Kubernetes Authentication Bridge validates Kubernetes TokenReview requests against the compatibility control plane and maps authenticated identities into Kubernetes user and group information.
PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
Upstream: rancher/kubernetes-auth. This GitHub fork preserves the upstream Git history, authorship, dates, tags, and license notices; PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.
The reviewed numeric candidate is 0.0.12. If publication is separately approved, its image tag will be:
ghcr.io/pasturestack/kubernetes-authentication-bridge:v0.0.12
The source review does not publish or deploy that image. Existing historical releases remain immutable. Every new PastureStack build uses plain numeric semantic versions without a product or maintenance-count suffix.
The Runtime is a static, standard-library-only Go binary in a digest-pinned distroless image. It runs as UID/GID 65532, contains no shell or package manager, follows no HTTP redirect while carrying credentials, applies bounded request and archive limits, and logs only bounded token fingerprints when debug mode is explicitly enabled. The old vendored CLI, logging, Kubernetes client, and generated control-plane client trees are no longer part of the active source or artifact.
Preferred settings are PLATFORM_URL, PLATFORM_ACCESS_KEY, PLATFORM_SECRET_KEY, PLATFORM_METADATA_ADDRESS, and PLATFORM_CA_ROOT. Historical CATTLE_*, metadata-address, and CA-path names remain temporary compatibility aliases.
The process retrieves the Kubernetes service certificate action through the existing metadata and control-plane APIs, accepts only a same-origin response, validates a bounded ZIP archive entirely in memory, and derives the bootstrap token from the validated PEM private key. No certificate archive or private key is written to the container filesystem.
The non-root webhook listens on port 8080; the health check remains on port 10240. A matching Kubernetes package or Catalog revision must set:
AUTHENTICATION_BRIDGE_URL=http://platform-kubernetes-authentication:8080
Set PASTURESTACK_LOCALE=en-US or PASTURESTACK_LOCALE=zh-TW for operator messages. TokenReview JSON, identity values, usernames, group names, and protocol errors remain language-neutral.
Run from a Docker-capable Linux host:
make validate
make test
make build VERSION_OVERRIDE=0.0.12
make package VERSION_OVERRIDE=0.0.12 TAG=v0.0.12 \
IMAGE_NAME=pasturestack/kubernetes-authentication-bridgeThe package target creates a local image only. See COMPATIBILITY.md, SECURITY.md, and ORIGIN.md.
The inherited project remains licensed under Apache License 2.0. Copyright and attribution for inherited work remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.