How ca-gip/kubi works
Kubi provides LDAP-backed Kubernetes token issuance and authentication, plus an operator that converts LDAP group conventions into tenant resources and optionally provisions network policies. The principal flow is credentials → LDAP identity and membership checks → token/config response, followed by Kubernetes TokenReview validation. Operator controllers and custom-resource support are included as separate product stages. Wiring for unsampled operator and token-provider internals is based only on README capabilities and the available tree.
Main entry points: client.go LDAP Client · project-provisionner.go Tenant Provisioning · operator/main.go Operator Runtime · api/main.go API HTTP Server
Components 23
Token API
- API HTTP Server
cmd/api/main.go - Basic Auth
internal/middlewares/httpauth.go - Token Issuer
internal/services/token-provider.go
Token Authentication
- Authentication Webhook
cmd/authorization-webhook/main.go - TokenReview Handler
internal/services/webhook-tokenauthenticator.go
Tenant Operator
- Operator Runtime
cmd/operator/main.go - LDAP Project Sync
internal/services/project-operator.go - Tenant Provisioning
internal/services/project-provisionner.go - Namespace Resources
internal/services/namespaces.go - Role Bindings
internal/services/rolebindings.go - Service Accounts
internal/services/serviceaccounts.go - Policy Config Watcher
internal/services/netpolconfig-operator.go - Network Policies
internal/services/netpols.go
Shared Domain
- LDAP Client
internal/ldap/client.go - Group Memberships
internal/ldap/membership.go - Group Parser
internal/project/constructors.go - Kubi CRD Types
pkg/apis/cagip/v1/types.go - CRD Client
pkg/generated/clientset/versioned/clientset.go - Runtime Configuration
internal/utils/config.go
Other components
- Kubi CLI
- API Server
- LDAP / AD
- Kubernetes API
Connections 27
- Kubi CLI → API HTTP Server: requests tokens
- API HTTP Server → Basic Auth: routes protected endpoints
- Basic Auth → LDAP Client: authenticates user
- LDAP Client → LDAP / AD: binds and searches
- LDAP Client → Group Memberships: loads memberships
- Basic Auth → Token Issuer: invokes protected handlers
- API HTTP Server → Runtime Configuration: loads settings
- API Server → Authentication Webhook: posts TokenReview
- Authentication Webhook → TokenReview Handler: routes request
- TokenReview Handler → Token Issuer: verifies token
- TokenReview Handler → API Server: returns review status
- Operator Runtime → LDAP Project Sync: starts project watch
- LDAP Project Sync → LDAP Client: lists LDAP projects
- LDAP Client → Group Parser: parses group names
- LDAP Project Sync → Tenant Provisioning: reconciles projects
- Tenant Provisioning → Namespace Resources: manages namespaces
- Tenant Provisioning → Role Bindings: manages bindings
- Tenant Provisioning → Service Accounts: creates accounts
- Namespace Resources → Kubernetes API: writes resources
- Role Bindings → Kubernetes API: writes resources
- Service Accounts → Kubernetes API: writes resources
- Operator Runtime → Policy Config Watcher: starts optional watcher
- Policy Config Watcher → CRD Client: watches configuration
- CRD Client → Kubi CRD Types: handles CRDs
- Policy Config Watcher → Network Policies: reconciles policies
- Network Policies → Kubernetes API: writes policies
- Operator Runtime → Runtime Configuration: loads settings