{
  "repo": "tidbcloud/kube-oidc",
  "binary": "kube-oidc-proxy",
  "binary_path": "cmd/kube-oidc-proxy/main.go",
  "dependencies": {
    "Runtime KubernetesAuthProxy.ProxyRequest": {
      "infrastructure": {
        "oidc_provider": {
          "conditions": [
            "Always during authenticated proxy requests"
          ],
          "operations": [
            {
              "operation": "Validate OIDC bearer tokens and resolve user and group claims",
              "trigger": "Incoming request carries an Authorization bearer token",
              "implementation": "serveKubeOIDCProxy builds an oidc authenticator and proxy.ServeHTTP calls AuthenticateToken before injecting Impersonate-* headers"
            }
          ]
        }
      },
      "services": [
        {
          "name": "kubernetes_api",
          "target_interface": "configured Kubernetes API endpoint from kubeconfig",
          "conditions": [
            "Always"
          ],
          "operations": [
            {
              "operation": "Reverse proxy authenticated HTTP requests to the Kubernetes API backend",
              "trigger": "Any non-upgrade request reaches the auth proxy",
              "implementation": "authproxy.New wires httputil.NewSingleHostReverseProxy to kubeconfig endpoint and applies backend auth before forwarding"
            }
          ]
        }
      ]
    },
    "Runtime KubernetesAuthProxy.UpgradeProxy": {
      "infrastructure": {},
      "services": [
        {
          "name": "kubernetes_api",
          "target_interface": "configured Kubernetes API endpoint from kubeconfig",
          "conditions": [
            "Only for upgrade requests"
          ],
          "operations": [
            {
              "operation": "Tunnel upgrade-capable traffic such as exec or attach to the Kubernetes API backend",
              "trigger": "isUpgradeRequest(r) returns true",
              "implementation": "proxy.ServeHTTP switches to tcpProxy.ServeHTTP for upgraded connections"
            }
          ]
        }
      ]
    }
  }
}