Module io.helidon.integrations.vault.auths.k8s

Package io.helidon.integrations.vault.auths.k8s

Interface K8sAuthRx

public interface K8sAuthRx

Kubernetes authentication method API. See https://www.vaultproject.io/docs/auth/kubernetes. When used to authenticate against a Vault from a k8s pod, there is no need to use this API directly.

Field Summary

Fields

Modifier and Type	Field	Description
static AuthMethod<K8sAuthRx>	AUTH_METHOD	Kubernetes authentication method.
static String	TYPE_BATCH	Batch token type.
static String	TYPE_DEFAULT	Default token type.
static String	TYPE_SERVICE	Service token type.

Method Summary

Modifier and Type	Method	Description
Single<ConfigureK8s.Response>	configure(ConfigureK8s.Request request)	Configure this authentication method.
Single<CreateRole.Response>	createRole(CreateRole.Request request)	Registers a role in the auth method.
Single<DeleteRole.Response>	deleteRole(DeleteRole.Request request)	Deletes the previously registered role.
Single<Login.Response>	login(Login.Request request)	Fetch a token.

Field Detail

AUTH_METHOD

static final AuthMethod<K8sAuthRx> AUTH_METHOD

Kubernetes authentication method.

TYPE_SERVICE

static final String TYPE_SERVICE

Service token type.

See Also:

Constant Field Values

TYPE_BATCH

static final String TYPE_BATCH

Batch token type.

See Also:

Constant Field Values

TYPE_DEFAULT

static final String TYPE_DEFAULT

Default token type.

See Also:

Constant Field Values

Method Detail

createRole

Single<CreateRole.Response> createRole(CreateRole.Request request)

Registers a role in the auth method. Role types have specific entities that can perform login operations against this endpoint. Constraints specific to the role type must be set on the role. These are applied to the authenticated entities attempting to login.

Parameters:

request - create role request

Returns:

when the role is created

deleteRole

Single<DeleteRole.Response> deleteRole(DeleteRole.Request request)

Deletes the previously registered role.

Parameters:

request - delete role request

Returns:

when the role is deleted

login

Single<Login.Response> login(Login.Request request)

Fetch a token. This endpoint takes a signed JSON Web Token (JWT) and a role name for some entity. It verifies the JWT signature to authenticate that entity and then authorizes the entity for the given role.

Parameters:

request - login request

Returns:

login response

configure

Single<ConfigureK8s.Response> configure(ConfigureK8s.Request request)

Configure this authentication method.

The Kubernetes auth method validates service account JWTs and verifies their existence with the Kubernetes TokenReview API. This endpoint configures the public key used to validate the JWT signature and the necessary information to access the Kubernetes API.

Caveats

If Vault is running in a Kubernetes Pod, the kubernetes_ca_cert and token_reviewer_jwt parameters will automatically default to the local CA cert (/var/run/secrets/kubernetes.io/serviceaccount/ca.crt) and local service account JWT (/var/run/secrets/kubernetes.io/serviceaccount/token). This behavior may be disabled by setting disable_local_ca_jwt to true. When Vault is running in a non-Kubernetes environment, either kubernetes_ca_cert or pem_keys must be set by the user.

Parameters:

request - request to configure

Returns:

when configured