util

Documentation

Index

• func ExtractJwtAud(jwt string) ([]string, bool)
• func GetAud(token string) ([]string, error)
• func GetExp(token string) (time.Time, error)
• func IsK8SUnbound(jwt string) bool
• type CertUtil
• type CertUtilImpl
  • func NewCertUtil(gracePeriodPercentage int) CertUtilImpl
  • func (cu CertUtilImpl) GetWaitTime(certBytes []byte, now time.Time, minGracePeriod time.Duration) (time.Duration, error)

Functions

func ExtractJwtAud

func ExtractJwtAud(jwt string) ([]string, bool)

ExtractJwtAud extracts the audiences from a JWT token. If aud cannot be parse, the bool will be set to false. This distinguishes aud=[] from not parsed.

func GetAud

func GetAud(token string) ([]string, error)

GetAud returns the claim `aud` from the token. Returns nil if not found.

func GetExp

func GetExp(token string) (time.Time, error)

GetExp returns token expiration time, or error on failures.

func IsK8SUnbound

func IsK8SUnbound(jwt string) bool

IsK8SUnbound detects if the token is a K8S unbound token. It is a regular JWT with no audience and expiration, which can be exchanged with bound tokens with audience.

This is used to determine if we check audience in the token. Clients should not use unbound tokens except in cases where bound tokens are not possible.

Types

type CertUtil

type CertUtil interface {
	// GetWaitTime returns the waiting time before renewing the certificate.
	GetWaitTime([]byte, time.Time, time.Duration) (time.Duration, error)
}

CertUtil is an interface for utility functions on certificate.

type CertUtilImpl

type CertUtilImpl struct {
	// contains filtered or unexported fields
}

CertUtilImpl is the implementation of CertUtil, for production use.

func NewCertUtil

func NewCertUtil(gracePeriodPercentage int) CertUtilImpl

NewCertUtil returns a new CertUtilImpl

func (CertUtilImpl) GetWaitTime

func (cu CertUtilImpl) GetWaitTime(certBytes []byte, now time.Time, minGracePeriod time.Duration) (time.Duration, error)

GetWaitTime returns the waiting time before renewing the cert, based on current time, the timestamps in cert and grace period.