig) UnmarshalYAML(value *yaml.Node) error
• type MetricsConfig
• type SAMLConfig
  • func (s SAMLConfig) Validate() error
• type SPConfig
  • func (s *SPConfig) UnmarshalYAML(value *yaml.Node) error
• type WorkloadIdentityConfig
• type WorkloadIdentityProviderConfig

Types

type ACSConfig

type ACSConfig struct {
	DeliveryMode   string `yaml:"deliveryMode"`
	CookieName     string `yaml:"cookieName"`
	CookieDomain   string `yaml:"cookieDomain"`
	CookieSameSite string `yaml:"cookieSameSite"`
	CookieSecure   bool   `yaml:"cookieSecure"`
	CookieHTTPOnly bool   `yaml:"cookieHTTPOnly"`
	SessionTTL     int    `yaml:"sessionTTL"`
	PostLoginURL   string `yaml:"postLoginURL"`
}

ACSConfig holds Assertion Consumer Service settings.

type Config

type Config struct {
	Port             int                    `yaml:"port"`
	RedisAddr        string                 `yaml:"redisAddr"`
	RedisHost        string                 `yaml:"redisHost"`
	RedisPort        int                    `yaml:"redisPort"`
	RedisDB          int                    `yaml:"redisDb"`
	RedisPassword    string                 `yaml:"redisPassword"`
	RedisURL         string                 `yaml:"redisUrl"`
	JwtSecret        string                 `yaml:"jwtSecret"`
	ApiKey           string                 `yaml:"apiKey"`
	IssuerBaseURL    string                 `yaml:"issuerBaseUrl"`
	DefaultAudience  string                 `yaml:"defaultAudience"`
	JwksPrivateKey   string                 `yaml:"jwksPrivateKey"`
	JwksKeyID        string                 `yaml:"jwksKeyId"`
	WorkloadIdentity WorkloadIdentityConfig `yaml:"workloadIdentity"`
	SAML             SAMLConfig             `yaml:"saml"`
	HTTP             HTTPConfig             `yaml:"http"`
	ForwardAuth      ForwardAuthConfig      `yaml:"forwardAuth"`
}

Config captures runtime parameters loaded from YAML or the environment.

func LoadConfig

func LoadConfig(filePath string) (*Config, error)

LoadConfig reads a YAML file, expands environment variables, and returns Config defaults.

type DiscoverConfig

type DiscoverConfig struct {
	Enabled      bool   `yaml:"enabled"`
	ProtocolType string `yaml:"protocolType"`
	ServiceURL   string `yaml:"serviceURL"`
}

DiscoverConfig holds IdP discovery settings.

type ForwardAuthConfig

type ForwardAuthConfig struct {
	AccessCookieName string `yaml:"accessCookieName"`
}

ForwardAuthConfig defines credentials accepted only by the edge authentication endpoint.

type HTTPConfig

type HTTPConfig struct {
	AllowedOrigins           []string `yaml:"allowedOrigins"`
	ReadHeaderTimeoutSeconds int      `yaml:"readHeaderTimeoutSeconds"`
	ReadTimeoutSeconds       int      `yaml:"readTimeoutSeconds"`
	WriteTimeoutSeconds      int      `yaml:"writeTimeoutSeconds"`
	IdleTimeoutSeconds       int      `yaml:"idleTimeoutSeconds"`
	MaxHeaderBytes           int      `yaml:"maxHeaderBytes"`
}

HTTPConfig defines the public server boundary.

type IdPSectionConfig

type IdPSectionConfig struct {
	MetadataURL        string        `yaml:"metadataURL"`
	MetadataPath       string        `yaml:"metadataPath"`
	RefreshInterval    time.Duration `yaml:"-"`
	TrustedCertPaths   []string      `yaml:"trustedCertPaths"`
	SkipSignatureCheck bool          `yaml:"skipSignatureCheck"`
}

IdPSectionConfig holds Identity Provider settings.

func (*IdPSectionConfig) UnmarshalYAML

func (i *IdPSectionConfig) UnmarshalYAML(value *yaml.Node) error

UnmarshalYAML converts refreshIntervalHours from integer hours into a time.Duration value.

type MetricsConfig

type MetricsConfig struct {
	Enabled   bool   `yaml:"enabled"`
	Namespace string `yaml:"namespace"`
}

MetricsConfig holds SAML metrics settings.

type SAMLConfig

type SAMLConfig struct {
	Enabled  bool             `yaml:"enabled"`
	SP       SPConfig         `yaml:"sp"`
	ACS      ACSConfig        `yaml:"acs"`
	IdP      IdPSectionConfig `yaml:"idp"`
	Discover DiscoverConfig   `yaml:"discover"`
	Metrics  MetricsConfig    `yaml:"metrics"`
}

SAMLConfig holds top-level SAML integration settings.

func (SAMLConfig) Validate

func (s SAMLConfig) Validate() error

Validate checks SAMLConfig invariants. When SAML is enabled the SP must provide signing key/cert paths, entityID, and acsURL.

type SPConfig

type SPConfig struct {
	EntityID                  string        `yaml:"entityID"`
	ACSURL                    string        `yaml:"acsURL"`
	SLOURL                    string        `yaml:"sloURL"`
	SigningKeyPath            string        `yaml:"signingKeyPath"`
	SigningCertPath           string        `yaml:"signingCertPath"`
	EncryptionKeyPath         string        `yaml:"encryptionKeyPath"`
	EncryptionCertPath        string        `yaml:"encryptionCertPath"`
	KeyBits                   int           `yaml:"keyBits"`
	ClockSkew                 time.Duration `yaml:"-"`
	RequestTTL                time.Duration `yaml:"-"`
	AllowedSigAlgs            []string      `yaml:"allowedSigAlgs"`
	AllowedDigestAlgs         []string      `yaml:"allowedDigestAlgs"`
	Canonicalization          string        `yaml:"canonicalization"`
	WatchFile                 bool          `yaml:"watchFile"`
	RequireAssertionSigned    bool          `yaml:"requireAssertionSigned"`
	RequireEncryptedAssertion bool          `yaml:"requireEncryptedAssertion"`
}

SPConfig holds SAML Service Provider parameters.

func (*SPConfig) UnmarshalYAML

func (s *SPConfig) UnmarshalYAML(value *yaml.Node) error

UnmarshalYAML converts clockSkewSeconds and requestTTLSeconds from integer seconds into time.Duration values.

type WorkloadIdentityConfig

type WorkloadIdentityConfig struct {
	Issuer                string                           `yaml:"issuer"`
	Audience              string                           `yaml:"audience"`
	JWKSURL               string                           `yaml:"jwksUrl"`
	JWKSBearerTokenFile   string                           `yaml:"jwksBearerTokenFile"`
	Providers             []WorkloadIdentityProviderConfig `yaml:"providers"`
	HTTPTimeoutSeconds    int                              `yaml:"httpTimeoutSeconds"`
	JWKSCacheTTLSeconds   int                              `yaml:"jwksCacheTtlSeconds"`
	AccessTokenTTLSeconds int                              `yaml:"accessTokenTtlSeconds"`
}

WorkloadIdentityConfig validates Kubernetes projected ServiceAccount tokens and controls the short-lived access tokens issued to bound controllers.

type WorkloadIdentityProviderConfig

type WorkloadIdentityProviderConfig struct {
	ClusterRef          string `yaml:"clusterRef"`
	Issuer              string `yaml:"issuer"`
	JWKSURL             string `yaml:"jwksUrl"`
	JWKSBearerTokenFile string `yaml:"jwksBearerTokenFile"`
	Authentication      string `yaml:"authentication"`
}

WorkloadIdentityProviderConfig declares one trusted Kubernetes token issuer. ClusterRef is an operator-facing identifier and is not trusted as a claim.