security

Documentation

Index

• Constants
• func CertPool(certPem []byte) (*x509.CertPool, error)
• func ExcludedRoute(route string) bool
• func GetAPIToken() string
• func GetCertChain() (*credentials.CertChain, error)
• type Authenticator
  • func GetSidecarAuthenticator(sentryAddress string, certChain *credentials.CertChain) (Authenticator, error)
• type SignedCertificate

Constants

const (
	// APITokenEnvVar is the environment variable for the api token
	APITokenEnvVar = "DAPR_API_TOKEN"
	// APITokenHeader is header name for http/gRPC calls to hold the token
	APITokenHeader = "dapr-api-token"
)

#nosec

const (
	TLSServerName = "cluster.local"
)

Functions

func CertPool

func CertPool(certPem []byte) (*x509.CertPool, error)

func ExcludedRoute

func ExcludedRoute(route string) bool

ExcludedRoute returns whether a given route should be excluded from a token check

func GetAPIToken

func GetAPIToken() string

GetAPIToken returns the value of the api token from an environment variable

func GetCertChain

func GetCertChain() (*credentials.CertChain, error)

Types

type Authenticator

type Authenticator interface {
	GetTrustAnchors() *x509.CertPool
	GetCurrentSignedCert() *SignedCertificate
	CreateSignedWorkloadCert(id, namespace, trustDomain string) (*SignedCertificate, error)
}

func GetSidecarAuthenticator

func GetSidecarAuthenticator(sentryAddress string, certChain *credentials.CertChain) (Authenticator, error)

GetSidecarAuthenticator returns a new authenticator with the extracted trust anchors

type SignedCertificate

type SignedCertificate struct {
	WorkloadCert  []byte
	PrivateKeyPem []byte
	Expiry        time.Time
	TrustChain    *x509.CertPool
}