cert

Documentation

Index

• type Provider
  • func DefaultProvider() (Provider, error)
  • func NewEnterpriseCertificateProxyProvider(configFilePath string) (Provider, error)
  • func NewSecureConnectProvider(configFilePath string) (Provider, error)
  • func NewWorkloadX509CertProvider(configFilePath string) (Provider, error)

Types

type Provider

type Provider func(*tls.CertificateRequestInfo) (*tls.Certificate, error)

Provider is a function that can be passed into crypto/tls.Config.GetClientCertificate.

func DefaultProvider

func DefaultProvider() (Provider, error)

DefaultProvider returns a certificate source using the preferred EnterpriseCertificateProxySource. If EnterpriseCertificateProxySource is not available, fall back to the legacy SecureConnectSource.

If neither source is available (due to missing configurations), a nil Source and a nil Error are returned to indicate that a default certificate source is unavailable.

func NewEnterpriseCertificateProxyProvider

func NewEnterpriseCertificateProxyProvider(configFilePath string) (Provider, error)

NewEnterpriseCertificateProxyProvider creates a certificate source using the Enterprise Certificate Proxy client, which delegates certifcate related operations to an OS-specific "signer binary" that communicates with the native keystore (ex. keychain on MacOS).

The configFilePath points to a config file containing relevant parameters such as the certificate issuer and the location of the signer binary. If configFilePath is empty, the client will attempt to load the config from a well-known gcloud location.

func NewSecureConnectProvider

func NewSecureConnectProvider(configFilePath string) (Provider, error)

NewSecureConnectProvider creates a certificate source using the Secure Connect Helper and its associated metadata file.

The configFilePath points to the location of the context aware metadata file. If configFilePath is empty, use the default context aware metadata location.

func NewWorkloadX509CertProvider

func NewWorkloadX509CertProvider(configFilePath string) (Provider, error)

NewWorkloadX509CertProvider creates a certificate source that reads a certificate and private key file from the local file system. This is intended to be used for workload identity federation.

The configFilePath points to a config file containing relevant parameters such as the certificate and key file paths. If configFilePath is empty, the client will attempt to load the config from a well-known gcloud location.