security

Documentation

Index

• Constants
• func CertPool(certPem []byte) (*x509.CertPool, error)
• func ExcludedRoute(route string) bool
• func GetAPIToken() string
• func GetAppToken() string
• func GetCertChain() (*credentials.CertChain, error)
• type Authenticator
  • func GetSidecarAuthenticator(sentryAddress string, certChain *credentials.CertChain) (Authenticator, error)
• type SignedCertificate

Constants

const (
	// APITokenEnvVar is the environment variable for the api token
	APITokenEnvVar    = "DAPR_API_TOKEN"
	AppAPITokenEnvVar = "APP_API_TOKEN"
	// APITokenHeader is header name for http/gRPC calls to hold the token
	APITokenHeader = "dapr-api-token"
)

#nosec

const (
	TLSServerName = "cluster.local"
)

Functions

func CertPool

func CertPool(certPem []byte) (*x509.CertPool, error)

func ExcludedRoute

func ExcludedRoute(route string) bool

ExcludedRoute returns whether a given route should be excluded from a token check

func GetAPIToken

func GetAPIToken() string

GetAPIToken returns the value of the api token from an environment variable

func GetAppToken

func GetAppToken() string

GetAppToken returns the value of the app api token from an environment variable

func GetCertChain

func GetCertChain() (*credentials.CertChain, error)

Types

type Authenticator

type Authenticator interface {
	GetTrustAnchors() *x509.CertPool
	GetCurrentSignedCert() *SignedCertificate
	CreateSignedWorkloadCert(id, namespace, trustDomain string) (*SignedCertificate, error)
}

func GetSidecarAuthenticator

func GetSidecarAuthenticator(sentryAddress string, certChain *credentials.CertChain) (Authenticator, error)

GetSidecarAuthenticator returns a new authenticator with the extracted trust anchors

type SignedCertificate

type SignedCertificate struct {
	WorkloadCert  []byte
	PrivateKeyPem []byte
	Expiry        time.Time
	TrustChain    *x509.CertPool
}