agentcrypto

Documentation

Overview

Package agentcrypto provides various cryptography related utility functions for Guest Agent.

Index

• Constants
• func Init(ctx context.Context)
• type CredsJob
  • func New() *CredsJob
  • func (j *CredsJob) ID() string
  • func (j *CredsJob) Interval() (time.Duration, bool)
  • func (j *CredsJob) Run(ctx context.Context) (bool, error)
  • func (j *CredsJob) ShouldEnable(ctx context.Context) bool

Constants

const (

	// MTLSSchedulerID is the identifier used by job scheduler.
	MTLSSchedulerID = "MTLS_MDS_Credential_Boostrapper"
	// MTLSScheduleInterval is interval at which credential bootstrapper runs.
	MTLSScheduleInterval = 48 * time.Hour
)

Functions

func Init

func Init(ctx context.Context)

Init intializes the mds mtls credential bootstrapping job and subscribes to MDS long poll event. This allows handler to enable/disable the job based on MDS keys.

Types

type CredsJob

type CredsJob struct {
	// contains filtered or unexported fields
}

CredsJob implements job scheduler interface for generating/rotating credentials.

func New

func New() *CredsJob

New initializes new job.

func (*CredsJob) ID

func (j *CredsJob) ID() string

ID returns the ID for this job.

func (*CredsJob) Interval

func (j *CredsJob) Interval() (time.Duration, bool)

Interval returns the interval at which job is executed.

func (*CredsJob) Run

func (j *CredsJob) Run(ctx context.Context) (bool, error)

Run generates the required credentials for MTLS MDS workflow.

1. Fetches, verifies and writes Root CA cert from UEFI variable to /run/google-mds-mtls/root.crt 2. Fetches encrypted client credentials from MDS, decrypts it via vTPM and writes it to /run/google-mds-mtls/client.key

Note that these credentials are at `C:\Program Files\Google\Compute Engine\certs\mds` on Windows. Additionally agent also generates a PFX file on windows that can be used invoking HTTPS endpoint.

Example usage of these credentials to call HTTPS endpoint of MDS:

curl --cacert /run/google-mds-mtls/root.crt -E /run/google-mds-mtls/client.key -H "MetadataFlavor: Google" https://169.254.169.254

Windows example:

$cert = Get-PfxCertificate -FilePath "C:\ProgramData\Google\Compute Engine\mds-mtls-client.key.pfx" or $cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Issuer -like "*google.internal*" } Invoke-RestMethod -Uri https://169.254.169.254 -Method Get -Headers @{"Metadata-Flavor"="Google"} -Certificate $cert

func (*CredsJob) ShouldEnable

func (j *CredsJob) ShouldEnable(ctx context.Context) bool

ShouldEnable implements scheduler job interface which returns true if job should be scheduled based on previous cached [isEnabled] value.