Zack Williams | e940c7a | 2019-08-21 14:25:39 -0700 | [diff] [blame] | 1 | /* |
| 2 | Copyright 2017 The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package v1 |
| 18 | |
| 19 | import ( |
| 20 | "fmt" |
| 21 | |
| 22 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 23 | "k8s.io/apimachinery/pkg/types" |
| 24 | ) |
| 25 | |
| 26 | const ( |
| 27 | // ImpersonateUserHeader is used to impersonate a particular user during an API server request |
| 28 | ImpersonateUserHeader = "Impersonate-User" |
| 29 | |
| 30 | // ImpersonateGroupHeader is used to impersonate a particular group during an API server request. |
| 31 | // It can be repeated multiplied times for multiple groups. |
| 32 | ImpersonateGroupHeader = "Impersonate-Group" |
| 33 | |
| 34 | // ImpersonateUserExtraHeaderPrefix is a prefix for any header used to impersonate an entry in the |
| 35 | // extra map[string][]string for user.Info. The key will be every after the prefix. |
| 36 | // It can be repeated multiplied times for multiple map keys and the same key can be repeated multiple |
| 37 | // times to have multiple elements in the slice under a single key |
| 38 | ImpersonateUserExtraHeaderPrefix = "Impersonate-Extra-" |
| 39 | ) |
| 40 | |
| 41 | // +genclient |
| 42 | // +genclient:nonNamespaced |
| 43 | // +genclient:noVerbs |
| 44 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 45 | |
| 46 | // TokenReview attempts to authenticate a token to a known user. |
| 47 | // Note: TokenReview requests may be cached by the webhook token authenticator |
| 48 | // plugin in the kube-apiserver. |
| 49 | type TokenReview struct { |
| 50 | metav1.TypeMeta `json:",inline"` |
| 51 | // +optional |
| 52 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 53 | |
| 54 | // Spec holds information about the request being evaluated |
| 55 | Spec TokenReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 56 | |
| 57 | // Status is filled in by the server and indicates whether the request can be authenticated. |
| 58 | // +optional |
| 59 | Status TokenReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 60 | } |
| 61 | |
| 62 | // TokenReviewSpec is a description of the token authentication request. |
| 63 | type TokenReviewSpec struct { |
| 64 | // Token is the opaque bearer token. |
| 65 | // +optional |
| 66 | Token string `json:"token,omitempty" protobuf:"bytes,1,opt,name=token"` |
| 67 | // Audiences is a list of the identifiers that the resource server presented |
| 68 | // with the token identifies as. Audience-aware token authenticators will |
| 69 | // verify that the token was intended for at least one of the audiences in |
| 70 | // this list. If no audiences are provided, the audience will default to the |
| 71 | // audience of the Kubernetes apiserver. |
| 72 | // +optional |
| 73 | Audiences []string `json:"audiences,omitempty" protobuf:"bytes,2,rep,name=audiences"` |
| 74 | } |
| 75 | |
| 76 | // TokenReviewStatus is the result of the token authentication request. |
| 77 | type TokenReviewStatus struct { |
| 78 | // Authenticated indicates that the token was associated with a known user. |
| 79 | // +optional |
| 80 | Authenticated bool `json:"authenticated,omitempty" protobuf:"varint,1,opt,name=authenticated"` |
| 81 | // User is the UserInfo associated with the provided token. |
| 82 | // +optional |
| 83 | User UserInfo `json:"user,omitempty" protobuf:"bytes,2,opt,name=user"` |
| 84 | // Audiences are audience identifiers chosen by the authenticator that are |
| 85 | // compatible with both the TokenReview and token. An identifier is any |
| 86 | // identifier in the intersection of the TokenReviewSpec audiences and the |
| 87 | // token's audiences. A client of the TokenReview API that sets the |
| 88 | // spec.audiences field should validate that a compatible audience identifier |
| 89 | // is returned in the status.audiences field to ensure that the TokenReview |
| 90 | // server is audience aware. If a TokenReview returns an empty |
| 91 | // status.audience field where status.authenticated is "true", the token is |
| 92 | // valid against the audience of the Kubernetes API server. |
| 93 | // +optional |
| 94 | Audiences []string `json:"audiences,omitempty" protobuf:"bytes,4,rep,name=audiences"` |
| 95 | // Error indicates that the token couldn't be checked |
| 96 | // +optional |
| 97 | Error string `json:"error,omitempty" protobuf:"bytes,3,opt,name=error"` |
| 98 | } |
| 99 | |
| 100 | // UserInfo holds the information about the user needed to implement the |
| 101 | // user.Info interface. |
| 102 | type UserInfo struct { |
| 103 | // The name that uniquely identifies this user among all active users. |
| 104 | // +optional |
| 105 | Username string `json:"username,omitempty" protobuf:"bytes,1,opt,name=username"` |
| 106 | // A unique value that identifies this user across time. If this user is |
| 107 | // deleted and another user by the same name is added, they will have |
| 108 | // different UIDs. |
| 109 | // +optional |
| 110 | UID string `json:"uid,omitempty" protobuf:"bytes,2,opt,name=uid"` |
| 111 | // The names of groups this user is a part of. |
| 112 | // +optional |
| 113 | Groups []string `json:"groups,omitempty" protobuf:"bytes,3,rep,name=groups"` |
| 114 | // Any additional information provided by the authenticator. |
| 115 | // +optional |
| 116 | Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,4,rep,name=extra"` |
| 117 | } |
| 118 | |
| 119 | // ExtraValue masks the value so protobuf can generate |
| 120 | // +protobuf.nullable=true |
| 121 | // +protobuf.options.(gogoproto.goproto_stringer)=false |
| 122 | type ExtraValue []string |
| 123 | |
| 124 | func (t ExtraValue) String() string { |
| 125 | return fmt.Sprintf("%v", []string(t)) |
| 126 | } |
| 127 | |
| 128 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 129 | |
| 130 | // TokenRequest requests a token for a given service account. |
| 131 | type TokenRequest struct { |
| 132 | metav1.TypeMeta `json:",inline"` |
| 133 | // +optional |
| 134 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 135 | |
| 136 | Spec TokenRequestSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"` |
| 137 | // +optional |
| 138 | Status TokenRequestStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` |
| 139 | } |
| 140 | |
| 141 | // TokenRequestSpec contains client provided parameters of a token request. |
| 142 | type TokenRequestSpec struct { |
| 143 | // Audiences are the intendend audiences of the token. A recipient of a |
| 144 | // token must identitfy themself with an identifier in the list of |
| 145 | // audiences of the token, and otherwise should reject the token. A |
| 146 | // token issued for multiple audiences may be used to authenticate |
| 147 | // against any of the audiences listed but implies a high degree of |
| 148 | // trust between the target audiences. |
| 149 | Audiences []string `json:"audiences" protobuf:"bytes,1,rep,name=audiences"` |
| 150 | |
| 151 | // ExpirationSeconds is the requested duration of validity of the request. The |
| 152 | // token issuer may return a token with a different validity duration so a |
| 153 | // client needs to check the 'expiration' field in a response. |
| 154 | // +optional |
| 155 | ExpirationSeconds *int64 `json:"expirationSeconds" protobuf:"varint,4,opt,name=expirationSeconds"` |
| 156 | |
| 157 | // BoundObjectRef is a reference to an object that the token will be bound to. |
| 158 | // The token will only be valid for as long as the bound object exists. |
| 159 | // NOTE: The API server's TokenReview endpoint will validate the |
| 160 | // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds |
| 161 | // small if you want prompt revocation. |
| 162 | // +optional |
| 163 | BoundObjectRef *BoundObjectReference `json:"boundObjectRef" protobuf:"bytes,3,opt,name=boundObjectRef"` |
| 164 | } |
| 165 | |
| 166 | // TokenRequestStatus is the result of a token request. |
| 167 | type TokenRequestStatus struct { |
| 168 | // Token is the opaque bearer token. |
| 169 | Token string `json:"token" protobuf:"bytes,1,opt,name=token"` |
| 170 | // ExpirationTimestamp is the time of expiration of the returned token. |
| 171 | ExpirationTimestamp metav1.Time `json:"expirationTimestamp" protobuf:"bytes,2,opt,name=expirationTimestamp"` |
| 172 | } |
| 173 | |
| 174 | // BoundObjectReference is a reference to an object that a token is bound to. |
| 175 | type BoundObjectReference struct { |
| 176 | // Kind of the referent. Valid kinds are 'Pod' and 'Secret'. |
| 177 | // +optional |
| 178 | Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"` |
| 179 | // API version of the referent. |
| 180 | // +optional |
| 181 | APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=aPIVersion"` |
| 182 | |
| 183 | // Name of the referent. |
| 184 | // +optional |
| 185 | Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"` |
| 186 | // UID of the referent. |
| 187 | // +optional |
| 188 | UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uID,casttype=k8s.io/apimachinery/pkg/types.UID"` |
| 189 | } |