server

Documentation

Index

• type AuthenticatorOptions
• type ClusterNodeAuthorizer
  • func NewClusterNodeAuthorizer(client kube.Client, trustedNodeAccounts sets.Set[types.NamespacedName]) *ClusterNodeAuthorizer
• type Options
• type Server
  • func New(log logr.Logger, restConfig *rest.Config, cm certmanager.Signer, ...) (*Server, error)
  • func (s *Server) Check(_ *http.Request) error
  • func (s *Server) CreateCertificate(ctx context.Context, icr *securityapi.IstioCertificateRequest) (*securityapi.IstioCertificateResponse, error)
  • func (s *Server) NeedLeaderElection() bool
  • func (s *Server) Start(ctx context.Context) error

Types

type AuthenticatorOptions

type AuthenticatorOptions struct {
	// EnableClientCert enables the client certificate authenticator when true.
	EnableClientCert bool
}

type ClusterNodeAuthorizer

type ClusterNodeAuthorizer struct {
	// contains filtered or unexported fields
}

func NewClusterNodeAuthorizer

func NewClusterNodeAuthorizer(client kube.Client, trustedNodeAccounts sets.Set[types.NamespacedName]) *ClusterNodeAuthorizer

type Options

type Options struct {
	// ClusterID is the ID of the cluster to verify requests to.
	ClusterID string

	// Address to serve the gRPC service
	ServingAddress string

	// MaximumClientCertificateDuration is the maximum duration a client can
	// request its duration for. If the client requests a duration larger than
	// this value, this value will be used instead.
	MaximumClientCertificateDuration time.Duration

	// Authenticators configures authenticators to use for incoming CSR requests.
	Authenticators AuthenticatorOptions

	CATrustedNodeAccounts []string
}

type Server

type Server struct {
	securityapi.UnimplementedIstioCertificateServiceServer
	// contains filtered or unexported fields
}

Server is the implementation of the istio CreateCertificate service

func New

func New(log logr.Logger, restConfig *rest.Config, cm certmanager.Signer, tls tls.Interface, opts Options) (*Server, error)

func (*Server) Check

func (s *Server) Check(_ *http.Request) error

Check is used by the shared readiness manager to expose whether the server is ready.

func (*Server) CreateCertificate

func (s *Server) CreateCertificate(ctx context.Context, icr *securityapi.IstioCertificateRequest) (*securityapi.IstioCertificateResponse, error)

CreateCertificate is the istio grpc API func, to authenticate, authorize, and sign CSRs requests from istio clients.

func (*Server) NeedLeaderElection

func (s *Server) NeedLeaderElection() bool

All istio-csr's should serve the CreateCertificate service

func (*Server) Start

func (s *Server) Start(ctx context.Context) error

Start is a blocking func that will run the client facing certificate service