Kubernetes authentication and RBAC authorization

[RaveNoX]

Summary

Adds Kubernetes authentication (via TokenReview) and optional Kubernetes RBAC authorization (via SelfSubjectRulesReview).

Users authenticate with Kubernetes bearer tokens; pull/push/delete can be authorized via existing Kubernetes RBAC (Roles/RoleBindings) for a configurable API group and resource.

Changes

Authentication (Kubernetes TokenReview)

• New config block kubernetes_auth: docker login username is fixed (default "token"), password is a Kubernetes bearer token validated via TokenReview.
• Optional kubeconfig path; if omitted, in-cluster config is used.
• Configurable limits (request_timeout, qps, burst) and cache (success_ttl, failure_ttl) for TokenReview.
• User identity exposed as labels: k8s-username, k8s-uid, k8s-groups, k8s-extra-*, and groups for ACL compatibility.
• Prometheus metrics: registry_auth_k8s_authn_requests_total, registry_auth_k8s_authn_request_latency_seconds.

Authorization (optional, SelfSubjectRulesReview)

• Optional authz block under kubernetes_auth enables RBAC-based authorization via SelfSubjectRulesReview.
• Namespace is taken from the first segment of the repository name; repository path is matched against RBAC resourceNames using recursive globbing (e.g. images/**) via doublestar (godoc).
• Configurable api_group and resource (e.g. custom resource registries in registry.example.com).
• Optional namespace_check_verbs: for listed actions (e.g. push, delete), namespace existence is checked before calling SelfSubjectRulesReview.
• Caching for SelfSubjectRulesReview and namespace existence to reduce API server load.
• Prometheus metrics: registry_auth_k8s_authz_rules_requests_total, registry_auth_k8s_authz_rules_request_duration_seconds.
• Evaluation order: ACL is checked first; if it allows, Kubernetes authz is not evaluated (OR logic).

Configuration example

kubernetes_auth:
  # kubeconfig: "/path/to/kubeconfig"  # optional; default: in-cluster
  # username: "token"                   # optional; default: "token"
  limits:
    request_timeout: "10s"
    qps: 5
    burst: 10
  cache:
    success_ttl: "1m"
    failure_ttl: "30s"
  authz:                               # optional; omit for auth-only
    api_group: "registry.example.com"
    resource: "registries"
    namespace_check_verbs: ["push", "delete"]  # optional

RBAC samples

Auth server (TokenReview + SelfSubjectRulesReview)

The auth server's service account needs permission to create TokenReview and SelfSubjectRulesReview, and (if namespace_check_verbs is used) to get/list namespaces:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: registry-auth-server
rules:
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create"]
- apiGroups: ["authorization.k8s.io"]
  resources: ["selfsubjectrulesreviews"]
  verbs: ["create"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: registry-auth-server
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: registry-auth-server
subjects:
- kind: ServiceAccount
  name: <auth-server-sa>
  namespace: <auth-server-namespace>

User/application RBAC (registry path access)

When authz is enabled, grant access to repository paths via Role/ClusterRole on the configured resource (e.g. api_group: "registry.example.com", resource: "registries"). resourceNames are repository path patterns; matching uses recursive globbing (e.g. **). Verb mapping: get → pull, list → catalog/list, create → push, delete → delete tag/manifest.

Read-only (pull + list) for one namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: registry-read-my-app
  namespace: my-app
rules:
- apiGroups: ["registry.example.com"]
  resources: ["registries"]
  resourceNames: ["my-app/*", "my-app/**"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: registry-read-my-app
  namespace: my-app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: registry-read-my-app
subjects:
- kind: ServiceAccount
  name: my-sa
  namespace: my-app

Push and pull (FULL) for a subpath:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: registry-write-my-app-frontend
  namespace: my-app
rules:
- apiGroups: ["registry.example.com"]
  resources: ["registries"]
  resourceNames: ["my-app/frontend/*", "my-app/frontend/**"]
  verbs: ["get", "list", "create", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: registry-write-my-app-frontend
  namespace: my-app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: registry-write-my-app-frontend
subjects:
- kind: ServiceAccount
  name: ci-sa
  namespace: my-app

(With namespace_check_verbs: ["push", "delete"], push/delete are only allowed if namespace my-app exists.)

Requirements

• Kubernetes API server must allow TokenReview and (if authz is used) SelfSubjectRulesReview.
• When authz is enabled, RBAC must grant the auth server's service account permission to create TokenReview and SelfSubjectRulesReview.

Testing

• auth_server/k8s/config_test.go covers config validation and defaults.
• Manual/QA: authenticate with a Kubernetes token and (with authz enabled) verify pull/push/delete according to Role/RoleBinding resourceNames and globs.

Backward compatibility

• Additive only: new config key kubernetes_auth. Existing configs and auth methods are unchanged.

[vadimartynov]

RequestTimeout is used twice. Will this cause any errors?:

• when initializing tokenAuth;
• when calling the AuthenticateToken method;

[RaveNoX]

which problem it can be?

[vadimartynov]

Just thought about the empty value in RequestTimeout.
It is checked in the method, but not at the call level. But ideally, default values should be set there.

I think we can skip it. There shouldn't be any problems.