rotation

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 14, 2022 License: MPL-2.0 Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func RotateNodeCredentials

RotateNodeCredentials accepts a request containing an encrypted fetch node credentials request and expects to be able to decrypt it via the key ID from the contained value. If valid, the credentials contained in the request will be registered to the system as valid credentials.

Note that unlike RotateRootCertificates, where ownership of the roots belongs to this library, this is not a method that does nothing if it is not time to rotate. The node owns its credentials and should track when it's time to rotate and initiate rotation at that time.

Although WithState is not explicitly supported, keep in mind that State will be transferred to the new NodeInformation. This fact can be used to match the new credentials to an external ID corresponding to the current credentials.

Supported options: WithWrapper/WithRandomReader/WithNotBeforeClockSkew/WithNotAfterClockSkew (passed through to AuthorizeNode and others)

func RotateRootCertificates

func RotateRootCertificates(ctx context.Context, storage nodeenrollment.Storage, opt ...nodeenrollment.Option) (*types.RootCertificates, error)

RotateRootCertificates generates roots: private keys and self-signed CA root certificates. At the end of this function, there should always be two certificates in existence. How we get there depends on the current state; see the switch statement below.

If things seem off in a way that this function should not allow to occur (for instance, one root is missing, or timing is weird), err on the side of failing secure and redo the roots.

It is safe to call this periodically; if the current root is still valid and no issues are detected with next, nothing will change.

Supported options: WithRandomReader, WithCertificateLifetime, WithWrapper (passed through to LoadRootCertificates and RootCertificates.Store), WithSkipStorage, WithNotBeforeClockSkew

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL