kubetoken

package module

v0.0.0-...-ad42612 Latest Latest Go to latest Published: Jan 18, 2022 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/atlassian/kubetoken

Links

Open Source Insights

README ¶

kubetoken is no longer maintained.

Synopsis

kubetoken issues temporary certificates for access to Kubernetes clusters.

Installation

Installation is covered in a seperate document.

Deployment

Deploying kubetoken involves two steps.

deploying kubetokend as a kubernetes service
distributing the kubetoken cli tool.

Contributing

Pull requests, issues and comments welcome. For pull requests:

Do not submit a pull request without an accompanying issue. All pull requests must include an Updates or Fixes line.
Add tests for new features and bug fixes.
Follow the existing style.
Separate unrelated changes into multiple pull requests.

See the existing issues for things to start contributing.

For bigger changes, make sure you start a discussion first by creating an issue and explaining the intended change.

Atlassian requires contributors to sign a Contributor License Agreement, known as a CLA. This serves as a record stating that the contributor is entitled to contribute the code/documentation/translation to the project and is willing to have it used in distributions and derivative works (or is willing to transfer ownership).

Prior to accepting your contributions we ask that you please follow the appropriate link below to digitally sign the CLA. The Corporate CLA is for those who are contributing as a member of an organization and the individual CLA is for those contributing as an individual.

License

Documentation ¶

Overview ¶

kubetoken provides time limited access tokens to Kubernetes clusters.

Index ¶

Variables
type ADRoleProvider
- func (r *ADRoleProvider) FetchRolesForUser(user string) ([]string, error)
type ADRoleValidater
- func (r *ADRoleValidater) ValidateRoleForUser(user, role string) error
type CertificateResponse
type Context
type LDAPConn
type LDAPCreds
- func (l *LDAPCreds) Bind() (*ldap.Conn, error)
type Signer
- func (s *Signer) Sign(csr *x509.CertificateRequest) ([]byte, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var BotOU string = "OU=bots,OU=people"

BotOU

View Source

var GroupOU string = "OU=access,OU=groups"

GroupOU

View Source

var NamespaceRegex string = `^kube-(?P<customer>\w+)-(?P<ns>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?)-(?P<env>\w+)-dl-`

NamespaceRegex is used to extract customer, namespace, and env from ldap queries

View Source

var SearchBase string = "DC=example,DC=com"

SearchBase is the LDAP search base.

View Source

var SearchGroups string = "kube"

Group prefix to use in ldap search

View Source

var UserOU string = "OU=people"

UserOU

View Source

var Version string = "unknown"

Version is populated by the release process.

Functions ¶

This section is empty.

Types ¶

type ADRoleProvider ¶

type ADRoleProvider struct {
	LDAPCreds
}

ADRoleProvider speaks Active Directory flavoured LDAP to retrieve the roles available to a specific user.

func (*ADRoleProvider) FetchRolesForUser ¶

func (r *ADRoleProvider) FetchRolesForUser(user string) ([]string, error)

type ADRoleValidater ¶

type ADRoleValidater struct {
	Bind func() (LDAPConn, error)
}

ADRoleValidater validates a user is permitted to assume a role as specified in Active Directory flavoured LDAP.

func (*ADRoleValidater) ValidateRoleForUser ¶

func (r *ADRoleValidater) ValidateRoleForUser(user, role string) error

type CertificateResponse ¶

type CertificateResponse struct {
	Username    string            `json:"username"`
	Role        string            `json:"role"`
	Files       map[string][]byte `json:"files"`
	Addresses   []string          `json:"addresses"`
	Customer    string            `json:"customer"`
	Environment string            `json:"environment"`
	Namespace   string            `json:"namespace"`
	Contexts    []Context         `json:"contexts"`
}

type Context ¶

type Context struct {
	Files    map[string][]byte `json:"files"`
	Clusters map[string]string `json:"clusters"`
}

type LDAPConn ¶

type LDAPConn interface {

	// Search performs a given search request.
	Search(searchRequest *ldap.SearchRequest) (*ldap.SearchResult, error)

	// Close closes the connection and frees any associated requets.
	Close() // yes, ldap.v2 gets this wrong
}

LDAPConn represents a LDAP connection that can handle search requests.

type LDAPCreds ¶

type LDAPCreds struct {
	Host     string
	Port     int
	BindDN   string
	Password string
}

func (*LDAPCreds) Bind ¶

func (l *LDAPCreds) Bind() (*ldap.Conn, error)

type Signer ¶

type Signer struct {
	Cert    *x509.Certificate
	PrivKey *rsa.PrivateKey
}

func (*Signer) Sign ¶

func (s *Signer) Sign(csr *x509.CertificateRequest) ([]byte, error)

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
cmd
kubetoken
kubetokend kubetokend handles requests for kubeconfig cert/key pairs.	kubetokend handles requests for kubeconfig cert/key pairs.
internal
cert Cert automates the generation of certificate and certificate authorities.	Cert automates the generation of certificate and certificate authorities.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL