provisioner

Nov 22, 2019

Changes in this version

+ const K8sSAID

+ const K8sSAName

+ type K8sSA struct

+ Claims *Claims

+ Name string

+ PubKeys []byte

+ Type string

+ func (p *K8sSA) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *K8sSA) AuthorizeRevoke(token string) error

+ func (p *K8sSA) AuthorizeSign(ctx context.Context, token string) ([]SignOption, error)

+ func (p *K8sSA) GetEncryptedKey() (string, string, bool)

+ func (p *K8sSA) GetID() string

+ func (p *K8sSA) GetName() string

+ func (p *K8sSA) GetTokenID(ott string) (string, error)

+ func (p *K8sSA) GetType() Type

+ func (p *K8sSA) Init(config Config) (err error)

type Type

+ const TypeK8sSA

+ const TypeX5C

+ type X5C struct

+ Claims *Claims

+ Name string

+ Roots []byte

+ Type string

+ func (p *X5C) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *X5C) AuthorizeRevoke(token string) error

+ func (p *X5C) AuthorizeSign(ctx context.Context, token string) ([]SignOption, error)

+ func (p *X5C) GetEncryptedKey() (string, string, bool)

+ func (p *X5C) GetID() string

+ func (p *X5C) GetName() string

+ func (p *X5C) GetTokenID(ott string) (string, error)

+ func (p *X5C) GetType() Type

+ func (p *X5C) Init(config Config) error

Sep 20, 2019

Changes in this version

type OIDC

+ ListenAddress string

Sep 13, 2019

Changes in this version

+ type ACME struct

+ Claims *Claims

+ Name string

+ Type string

+ func (p *ACME) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *ACME) AuthorizeRevoke(token string) error

+ func (p *ACME) AuthorizeSign(ctx context.Context, _ string) ([]SignOption, error)

+ func (p *ACME) GetEncryptedKey() (string, string, bool)

+ func (p *ACME) GetName() string

+ func (p *ACME) GetTokenID(ott string) (string, error)

+ func (p *ACME) GetType() Type

+ func (p *ACME) Init(config Config) (err error)

+ func (p ACME) GetID() string

+ type MockProvisioner struct

+ MauthorizeRenewal func(*x509.Certificate) error

+ MauthorizeRevoke func(ott string) error

+ MauthorizeSign func(ctx context.Context, ott string) ([]SignOption, error)

+ Merr error

+ MgetEncryptedKey func() (string, string, bool)

+ MgetID func() string

+ MgetName func() string

+ MgetTokenID func(string) (string, error)

+ MgetType func() Type

+ Minit func(Config) error

+ Mret1 interface{}

+ Mret2 interface{}

+ Mret3 interface{}

+ func (m *MockProvisioner) AuthorizeRenewal(c *x509.Certificate) error

+ func (m *MockProvisioner) AuthorizeRevoke(ott string) error

+ func (m *MockProvisioner) AuthorizeSign(ctx context.Context, ott string) ([]SignOption, error)

+ func (m *MockProvisioner) GetEncryptedKey() (string, string, bool)

+ func (m *MockProvisioner) GetID() string

+ func (m *MockProvisioner) GetName() string

+ func (m *MockProvisioner) GetTokenID(token string) (string, error)

+ func (m *MockProvisioner) GetType() Type

+ func (m *MockProvisioner) Init(c Config) error

type Type

+ const TypeACME

Sep 9, 2019

Changes in this version

+ const SSHHostCert

+ const SSHUserCert

+ func NewContextWithMethod(ctx context.Context, method Method) context.Context

+ func SanitizeSSHUserPrincipal(email string) string

type Claimer

+ func (c *Claimer) DefaultHostSSHCertDuration() time.Duration

+ func (c *Claimer) DefaultUserSSHCertDuration() time.Duration

+ func (c *Claimer) IsSSHCAEnabled() bool

+ func (c *Claimer) MaxHostSSHCertDuration() time.Duration

+ func (c *Claimer) MaxUserSSHCertDuration() time.Duration

+ func (c *Claimer) MinHostSSHCertDuration() time.Duration

+ func (c *Claimer) MinUserSSHCertDuration() time.Duration

type Claims

+ DefaultHostSSHDur *Duration

+ DefaultUserSSHDur *Duration

+ EnableSSHCA *bool

+ MaxHostSSHDur *Duration

+ MaxUserSSHDur *Duration

+ MinHostSSHDur *Duration

+ MinUserSSHDur *Duration

+ type Method int

+ const RevokeMethod

+ const SignMethod

+ const SignSSHMethod

+ func MethodFromContext(ctx context.Context) Method

+ type SSHCertificateModifier interface

+ Modify func(cert *ssh.Certificate) error

+ type SSHCertificateOptionModifier interface

+ Option func(o SSHOptions) SSHCertificateModifier

+ type SSHCertificateOptionsValidator interface

+ Valid func(got SSHOptions) error

+ type SSHCertificateValidator interface

+ Valid func(cert *ssh.Certificate) error

+ type SSHOptions struct

+ CertType string

+ Principals []string

+ ValidAfter TimeDuration

+ ValidBefore TimeDuration

+ func (o SSHOptions) Modify(cert *ssh.Certificate) error

+ func (o SSHOptions) Type() uint32

type TimeDuration

+ func (t *TimeDuration) Equal(other *TimeDuration) bool

+ func (t *TimeDuration) IsZero() bool

+ func (t *TimeDuration) Unix() int64

Aug 29, 2019

Changes in this version

+ type AWS struct

+ Accounts []string

+ Claims *Claims

+ DisableCustomSANs bool

+ DisableTrustOnFirstUse bool

+ InstanceAge Duration

+ Name string

+ Type string

+ func (p *AWS) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *AWS) AuthorizeRevoke(token string) error

+ func (p *AWS) AuthorizeSign(token string) ([]SignOption, error)

+ func (p *AWS) GetEncryptedKey() (kid string, key string, ok bool)

+ func (p *AWS) GetID() string

+ func (p *AWS) GetIdentityToken(subject, caURL string) (string, error)

+ func (p *AWS) GetName() string

+ func (p *AWS) GetTokenID(token string) (string, error)

+ func (p *AWS) GetType() Type

+ func (p *AWS) Init(config Config) (err error)

type Audiences

+ func (a Audiences) WithFragment(fragment string) Audiences

+ type Azure struct

+ Audience string

+ Claims *Claims

+ DisableCustomSANs bool

+ DisableTrustOnFirstUse bool

+ Name string

+ ResourceGroups []string

+ TenantID string

+ Type string

+ func (p *Azure) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *Azure) AuthorizeRevoke(token string) error

+ func (p *Azure) AuthorizeSign(token string) ([]SignOption, error)

+ func (p *Azure) GetEncryptedKey() (kid string, key string, ok bool)

+ func (p *Azure) GetID() string

+ func (p *Azure) GetIdentityToken(subject, caURL string) (string, error)

+ func (p *Azure) GetName() string

+ func (p *Azure) GetTokenID(token string) (string, error)

+ func (p *Azure) GetType() Type

+ func (p *Azure) Init(config Config) (err error)

type Duration

+ func NewDuration(s string) (*Duration, error)

+ func (d *Duration) Value() time.Duration

+ type GCP struct

+ Claims *Claims

+ DisableCustomSANs bool

+ DisableTrustOnFirstUse bool

+ InstanceAge Duration

+ Name string

+ ProjectIDs []string

+ ServiceAccounts []string

+ Type string

+ func (p *GCP) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *GCP) AuthorizeRevoke(token string) error

+ func (p *GCP) AuthorizeSign(token string) ([]SignOption, error)

+ func (p *GCP) GetEncryptedKey() (kid string, key string, ok bool)

+ func (p *GCP) GetID() string

+ func (p *GCP) GetIdentityToken(subject, caURL string) (string, error)

+ func (p *GCP) GetIdentityURL(audience string) string

+ func (p *GCP) GetName() string

+ func (p *GCP) GetTokenID(token string) (string, error)

+ func (p *GCP) GetType() Type

+ func (p *GCP) Init(config Config) error

type OIDC

+ Groups []string

type TimeDuration

+ func (t *TimeDuration) RelativeTime(base time.Time) time.Time

type Type

+ const TypeAWS

+ const TypeAzure

+ const TypeGCP

+ func (t Type) String() string

Apr 30, 2019

Changes in this version

+ const RevokeAudienceKey

+ const SignAudienceKey

+ type Audiences struct

+ Revoke []string

+ Sign []string

+ func (a *Audiences) All() []string

type Interface

+ AuthorizeSign func(token string) ([]SignOption, error)

+ GetTokenID func(token string) (string, error)

type JWK

+ func (p *JWK) AuthorizeSign(token string) ([]SignOption, error)

+ func (p *JWK) GetTokenID(ott string) (string, error)

type OIDC

+ func (o *OIDC) AuthorizeSign(token string) ([]SignOption, error)

+ func (o *OIDC) GetTokenID(ott string) (string, error)

Mar 26, 2019

Changes in this version

+ const DefaultProvisionersLimit

+ const DefaultProvisionersMax

+ type CertificateRequestValidator interface

+ Valid func(req *x509.CertificateRequest) error

+ type CertificateValidator interface

+ Valid func(crt *x509.Certificate) error

+ type Claimer struct

+ func NewClaimer(claims *Claims, global Claims) (*Claimer, error)

+ func (c *Claimer) Claims() Claims

+ func (c *Claimer) DefaultTLSCertDuration() time.Duration

+ func (c *Claimer) IsDisableRenewal() bool

+ func (c *Claimer) MaxTLSCertDuration() time.Duration

+ func (c *Claimer) MinTLSCertDuration() time.Duration

+ func (c *Claimer) Validate() error

+ type Claims struct

+ DefaultTLSDur *Duration

+ DisableRenewal *bool

+ MaxTLSDur *Duration

+ MinTLSDur *Duration

+ type Collection struct

+ func NewCollection(audiences []string) *Collection

+ func (c *Collection) Find(cursor string, limit int) (List, string)

+ func (c *Collection) Load(id string) (Interface, bool)

+ func (c *Collection) LoadByCertificate(cert *x509.Certificate) (Interface, bool)

+ func (c *Collection) LoadByToken(token *jose.JSONWebToken, claims *jose.Claims) (Interface, bool)

+ func (c *Collection) LoadEncryptedKey(keyID string) (string, bool)

+ func (c *Collection) Store(p Interface) error

+ type Config struct

+ Audiences []string

+ Claims Claims

+ type Duration struct

+ func (d *Duration) MarshalJSON() ([]byte, error)

+ func (d *Duration) UnmarshalJSON(data []byte) (err error)

+ type Interface interface

+ Authorize func(token string) ([]SignOption, error)

+ AuthorizeRenewal func(cert *x509.Certificate) error

+ AuthorizeRevoke func(token string) error

+ GetEncryptedKey func() (kid string, key string, ok bool)

+ GetID func() string

+ GetName func() string

+ GetType func() Type

+ Init func(config Config) error

+ type JWK struct

+ Claims *Claims

+ EncryptedKey string

+ Key *jose.JSONWebKey

+ Name string

+ Type string

+ func (p *JWK) Authorize(token string) ([]SignOption, error)

+ func (p *JWK) AuthorizeRenewal(cert *x509.Certificate) error

+ func (p *JWK) AuthorizeRevoke(token string) error

+ func (p *JWK) GetEncryptedKey() (string, string, bool)

+ func (p *JWK) GetID() string

+ func (p *JWK) GetName() string

+ func (p *JWK) GetType() Type

+ func (p *JWK) Init(config Config) (err error)

+ type List []Interface

+ func (l *List) UnmarshalJSON(data []byte) error

+ type OIDC struct

+ Admins []string

+ Claims *Claims

+ ClientID string

+ ClientSecret string

+ ConfigurationEndpoint string

+ Domains []string

+ Name string

+ Type string

+ func (o *OIDC) Authorize(token string) ([]SignOption, error)

+ func (o *OIDC) AuthorizeRenewal(cert *x509.Certificate) error

+ func (o *OIDC) AuthorizeRevoke(token string) error

+ func (o *OIDC) GetEncryptedKey() (kid string, key string, ok bool)

+ func (o *OIDC) GetID() string

+ func (o *OIDC) GetName() string

+ func (o *OIDC) GetType() Type

+ func (o *OIDC) Init(config Config) (err error)

+ func (o *OIDC) IsAdmin(email string) bool

+ func (o *OIDC) ValidatePayload(p openIDPayload) error

+ type Options struct

+ NotAfter TimeDuration

+ NotBefore TimeDuration

+ type ProfileModifier interface

+ Option func(o Options) x509util.WithOption

+ type SignOption interface

+ type TimeDuration struct

+ func NewTimeDuration(t time.Time) TimeDuration

+ func ParseTimeDuration(s string) (TimeDuration, error)

+ func (t *TimeDuration) SetDuration(d time.Duration)

+ func (t *TimeDuration) SetTime(tt time.Time)

+ func (t *TimeDuration) String() string

+ func (t *TimeDuration) Time() time.Time

+ func (t *TimeDuration) UnmarshalJSON(data []byte) error

+ func (t TimeDuration) MarshalJSON() ([]byte, error)

+ type Type int

+ const TypeJWK

+ const TypeOIDC