API · 02 of 03 · Auth

How glidepath-api decides a call

Authentication is the cluster's TokenReview. Authorization is ordinary RBAC on a group nothing serves. Every refusal has a name an agent can branch on, and nothing goes unrecorded.

How glidepath-api decides a call Five steps in order. Who are you: a TokenReview by the cluster, or a people-dex ID token glidepath-api verifies itself. Acting for whom: only a listed delegate such as Tower may name a person with On-Behalf-Of. May you: a SubjectAccessReview in the app's cicd namespace on the virtual group glidepath.hangar.io, the focal step. Do it: a read, a re-run or cancel, or a proposal. Answer: JSON with a stable rule id. Each of the first four can refuse with a stable rule: GP-AUTH-001 or 002, GP-AUTH-003 or 004, GP-AUTHZ-001 (an app answers 404 only to someone who could read it), and GP-API-422 when the cluster's shape lock or the release plan says no. Every call, allowed or refused, writes one audit line, one metric and one span with the operation, tier, app, caller, on-behalf-of, decision, status, time and trace id. EVERY CALL, IN ORDERREFUSED, WITH A RULEWRITTEN DOWN, EITHER WAYAUTHENTICATEWho are you?TokenReview, or an ID tokenDELEGATEActing for whom?On-Behalf-Of: delegates onlyAUTHORIZEMay you?SubjectAccessReview, app nsACTDo itread · re-run · proposeRESPONDAnswerJSON, a stable rule idGP-AUTH-001 / 002no token, or not acceptedGP-AUTH-003 / 004not a delegate · no personGP-AUTHZ-001404 only if you could readGP-API-422shape lock or plan said noOne audit line, one metric, one spanop · tier · app · caller · onBehalfOf · decision · status · ms · traceIdThe cluster already knows who you are. RBAC only needs the strings.LEGENDThe decisionA stepA refusalThe recordRefused

Who

Anything the cluster trusts works: an in-cluster ServiceAccount, a federated identity from the other cluster, or since November 1 a person signed in with people-dex.

What

runs, runs/logs, releases, evidence, tests, environments, events and cicd: strings in a ClusterRole. Three roles, reader, operator and releaser, and all of them empty on a fresh install.

For whom

Tower writes as tower-actor and names the person. The API authorizes Tower and records the person; Tower checks ownership before it calls.

Hangar · Glidepath · API