proxy

Documentation

Overview

Package proxy provides a reverse proxy that accepts client certificates and forwards Common Name and Organizations to backend API servers in HTTP headers. The proxy terminates client TLS and communicates with API servers via mTLS. Traffic is routed based on paths.

An example configuration:

• path: /services/ backend: https://localhost:6444 backend_server_ca: certs/kcp-ca-cert.pem proxy_client_cert: certs/proxy-client-cert.pem proxy_client_key: certs/proxy-client-key.pem
• path: / backend: https://localhost:6443 backend_server_ca: certs/kcp-ca-cert.pem proxy_client_cert: certs/proxy-client-cert.pem proxy_client_key: certs/proxy-client-key.pem

Index

• func NewHandler(ctx context.Context, o *proxyoptions.Options, index index.Index) (http.Handler, error)
• func ShardURLFrom(ctx context.Context) *url.URL
• func WithProxyAuthHeaders(delegate http.Handler, userHeader, groupHeader string, ...) http.HandlerFunc
• func WithShardURL(parent context.Context, shardURL *url.URL) context.Context
• type CompletedConfig
• type Config
  • func NewConfig(ctx context.Context, opts *proxyoptions.Options) (*Config, error)
  • func (c *Config) Complete() (CompletedConfig, error)
• type ExtraConfig
• type Server
  • func NewServer(ctx context.Context, c CompletedConfig) (*Server, error)
  • func (s *Server) PrepareRun(ctx context.Context) (preparedServer, error)

Functions

func NewHandler

func NewHandler(ctx context.Context, o *proxyoptions.Options, index index.Index) (http.Handler, error)

func ShardURLFrom

func ShardURLFrom(ctx context.Context) *url.URL

func WithProxyAuthHeaders

func WithProxyAuthHeaders(delegate http.Handler, userHeader, groupHeader string, extraHeaderPrefix string) http.HandlerFunc

WithProxyAuthHeaders does client cert termination by extracting the user and groups and passing them through access headers to the shard.

func WithShardURL

func WithShardURL(parent context.Context, shardURL *url.URL) context.Context

Types

type CompletedConfig

type CompletedConfig struct {
	// contains filtered or unexported fields
}

type Config

type Config struct {
	Options *proxyoptions.Options

	ExtraConfig
}

func NewConfig

func NewConfig(ctx context.Context, opts *proxyoptions.Options) (*Config, error)

NewConfig returns a new Config for the given options.

func (*Config) Complete

func (c *Config) Complete() (CompletedConfig, error)

Complete fills in any fields not set that are required to have valid data. It's mutating the receiver.

type ExtraConfig

type ExtraConfig struct {
	// resolveIdentities is to be called on server start until it succeeds. It injects the kcp
	// resource identities into the rest.Config used by the client. Only after it succeeds,
	// the clients can wildcard-list/watch most kcp resources.
	ResolveIdentities func(ctx context.Context) error
	RootShardConfig   *rest.Config
	ShardsConfig      *rest.Config

	AuthenticationInfo    genericapiserver.AuthenticationInfo
	ServingInfo           *genericapiserver.SecureServingInfo
	AdditionalAuthEnabled bool
}

type Server

type Server struct {
	CompletedConfig
	Handler                  http.Handler
	IndexController          *index.Controller
	KcpSharedInformerFactory kcpinformers.SharedScopedInformerFactory
}

func NewServer

func NewServer(ctx context.Context, c CompletedConfig) (*Server, error)

func (*Server) PrepareRun

func (s *Server) PrepareRun(ctx context.Context) (preparedServer, error)