istioca

Documentation

Index

• Constants
• func GetCertIstio(ctx context.Context, ma *meshauth.Mesh, dest *meshauth.Dest, ttlSec int, ...) (string, []string, error)
• func NewCSR(priv crypto.PrivateKey, san string) (csrPEM []byte, err error)
• type IstioCA
  • func New(ctx context.Context, ma *meshauth.Mesh) *IstioCA
  • func (ca *IstioCA) CreateCertificate(ctx context.Context, r *connect.Request[auth.IstioCertificateRequest]) (*connect.Response[auth.IstioCertificateResponse], error)
  • func (ca *IstioCA) SignSSH(public interface{}, id string, secret *uk8s.Secret)

Constants

const PEMBlockCertificateRequest = "CERTIFICATE REQUEST"

Functions

func GetCertIstio

func GetCertIstio(ctx context.Context, ma *meshauth.Mesh,
	dest *meshauth.Dest, ttlSec int, certSigner string) (string, []string, error)

GetCertIstio implements the basic Istio gRPC protocol as client, getting a cert for the primary key in Mesh.

The 'dest' must be configured with

• TokenSource reading the istio-ca mounted token
• K8S token source returning "istio-ca" certs (using cluster, kubeconfig or other user creds)
• An existing certificate
• A long-lived certificate

func NewCSR

func NewCSR(priv crypto.PrivateKey, san string) (csrPEM []byte, err error)

NewCSR creates a key and CSR for the specified SAN (which may be ignored by the CA and replaced with a reflexive identity). It uses the primary identity in Mesh.

Types

type IstioCA

type IstioCA struct {

	// Map of issuers to trust domains.
	IssuerToTrustDomain map[string]string

	CA *meshca.CA

	Auth  *meshauth.Mesh
	SSHCA *sshd.SSHMesh
}

IstioCA implements the Istio CA interface as a 'reflective CA'.

Will accept any valid JWT and return a cert for the same identity. Trust domain is based on the JWT issuer.

func New

func New(ctx context.Context, ma *meshauth.Mesh) *IstioCA

func (*IstioCA) CreateCertificate

func (ca *IstioCA) CreateCertificate(ctx context.Context, r *connect.Request[auth.IstioCertificateRequest]) (*connect.Response[auth.IstioCertificateResponse], error)

CreateCertificate should be chained with a verification handler. The method itself assumes Authorization has been verified.

func (*IstioCA) SignSSH

func (ca *IstioCA) SignSSH(public interface{}, id string, secret *uk8s.Secret)