Monis Khan 521adffb17 impersonation proxy: add nested impersonation support ... This change updates the impersonator logic to use the delegated authorizer for all non-rest verbs such as impersonate. This allows it to correctly perform authorization checks for incoming requests that set impersonation headers while not performing unnecessary checks that are already handled by KAS. The audit layer is enabled to track the original user who made the request. This information is then included in a reserved extra field original-user-info.impersonation-proxy.concierge.pinniped.dev as a JSON blob. Signed-off-by: Monis Khan <mok@vmware.com>		2021-04-19 15:52:46 -04:00
..
apiserviceref	Use API service as owner ref for cluster scoped resources	2021-02-10 21:52:08 -05:00
certauthority	dynamiccert: split into serving cert and CA providers	2021-03-15 12:24:07 -04:00
clusterhost	Introduce clusterhost package to determine whether a cluster has control plane nodes	2021-02-09 11:16:01 -08:00
concierge	impersonation proxy: add nested impersonation support	2021-04-19 15:52:46 -04:00
config	Use TokenCredentialRequest instead of base64 token with impersonator	2021-03-10 10:30:06 -08:00
constable	Save 2 lines by using inline-style comments for Copyright	2020-09-16 10:35:19 -04:00
controller	Fix lint error	2021-03-30 14:53:26 -07:00
controllerlib	Allow multiple Pinnipeds to work on same cluster	2021-02-02 15:18:41 -08:00
controllermanager	dynamiccert: split into serving cert and CA providers	2021-03-15 12:24:07 -04:00
crud	Supervisor storage garbage collection controller enabled in production	2020-12-11 15:21:34 -08:00
deploymentref	Use API service as owner ref for cluster scoped resources	2021-02-10 21:52:08 -05:00
downward	internal/downward: add support for (optional) pod name	2020-12-11 11:49:27 -05:00
dynamiccert	dynamiccert: unit test with DynamicServingCertificateController	2021-03-15 17:23:37 -04:00
execcredcache	Add CLI caching of cluster-specific credentials.	2021-04-08 14:12:34 -05:00
fositestorage	Update ExpectedAuthorizeCodeSessionJSONFromFuzzing.	2020-12-17 16:31:08 -06:00
groupsuffix	Add WhoAmIRequest Aggregated Virtual REST API	2021-02-22 20:02:41 -05:00
here	Save 2 lines by using inline-style comments for Copyright	2020-09-16 10:35:19 -04:00
httputil	impersonator: test UID impersonation and header canonicalization	2021-03-16 13:00:51 -04:00
issuer	dynamiccert: split into serving cert and CA providers	2021-03-15 12:24:07 -04:00
kubeclient	Add WhoAmIRequest Aggregated Virtual REST API	2021-02-22 20:02:41 -05:00
mocks	dynamiccert: split into serving cert and CA providers	2021-03-15 12:24:07 -04:00
oidc	oidc discovery: encode metadata once and reuse	2021-03-03 13:37:43 -05:00
ownerref	internal/groupsuffix: mutate TokenCredentialRequest's Authenticator	2021-02-10 15:53:44 -05:00
plog	internal/plog: add KObj() and KRef()	2021-02-10 14:25:39 -05:00
registry	certauthority.go: Refactor issuing client versus server certs	2021-03-12 16:09:37 -08:00
secret	All controller unit tests should not cancel context until test is over	2021-03-04 17:26:01 -08:00
testutil	certauthority.go: Refactor issuing client versus server certs	2021-03-12 16:09:37 -08:00
upstreamoidc	Upgrade to github.com/coreos/go-oidc v3.0.0.	2021-01-21 12:08:14 -06:00