Module auth 

Authentication middleware for Kubernetes ServiceAccount tokens

This module validates that incoming requests include a valid ServiceAccount token in the Authorization header.

Token Validation Modes

Basic Mode (default)

• Checks for token presence and format
• Suitable for trusted environments or when using external auth (API gateway, service mesh)

Kubernetes TokenReview Mode (feature: k8s-token-review)

• Validates tokens against Kubernetes TokenReview API
• Verifies token authenticity and expiration
• Validates token audience
• Restricts to allowed namespaces and service accounts
• Requires in-cluster configuration or kubeconfig

Security Configuration

Environment variables for TokenReview mode:

• BIND_TOKEN_AUDIENCES - Comma-separated list of expected audiences (default: “bindcar”)
• BIND_ALLOWED_NAMESPACES - Comma-separated list of allowed namespaces (empty = allow all)
• BIND_ALLOWED_SERVICE_ACCOUNTS - Comma-separated list of allowed SA names (empty = allow all)

Structs

AuthError

Error response for authentication failures

TokenReviewConfig

Configuration for TokenReview security policies

Enums

KubeAuthMode

Describes how the Kubernetes client will be authenticated when performing TokenReview calls.

Constants

ALLOW_ANY_SERVICE_ACCOUNT_ENV

Environment variable that explicitly opts into allow-all authorization when the Kubernetes TokenReview feature is active but no namespace / service-account allowlist is configured.

BIND_API_TOKEN_ENV

Environment variable holding a shared API token.

Functions

authenticate

Authentication middleware

check_authorization_posture

Decide whether bindcar may start given its TokenReview authorization posture.

check_startup_auth_posture

Decide whether bindcar is allowed to start given its authentication posture.

detect_kube_auth_mode

Inspect environment variables and return which Kubernetes auth mode should be used.

has_real_auth

Returns true if a real authenticator is configured at runtime: either the Kubernetes TokenReview feature is compiled in, or a shared secret is set.

is_loopback_host

Returns true if host denotes a loopback-only bind address.

shared_secret_configured

Returns true when shared-secret authentication is the selected mode — i.e. BIND_API_TOKEN_ENV is set to a non-empty value.