updated

Author: mfaizanse

pkg/kubernetes/auth_headers.go

@@ -11,10 +11,6 @@ type AuthType string
 type ContextKey string
 
 const (
-	// AuthTypeToken represents token-based authentication.
-	AuthTypeToken AuthType = "token"
-	// AuthTypeClientCertificate represents client certificate authentication.
-	AuthTypeClientCertificate AuthType = "client_certificate"
 	// AuthHeadersContextKey is the context key for the Kubernetes authentication headers.
 	AuthHeadersContextKey ContextKey = "k8s_auth_headers"
 )
@@ -40,11 +36,12 @@ func GetDecodedData(data string) ([]byte, error) {
 	return base64.StdEncoding.DecodeString(data)
 }
 
+// NewK8sAuthHeadersFromHeaders creates a new K8sAuthHeaders from the provided headers.
 func NewK8sAuthHeadersFromHeaders(data map[string]any) (*K8sAuthHeaders, error) {
 	var ok bool
 	var err error
 
-	// Initialize auth headers.
+	// Initialize auth headers with default values.
 	authHeaders := &K8sAuthHeaders{
 		InsecureSkipTLSVerify: false,
 	}
@@ -92,21 +89,20 @@ func NewK8sAuthHeadersFromHeaders(data map[string]any) (*K8sAuthHeaders, error)
 	}
 
 	// Check if a valid authentication type is provided.
-	_, err = authHeaders.GetAuthType()
-	if err != nil {
+	if !authHeaders.IsValid() {
 		return nil, fmt.Errorf("either %s header for token authentication or (%s and %s) headers for client certificate authentication required", CustomAuthorizationHeader, CustomClientCertificateDataHeader, CustomClientKeyDataHeader)
 	}
 
 	return authHeaders, nil
 }
 
-// GetAuthType returns the authentication type based on the provided headers.
-func (h *K8sAuthHeaders) GetAuthType() (AuthType, error) {
+// IsValid checks if the authentication headers are valid.
+func (h *K8sAuthHeaders) IsValid() bool {
 	if h.AuthorizationToken != "" {
-		return AuthTypeToken, nil
+		return true
 	}
 	if h.ClientCertificateData != nil && h.ClientKeyData != nil {
-		return AuthTypeClientCertificate, nil
+		return true
 	}
-	return "", fmt.Errorf("invalid authentication type")
+	return false
 }

pkg/kubernetes/provider_auth_headers.go

@@ -27,25 +27,27 @@ func init() {
 // newAuthHeadersClusterProvider creates a provider that requires header-based authentication.
 // Users must provide tokens via request headers (server URL, Token or client certificate and key).
 func newAuthHeadersClusterProvider(cfg *config.StaticConfig) (Provider, error) {
-	klog.V(1).Infof("Auth-headers provider initialized - all requests must include valid headers")
+	klog.V(1).Infof("Auth-headers provider initialized - all requests must include valid k8s auth headers")
 
 	return &AuthHeadersClusterProvider{staticConfig: cfg}, nil
 }
 
 func (p *AuthHeadersClusterProvider) IsOpenShift(ctx context.Context) bool {
+	klog.V(1).Infof("IsOpenShift not supported for auth-headers provider. Returning false.")
 	return false
 }
 
 func (p *AuthHeadersClusterProvider) VerifyToken(ctx context.Context, target, token, audience string) (*authenticationv1api.UserInfo, []string, error) {
-	return nil, nil, fmt.Errorf("auth-headers VerifyToken not implemented")
+	return nil, nil, fmt.Errorf("VerifyToken not supported for auth-headers provider")
 }
 
 func (p *AuthHeadersClusterProvider) GetTargets(_ context.Context) ([]string, error) {
-	// Single cluster mode
+	klog.V(1).Infof("GetTargets not supported for auth-headers provider. Returning empty list.")
 	return []string{""}, nil
 }
 
 func (p *AuthHeadersClusterProvider) GetTargetParameterName() string {
+	klog.V(1).Infof("GetTargetParameterName not supported for auth-headers provider. Returning empty name.")
 	return ""
 }
 
@@ -64,10 +66,12 @@ func (p *AuthHeadersClusterProvider) GetDerivedKubernetes(ctx context.Context, t
 }
 
 func (p *AuthHeadersClusterProvider) GetDefaultTarget() string {
+	klog.V(1).Infof("GetDefaultTarget not supported for auth-headers provider. Returning empty name.")
 	return ""
 }
 
 func (p *AuthHeadersClusterProvider) WatchTargets(watch func() error) {
+	klog.V(1).Infof("WatchTargets not supported for auth-headers provider. Ignoring watch function.")
 }
 
 func (p *AuthHeadersClusterProvider) Close() {