sia

README

SIA for GCP Run

Configuration

SIA GCP Run requires a configuration file to be present in the /etc/sia/sia_config with the following required attributes

{
    "version": "1.0.0",
    "domain": "application-domain-name",
    "service": "application-service-name"
}

The Google Project administrator must create a Google Service Account with the name <application-service-name>.

SIA Configuration file provides a way to change the default user/group settings that the private key is owned by. By default, the private key is owned by user root and readable by group athenz. If the admin wants to provide access to their service identity private key to another user, it can be accomplished by adding the user to the group athenz. If the user wants to change the user and group values, a config file must contain following optional fields:

{
    "version": "1.0.0",
    "domain": "application-domain-name",
    "service": "application-service-name",
    "user": "unix-username",
    "group": "unix-groupname"
}

SIA-RUN can be built with following parameters - e.g.

GOOS=linux go install -ldflags "-X main.Version=1.0.0 -X main.ZtsEndPoint=zts.athenz.io -X main.DnsDomain=gcp.athenz.io -X main.ProviderPrefix=athenz.gcp" ./...

alternatively, those parameters can be passed during runtime and runtime parameters will take precedence over build time parameters.

Documentation

Index

• func GetRunConfig(configFile, metaEndpoint, region string, provider provider.Provider) (*options.Config, error)
• type GCPRunProvider
  • func (gcprun GCPRunProvider) AttestationData(_ string, _ crypto.PrivateKey, _ *signature.SignatureInfo) (string, error)
  • func (gcprun GCPRunProvider) CloudAttestationData(base, svc, ztsServerName string) (string, error)
  • func (gcprun GCPRunProvider) GetAccessManagementProfileFromMeta(base string) (string, error)
  • func (gcprun GCPRunProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)
  • func (gcprun GCPRunProvider) GetAdditionalSshHostPrincipals(base string) (string, error)
  • func (gcprun GCPRunProvider) GetCsrDn() pkix.Name
  • func (gcprun GCPRunProvider) GetEmail(_ string) []string
  • func (gcprun GCPRunProvider) GetHostname(fqdn bool) string
  • func (gcprun GCPRunProvider) GetName() string
  • func (gcprun GCPRunProvider) GetRoleDnsNames(_ *x509.Certificate, _ string) []string
  • func (gcprun GCPRunProvider) GetSanDns(_ string, _ bool, _ bool, _ []string) []string
  • func (gcprun GCPRunProvider) GetSanIp(_ map[string]bool, _ []net.IP, _ ip.Opts) []net.IP
  • func (gcprun GCPRunProvider) GetSanUri(_ string, _ ip.Opts, _, _ string) []*url.URL
  • func (gcprun GCPRunProvider) GetSuffixes() []string
  • func (gcprun GCPRunProvider) PrepareKey(_ string) (crypto.PrivateKey, error)

Functions

func GetRunConfig

func GetRunConfig(configFile, metaEndpoint, region string, provider provider.Provider) (*options.Config, error)

Types

type GCPRunProvider

type GCPRunProvider struct {
	Name string
}

func (GCPRunProvider) AttestationData

func (gcprun GCPRunProvider) AttestationData(_ string, _ crypto.PrivateKey, _ *signature.SignatureInfo) (string, error)

func (GCPRunProvider) CloudAttestationData

func (gcprun GCPRunProvider) CloudAttestationData(base, svc, ztsServerName string) (string, error)

func (GCPRunProvider) GetAccessManagementProfileFromMeta

func (gcprun GCPRunProvider) GetAccessManagementProfileFromMeta(base string) (string, error)

func (GCPRunProvider) GetAccountDomainServiceFromMeta

func (gcprun GCPRunProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)

func (GCPRunProvider) GetAdditionalSshHostPrincipals

func (gcprun GCPRunProvider) GetAdditionalSshHostPrincipals(base string) (string, error)

func (GCPRunProvider) GetCsrDn

func (gcprun GCPRunProvider) GetCsrDn() pkix.Name

func (GCPRunProvider) GetEmail

func (gcprun GCPRunProvider) GetEmail(_ string) []string

func (GCPRunProvider) GetHostname

func (gcprun GCPRunProvider) GetHostname(fqdn bool) string

GetHostname returns the hostname as per the provider

func (GCPRunProvider) GetName

func (gcprun GCPRunProvider) GetName() string

GetName returns the name of the current provider

func (GCPRunProvider) GetRoleDnsNames

func (gcprun GCPRunProvider) GetRoleDnsNames(_ *x509.Certificate, _ string) []string

func (GCPRunProvider) GetSanDns

func (gcprun GCPRunProvider) GetSanDns(_ string, _ bool, _ bool, _ []string) []string

func (GCPRunProvider) GetSanIp

func (gcprun GCPRunProvider) GetSanIp(_ map[string]bool, _ []net.IP, _ ip.Opts) []net.IP

func (GCPRunProvider) GetSanUri

func (gcprun GCPRunProvider) GetSanUri(_ string, _ ip.Opts, _, _ string) []*url.URL

func (GCPRunProvider) GetSuffixes

func (gcprun GCPRunProvider) GetSuffixes() []string

func (GCPRunProvider) PrepareKey

func (gcprun GCPRunProvider) PrepareKey(_ string) (crypto.PrivateKey, error)