istioca

Documentation

Index

• func GetCertIstio(ctx context.Context, ma *meshauth.MeshAuth, dest *meshauth.Dest, ttlSec int, ...) ([]string, error)
• type IstioCA
  • func New(ctx context.Context, ma *meshauth.MeshAuth) *IstioCA
  • func (X *IstioCA) CreateCertificate(ctx context.Context, r *connect.Request[auth.IstioCertificateRequest]) (*connect.Response[auth.IstioCertificateResponse], error)

Functions

func GetCertIstio

func GetCertIstio(ctx context.Context, ma *meshauth.MeshAuth,
	dest *meshauth.Dest, ttlSec int, certSigner string) ([]string, error)

GetCertIstio implements the basic Istio gRPC protocol as client, getting a cert for the primary key in MeshAuth.

The 'dest' must be configured with

• TokenSource reading the istio-ca mounted token
• K8S token source returning "istio-ca" certs (using cluster, kubeconfig or other user creds)
• An existing certificate
• A long-lived certificate

Types

type IstioCA

type IstioCA struct {

	// Map of issuers to trust domains.
	TrustDomains map[string]string
	CA           *meshauth.CA
	Auth         *meshauth.MeshAuth
}

Reflective CA. Will accept any valid JWT and return a cert for the same identity. Trust domain is based on the JWT issuer.

func New

func New(ctx context.Context, ma *meshauth.MeshAuth) *IstioCA

func (*IstioCA) CreateCertificate

func (X *IstioCA) CreateCertificate(ctx context.Context, r *connect.Request[auth.IstioCertificateRequest]) (*connect.Response[auth.IstioCertificateResponse], error)