You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Three mode-specific binaries** providing transparent traffic interception for both inbound JWT validation and outbound OAuth 2.0 token exchange (RFC 8693). Each binary is hardcoded to its deployment shape; mode is no longer selected at runtime.
63
+
**Two mode-specific binaries**(proxy-sidecar and envoy-sidecar) providing transparent traffic interception for both inbound JWT validation and outbound OAuth 2.0 token exchange (RFC 8693). Each binary is hardcoded to its deployment shape; mode is no longer selected at runtime. The `authbridge-lite`**image** is a build variant of the proxy binary (not a third binary) — see below.
67
64
68
65
**Library:**`authbridge/authlib/` (shared)
69
66
**Language:** Go 1.25
@@ -72,7 +69,7 @@ kagenti-extensions/
72
69
**Binaries:**
73
70
-`cmd/authbridge-proxy/` — proxy-sidecar mode (default): HTTP forward + reverse proxies, full plugin set (jwt-validation, token-exchange, a2a-parser, mcp-parser, inference-parser). No Envoy / no gRPC.
74
71
-`cmd/authbridge-envoy/` — envoy-sidecar mode: ext_proc gRPC server hooked into Envoy, full plugin set.
75
-
-`cmd/authbridge-lite/` — proxy-sidecar mode, lite plugin set (auth gates only, parsers dropped) for size-optimized deployments.
72
+
-`authbridge-lite` (image, **not** a separate binary) — `cmd/authbridge-proxy` built with `exclude_plugin_*` tags so only jwt-validation + token-exchange compile in (OPA + parsers dropped), for size-optimized deployments. Individual plugins live in `cmd/authbridge-proxy/plugins_<name>.go` files gated by `//go:build !exclude_plugin_<name>`.
76
73
77
74
**Common:**
78
75
-`authlib/` — shared auth library (JWT validation, token exchange, caching, routing, all listener implementations, all plugins).
Three mode-specific binaries, one Dockerfile per binary:
122
+
Two mode-specific binaries (proxy, envoy), one Dockerfile each; the `authbridge-lite` image is a build variant of the proxy binary (proxy Dockerfile + `exclude_plugin_*` tags):
-`authbridge/authlib/` — pure library: validation, exchange, cache, bypass, spiffe, routing, auth, config, all listener implementations, all plugins.
135
-
-`authbridge/cmd/authbridge-{proxy,envoy,lite}/` — thin main packages that import authlib and start the listeners they need.
132
+
-`authbridge/cmd/authbridge-{proxy,envoy}/` — thin main packages that import authlib and start the listeners they need. (The `authbridge-lite` image is `authbridge-proxy` built with `exclude_plugin_*` tags.)
136
133
-`authbridge/go.work` — workspace linking authlib + the binaries for local development.
137
134
138
135
**Config format:** YAML with `${ENV_VAR}` expansion, mode presets, and startup validation. Supports `keycloak_url` + `keycloak_realm` derivation for operator compatibility. The `mode` field in YAML must match the binary (each binary rejects mismatched modes at boot).
@@ -142,7 +139,7 @@ Three mode-specific binaries, one Dockerfile per binary:
142
139
| Workflow | Trigger | Purpose |
143
140
|----------|---------|---------|
144
141
|`ci.yaml`| PR to main/release-*| Pre-commit, Go fmt/vet/build/test for authlib and the cmd/authbridge-* binaries; Python tests |
145
-
|`build.yaml`| Tag push (`v*`) or manual | Multi-arch Docker builds for: proxy-init, authbridge (proxy-sidecar combined), authbridge-envoy (envoy-sidecar combined), authbridge-lite (proxy-sidecar lite combined) |
142
+
|`build.yaml`| Tag push (`v*`) or manual | Multi-arch Docker builds for: proxy-init, authbridge (proxy-sidecar combined), authbridge-envoy (envoy-sidecar combined), authbridge-lite (proxy Dockerfile built with `exclude_plugin_*` tags — auth-only) |
146
143
|`security-scans.yaml`| PR to main | Dependency review, shellcheck, YAML lint, Hadolint, Bandit, Trivy, CodeQL |
147
144
|`scorecard.yaml`| Weekly / push to main | OpenSSF Scorecard security health metrics |
148
145
|`spellcheck_action.yml`| PR | Spellcheck on markdown files |
@@ -173,7 +170,7 @@ All images are pushed to `ghcr.io/kagenti/kagenti-extensions/` from
173
170
|-------|--------|-------------|
174
171
|**`authbridge`**|**`authbridge/cmd/authbridge-proxy/Dockerfile`**|**proxy-sidecar combined image (default mode): authbridge-proxy (full plugin set incl. parsers) + spiffe-helper. No Envoy.**|
|`authbridge-lite`|`authbridge/cmd/authbridge-lite/Dockerfile`| proxy-sidecar lite combined image: authbridge-lite (auth gates only, parsers dropped) + spiffe-helper. Same listener layout as`authbridge`; not yet referenced by the operator's default config |
173
+
|`authbridge-lite`|`authbridge/cmd/authbridge-proxy/Dockerfile`(+ `GO_BUILD_TAGS=exclude_plugin_*`) | proxy-sidecar combined image built auth-only (jwt-validation + token-exchange; OPA + parsers dropped) + spiffe-helper. A build variant of`authbridge`, not a separate binary; not yet referenced by the operator's default config |
177
174
|`authbridge-cpex`|`authbridge/cmd/authbridge-cpex/Dockerfile`| proxy-sidecar build with the CPEX plugin: authbridge-proxy built with `-tags cpex`, links `libcpex_ffi.a` from a pinned CPEX release (CGO_ENABLED=1). Routes hooks through the CPEX framework (APL DSL + named CPEX policy plugins). FFI ABI version is read from `authbridge/cmd/authbridge-cpex/CPEX_FFI_VERSION`|
0 commit comments