mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-22 06:19:47 +08:00
Taylor Mutch
702cbc4f63
* feat(providers): support SPIFFE-backed token grants Add provider profile token_grant metadata and expand endpoint-specific dynamic credentials so sandbox supervisors can request SPIFFE JWT-SVIDs, exchange them with an OAuth-style token endpoint, cache returned access tokens, and inject bearer tokens into matching HTTP requests. Wire Kubernetes and Helm deployments to mount the provider SPIFFE Workload API socket into sandbox pods for token grant exchange. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Gordon Sim <gsim@redhat.com> * test(examples): add SPIFFE token grant demo Add a reusable alpha/beta demo that deploys a SPIFFE-verifying token issuer and protected services, imports a token-grant provider profile, creates a sandbox, and verifies endpoint-specific bearer tokens. The script leaves Kubernetes workloads in place, deletes sandboxes through openshell unless KEEP_SANDBOX=1, and prints protected service logs as proof of life. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(providers): harden SPIFFE token grants * fix(providers): harden dynamic token grants Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(providers): harden token grant handling --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Gordon Sim <gsim@redhat.com>
156 lines
4.2 KiB
TOML
156 lines
4.2 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[workspace]
|
|
resolver = "2"
|
|
members = ["crates/*"]
|
|
|
|
[workspace.package]
|
|
version = "0.0.0"
|
|
edition = "2024"
|
|
rust-version = "1.88"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/NVIDIA/OpenShell"
|
|
|
|
[workspace.dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1.43", features = ["full"] }
|
|
|
|
# gRPC/Protobuf
|
|
tonic = "0.14"
|
|
tonic-prost = "0.14"
|
|
tonic-prost-build = "0.14"
|
|
prost = "0.14"
|
|
prost-types = "0.14"
|
|
|
|
# HTTP server
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace", "request-id"] }
|
|
hyper = { version = "1.6", features = ["full"] }
|
|
hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
|
|
http = "1.2"
|
|
http-body = "1.0"
|
|
http-body-util = "0.1"
|
|
|
|
# TLS
|
|
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
|
|
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
|
|
rustls-pemfile = "2"
|
|
rcgen = { version = "0.13", features = ["crypto", "pem"] }
|
|
webpki-roots = "1"
|
|
|
|
# CLI
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
clap_complete = { version = "4.5", features = ["unstable-dynamic"] }
|
|
indicatif = "0.17"
|
|
owo-colors = "4"
|
|
ratatui = "0.26"
|
|
crossterm = "0.28"
|
|
terminal-colorsaurus = "1.0"
|
|
|
|
# Error handling
|
|
miette = { version = "7", features = ["fancy"] }
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Logging/Tracing
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
tracing-appender = "0.2"
|
|
|
|
# Metrics
|
|
metrics = "0.24"
|
|
metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }
|
|
|
|
# Unix/Process
|
|
nix = { version = "0.29", features = ["signal", "process", "user", "fs", "term"] }
|
|
rustix = { version = "1.1", features = ["process"] }
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yml = "0.0.12"
|
|
toml = "0.8"
|
|
apollo-parser = "0.8.5"
|
|
|
|
# HTTP client
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
|
|
|
|
# WebSocket
|
|
tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }
|
|
|
|
# Clipboard (OSC 52)
|
|
base64 = "0.22"
|
|
|
|
# Crypto / Auth
|
|
sha2 = "0.10"
|
|
rand = "0.9"
|
|
jsonwebtoken = "9"
|
|
getrandom = "0.3"
|
|
spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "tracing"] }
|
|
|
|
# Filesystem embedding
|
|
include_dir = "0.7"
|
|
|
|
# Glob matching
|
|
glob = "0.3"
|
|
|
|
# Utilities
|
|
futures = "0.3"
|
|
bytes = "1"
|
|
pin-project-lite = "0.2"
|
|
tokio-stream = "0.1"
|
|
protobuf-src = "1.1.0"
|
|
url = "2"
|
|
|
|
# Database
|
|
sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "sqlite", "migrate"] }
|
|
|
|
# Kubernetes
|
|
kube = { version = "0.90", features = ["runtime", "derive"] }
|
|
kube-runtime = "0.90"
|
|
k8s-openapi = { version = "0.21.1", features = ["v1_26"] }
|
|
|
|
# IDs
|
|
uuid = { version = "1.10", features = ["v4"] }
|
|
|
|
# SMT solver (uses system libz3; enable z3/bundled via the prover's bundled-z3 feature for local dev without system z3)
|
|
z3 = "0.19"
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "warn"
|
|
rust_2018_idioms = { level = "warn", priority = -1 }
|
|
trivial_casts = "warn"
|
|
trivial_numeric_casts = "warn"
|
|
unused_lifetimes = "warn"
|
|
unused_qualifications = "warn"
|
|
|
|
[workspace.lints.clippy]
|
|
all = { level = "warn", priority = -1 }
|
|
pedantic = { level = "warn", priority = -1 }
|
|
nursery = { level = "warn", priority = -1 }
|
|
|
|
# Allow certain pedantic lints that are too noisy
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
|
|
# Allow noisy nursery lints
|
|
significant_drop_tightening = "allow" # Often gives incorrect suggestions
|
|
missing_const_for_fn = "allow" # Too noisy for async code patterns
|
|
|
|
# Allow noisy pedantic lints
|
|
too_many_lines = "allow" # Function length limits are subjective
|
|
needless_pass_by_value = "allow" # Common pattern in async handlers
|
|
ref_option = "allow" # Common pattern for optional references
|
|
missing_fields_in_debug = "allow" # Manual Debug impls often intentionally omit fields
|
|
|
|
[profile.release]
|
|
strip = true
|
|
|
|
[profile.dev]
|
|
# Faster compile times for dev builds
|
|
debug = 1
|