Struct KubernetesVerifier 

pub struct KubernetesVerifier { /* private fields */ }

Available on crate feature kubernetes-auth only.

The reviewer: where the API server is, how this server authenticates to it, and who is granted what.

Implementations

impl KubernetesVerifier

pub fn in_cluster( audience: Option<String>, grants: Vec<(String, Principal)>, ) -> Result<Self, String>

The in-cluster reviewer: API server address from the environment Kubernetes injects, trust from the mounted cluster CA, identity from the mounted service-account token.

Errors

Outside a cluster (no KUBERNETES_SERVICE_HOST, no mounted CA) — at startup, where the refusal names what is missing, not at the first request.

pub fn verify(&self, presented: &str) -> Option<Principal>

Who presented is, if the API server vouches for it AND a grant names it. None is both “not a valid token” and “valid but not granted” — the caller’s error stays 401 either way, and the distinction lives in this server’s log, not the response.

Trait Implementations

impl Debug for KubernetesVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.