nodeauth

Documentation

Overview

Package nodeauth defines the authenticated node identity shared by internal data-plane authority handlers.

Index

• func NewCertificateMiddleware(identities []CertificateIdentity, next http.Handler) (http.Handler, error)
• func NewVerifiedCertificateMiddleware(verifier Verifier, next http.Handler) (http.Handler, error)
• type CertificateIdentity
• type CertificateIdentityLookup
• type HTTPSClient
  • func NewHTTPSClient(config HTTPSClientConfig) (*HTTPSClient, error)
  • func (c *HTTPSClient) Do(request *http.Request) (*http.Response, error)
  • func (c *HTTPSClient) NewRequest(ctx context.Context, method, escapedPath string, body io.Reader) (*http.Request, error)
• type HTTPSClientConfig
• type Identity
• type Verifier
  • func NewCertificateVerifier(identities []CertificateIdentity) (Verifier, error)
  • func NewCertificateVerifierWithLookup(identities []CertificateIdentity, lookup CertificateIdentityLookup) (Verifier, error)

Functions

func NewCertificateMiddleware

func NewCertificateMiddleware(identities []CertificateIdentity, next http.Handler) (http.Handler, error)

NewCertificateMiddleware projects a verified client certificate identity into the bearer verifier contract shared by the authority handlers. The TLS listener must already require and verify client certificates; this wrapper checks that invariant again and fails closed if it is miswired.

func NewVerifiedCertificateMiddleware

func NewVerifiedCertificateMiddleware(verifier Verifier, next http.Handler) (http.Handler, error)

NewVerifiedCertificateMiddleware accepts only a TLS-verified certificate whose common name resolves through the same verifier used by handlers.

Types

type CertificateIdentity

type CertificateIdentity struct {
	CommonName string
	ClusterID  string
	NodeID     string
	NodeUID    string
	AgentUID   string
}

CertificateIdentity maps one verified client certificate common name to the durable node identity used by regional authorities.

type CertificateIdentityLookup

type CertificateIdentityLookup func(context.Context, string) (CertificateIdentity, error)

CertificateIdentityLookup resolves dynamically enrolled worker identities from the regional authority. Revoked workers must not be returned.

type HTTPSClient

type HTTPSClient struct {
	// contains filtered or unexported fields
}

HTTPSClient owns transport security and reloads its bearer token per request.

func NewHTTPSClient

func NewHTTPSClient(config HTTPSClientConfig) (*HTTPSClient, error)

func (*HTTPSClient) Do

func (c *HTTPSClient) Do(request *http.Request) (*http.Response, error)

func (*HTTPSClient) NewRequest

func (c *HTTPSClient) NewRequest(ctx context.Context, method, escapedPath string, body io.Reader) (*http.Request, error)

NewRequest creates an authenticated request for one already-escaped absolute protocol path. It reloads the token so projected credential rotation works.

type HTTPSClientConfig

type HTTPSClientConfig struct {
	Authority      string
	BaseURL        string
	CAFile         string
	ClientCertFile string
	ClientKeyFile  string
	TokenFile      string
	Timeout        time.Duration
}

HTTPSClientConfig configures one credential-rotating node-to-region client.

type Identity

type Identity struct {
	ClusterID string
	NodeID    string
	NodeUID   string
	AgentUID  string
}

Identity is derived from a verified workload credential, never from an API request body.

type Verifier

type Verifier interface {
	Verify(context.Context, string) (Identity, error)
}

Verifier resolves a bearer credential to its durable node incarnation.

func NewCertificateVerifier

func NewCertificateVerifier(identities []CertificateIdentity) (Verifier, error)

NewCertificateVerifier returns a verifier backed by an immutable client certificate identity catalog.

func NewCertificateVerifierWithLookup

func NewCertificateVerifierWithLookup(identities []CertificateIdentity, lookup CertificateIdentityLookup) (Verifier, error)

NewCertificateVerifierWithLookup combines migration-time static identities with the dynamic worker catalog. Static identities remain exact and cannot be shadowed by a dynamic record.