server

Documentation

Index

• func NewServerAuthzInterceptor(jwksURL, namespacesKey, namespacesRegex, identifierKey, adminNamespace string, ...) *serverAuthzInterceptor
• type RequestWithMetadata

Functions

func NewServerAuthzInterceptor

func NewServerAuthzInterceptor(
	jwksURL, namespacesKey, namespacesRegex, identifierKey, adminNamespace string, roleBindingPrefix string, kubeconfigPath string,
) *serverAuthzInterceptor

Returns a new ServerAuthzInterceptor for validating authorization tokens in client requests. jwksURL is used to fetch the JWKS for validating incoming keys. This will refresh if a kid is unknown. namespacesKey is the key to a list of namespace claims in the token. namespacesRegex is used for extracting namespace from the claims. For example, given `kaluza:default`, we can usethe regex `kaluza:([1-9a-z-]{1,63})“ to extract the namespace `default` from the claim. identiferKey is the key to a unique identifier in the claim, for example the email. This is for auditing purposes.

Types

type RequestWithMetadata

type RequestWithMetadata interface {
	GetMetadata() *pb.ClientMeta
}