README
¶
Pinniped
Overview
Pinniped provides identity services to Kubernetes.
Pinniped allows cluster administrators to easily plug in external identity providers (IDPs) into Kubernetes clusters. This is achieved via a uniform install procedure across all types and origins of Kubernetes clusters, declarative configuration via Kubernetes APIs, enterprise-grade integrations with IDPs, and distribution-specific integration strategies.
Example Use Cases
- Your team uses a large enterprise IDP, and has many clusters that they
manage. Pinniped provides:
- Seamless and robust integration with the IDP
- Easy installation across clusters of any type and origin
- A simplified login flow across all clusters
- Your team shares a single cluster. Pinniped provides:
- Simple configuration to integrate an IDP
- Individual, revocable identities
Architecture
Pinniped offers credential exchange to enable a user to exchange an external IDP credential for a short-lived, cluster-specific credential. Pinniped supports various IDP types and implements different integration strategies for various Kubernetes distributions to make authentication possible.
To learn more, see architecture.md.
Trying Pinniped
Care to kick the tires? It's easy to install and try Pinniped.
Installation
Currently, Pinniped supports self-hosted clusters where the Kube Controller Manager pod is accessible from Pinniped's pods. Support for other types of Kubernetes distributions is coming soon.
To try Pinniped, see deploy/README.md.
Contributions
Contributions are welcome. Before contributing, please see the Code of Conduct and the contributing guide.
Reporting Security Vulnerabilities
Please follow the procedure described in SECURITY.md.
License
Pinniped is open source and licensed under Apache License Version 2.0. See LICENSE file.
Copyright 2020 the Pinniped contributors. All Rights Reserved.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
local-user-authenticator
command
Package main provides a authentication webhook program.
|
Package main provides a authentication webhook program. |
|
pinniped
command
|
|
|
pinniped-server
command
|
|
|
internal
|
|
|
certauthority
Package certauthority implements a simple x509 certificate authority suitable for use in an aggregated API service.
|
Package certauthority implements a simple x509 certificate authority suitable for use in an aggregated API service. |
|
certauthority/kubecertauthority
Package kubecertauthority implements a signer backed by the kubernetes controller-manager signing keys (accessed via the kubernetes Exec API).
|
Package kubecertauthority implements a signer backed by the kubernetes controller-manager signing keys (accessed via the kubernetes Exec API). |
|
client
Package client is a wrapper for interacting with Pinniped's CredentialRequest API.
|
Package client is a wrapper for interacting with Pinniped's CredentialRequest API. |
|
controller/apicerts
Package apicerts contains controllers that work together to provide rotating API certs.
|
Package apicerts contains controllers that work together to provide rotating API certs. |
|
controller/identityprovider/idpcache
Package idpcache implements a cache of active identity providers.
|
Package idpcache implements a cache of active identity providers. |
|
controller/identityprovider/webhookcachecleaner
Package webhookcachecleaner implements a controller for garbage collectting webhook IDPs from an IDP cache.
|
Package webhookcachecleaner implements a controller for garbage collectting webhook IDPs from an IDP cache. |
|
controller/identityprovider/webhookcachefiller
Package webhookcachefiller implements a controller for filling an idpcache.Cache with each added/updated WebhookIdentityProvider.
|
Package webhookcachefiller implements a controller for filling an idpcache.Cache with each added/updated WebhookIdentityProvider. |
|
controller/issuerconfig
Package discovery contains controller(s) for reconciling CredentialIssuerConfig's.
|
Package discovery contains controller(s) for reconciling CredentialIssuerConfig's. |
|
downward
Package downward implements a client interface for interacting with Kubernetes "downwardAPI" volumes.
|
Package downward implements a client interface for interacting with Kubernetes "downwardAPI" volumes. |
|
mocks/mockcertissuer
Package mockcertissuer is a generated GoMock package.
|
Package mockcertissuer is a generated GoMock package. |
|
mocks/mocktokenauthenticator
Package mocktokenauthenticator is a generated GoMock package.
|
Package mocktokenauthenticator is a generated GoMock package. |
|
registry/credentialrequest
Package credentialrequest provides REST functionality for the CredentialRequest resource.
|
Package credentialrequest provides REST functionality for the CredentialRequest resource. |
|
server
Package server is the command line entry point for pinniped-server.
|
Package server is the command line entry point for pinniped-server. |
|
testutil/testlogger
Package testlogger implements a logr.Logger suitable for writing test assertions.
|
Package testlogger implements a logr.Logger suitable for writing test assertions. |
|
pkg
|
|
|
config
Package config contains functionality to load/store api.Config's from/to some source.
|
Package config contains functionality to load/store api.Config's from/to some source. |
|
test
|
|