23 lines
897 B
Go
23 lines
897 B
Go
package workerruntime
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// SPIFFEIdentity returns the ID from an exact workload SPIFFE URI SAN. The
|
|
// control plane accepts no URI decorations so certificate parsing and server
|
|
// authorization use the same identity boundary.
|
|
func SPIFFEIdentity(uri *url.URL, trustDomain, environment, role string) (string, bool) {
|
|
if uri == nil || trustDomain == "" || environment == "" || (role != "worker" && role != "checker") ||
|
|
uri.Scheme != "spiffe" || uri.Host != trustDomain || uri.User != nil || uri.Port() != "" ||
|
|
uri.Opaque != "" || uri.RawPath != "" || uri.RawQuery != "" || uri.ForceQuery || uri.Fragment != "" {
|
|
return "", false
|
|
}
|
|
segments := strings.Split(uri.Path, "/")
|
|
if len(segments) != 4 || segments[0] != "" || segments[1] != environment || segments[2] != role || !ValidIdentifier(segments[3]) {
|
|
return "", false
|
|
}
|
|
return segments[3], true
|
|
}
|