certs

Documentation

Index

• Constants
• Variables
• func CertOrKeyExist(pkiPath, name string) bool
• func CheckCertificatePeriodValidity(baseName string, cert *x509.Certificate)
• func CreateCACertAndKeyFiles(certSpec *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error
• func CreateCertAndKeyFilesWithCA(caCertSpec *KubekeyCert, certSpec *KubekeyCert, pkiPath string, ...) error
• func EncodeCertPEM(cert *x509.Certificate) []byte
• func GenerateCA(ca *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error
• func GenerateCerts(cert *KubekeyCert, caCert *KubekeyCert, pkiPath string, ...) error
• func GeneratePrivateKey(keyType x509.PublicKeyAlgorithm) (crypto.Signer, error)
• func HasServerAuth(cert *x509.Certificate) bool
• func LoadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate, crypto.Signer, error)
• func NewCertAndKey(caCert *x509.Certificate, caKey crypto.Signer, config *CertConfig) (*x509.Certificate, crypto.Signer, error)
• func NewCertificateAuthority(config *CertConfig) (*x509.Certificate, crypto.Signer, error)
• func NewSignedCert(cfg *CertConfig, key crypto.Signer, caCert *x509.Certificate, ...) (*x509.Certificate, error)
• func PathsForCertAndKey(pkiPath, name string) (string, string)
• func RemoveDuplicateAltNames(altNames *certutil.AltNames)
• func TryLoadCertAndKeyFromDisk(pkiPath, name string) (*x509.Certificate, crypto.Signer, error)
• func TryLoadCertChainFromDisk(pkiPath, name string) (*x509.Certificate, []*x509.Certificate, error)
• func TryLoadCertFromDisk(pkiPath, name string) (*x509.Certificate, error)
• func TryLoadKeyFromDisk(pkiPath, name string) (crypto.Signer, error)
• func ValidateCertPeriod(cert *x509.Certificate, offset time.Duration) error
• func VerifyCertChain(cert *x509.Certificate, intermediates []*x509.Certificate, ...) error
• func WriteCert(pkiPath, name string, cert *x509.Certificate) error
• func WriteCertAndKey(pkiPath string, name string, cert *x509.Certificate, key crypto.Signer) error
• func WriteKey(pkiPath, name string, key crypto.Signer) error
• type CertConfig
• type KubekeyCert
  • func (k *KubekeyCert) CreateFromCA(kubeConf *common.KubeConf, pkiPath string, caCert *x509.Certificate, ...) error
  • func (k *KubekeyCert) GetConfig(_ *common.KubeConf) (*CertConfig, error)

Constants

const (
	// CertificateValidity defines the validity for all the signed certificates generated by kubeadm
	CertificateValidity = time.Hour * 24 * 365 * 10
	// CertificateBlockType is a possible value for pem.Block.Type.
	CertificateBlockType = "CERTIFICATE"
)

Variables

var NewPrivateKey = GeneratePrivateKey

NewPrivateKey returns a new private key.

Functions

func CertOrKeyExist

func CertOrKeyExist(pkiPath, name string) bool

CertOrKeyExist returns a boolean whether the cert or the key exists

func CheckCertificatePeriodValidity

func CheckCertificatePeriodValidity(baseName string, cert *x509.Certificate)

CheckCertificatePeriodValidity takes a certificate and prints a warning if its period is not valid related to the current time. It does so only if the certificate was not validated already by keeping track with a cache.

func CreateCACertAndKeyFiles

func CreateCACertAndKeyFiles(certSpec *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error

CreateCACertAndKeyFiles generates and writes out a given certificate authority. The certSpec should be one of the variables from this package.

func CreateCertAndKeyFilesWithCA

func CreateCertAndKeyFilesWithCA(caCertSpec *KubekeyCert, certSpec *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error

CreateCertAndKeyFilesWithCA loads the given certificate authority from disk, then generates and writes out the given certificate and key. The certSpec and caCertSpec should both be one of the variables from this package.

func EncodeCertPEM

func EncodeCertPEM(cert *x509.Certificate) []byte

EncodeCertPEM returns PEM-endcoded certificate data

func GenerateCA

func GenerateCA(ca *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error

func GenerateCerts

func GenerateCerts(cert *KubekeyCert, caCert *KubekeyCert, pkiPath string, kubeConf *common.KubeConf) error

func GeneratePrivateKey

func GeneratePrivateKey(keyType x509.PublicKeyAlgorithm) (crypto.Signer, error)

func HasServerAuth

func HasServerAuth(cert *x509.Certificate) bool

HasServerAuth returns true if the given certificate is a ServerAuth

func LoadCertificateAuthority

func LoadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate, crypto.Signer, error)

LoadCertificateAuthority tries to load a CA in the given directory with the given name.

func NewCertAndKey

func NewCertAndKey(caCert *x509.Certificate, caKey crypto.Signer, config *CertConfig) (*x509.Certificate, crypto.Signer, error)

NewCertAndKey creates new certificate and key by passing the certificate authority certificate and key

func NewCertificateAuthority

func NewCertificateAuthority(config *CertConfig) (*x509.Certificate, crypto.Signer, error)

NewCertificateAuthority creates new certificate and private key for the certificate authority

func NewSignedCert

func NewSignedCert(cfg *CertConfig, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, isCA bool) (*x509.Certificate, error)

NewSignedCert creates a signed certificate using the given CA certificate and key

func PathsForCertAndKey

func PathsForCertAndKey(pkiPath, name string) (string, string)

PathsForCertAndKey returns the paths for the certificate and key given the path and basename.

func RemoveDuplicateAltNames

func RemoveDuplicateAltNames(altNames *certutil.AltNames)

RemoveDuplicateAltNames removes duplicate items in altNames.

func TryLoadCertAndKeyFromDisk

func TryLoadCertAndKeyFromDisk(pkiPath, name string) (*x509.Certificate, crypto.Signer, error)

TryLoadCertAndKeyFromDisk tries to load a cert and a key from the disk and validates that they are valid

func TryLoadCertChainFromDisk

func TryLoadCertChainFromDisk(pkiPath, name string) (*x509.Certificate, []*x509.Certificate, error)

TryLoadCertChainFromDisk tries to load the cert chain from the disk

func TryLoadCertFromDisk

func TryLoadCertFromDisk(pkiPath, name string) (*x509.Certificate, error)

TryLoadCertFromDisk tries to load the cert from the disk

func TryLoadKeyFromDisk

func TryLoadKeyFromDisk(pkiPath, name string) (crypto.Signer, error)

TryLoadKeyFromDisk tries to load the key from the disk and validates that it is valid

func ValidateCertPeriod

func ValidateCertPeriod(cert *x509.Certificate, offset time.Duration) error

ValidateCertPeriod checks if the certificate is valid relative to the current time (+/- offset)

func VerifyCertChain

func VerifyCertChain(cert *x509.Certificate, intermediates []*x509.Certificate, root *x509.Certificate) error

VerifyCertChain verifies that a certificate has a valid chain of intermediate CAs back to the root CA

func WriteCert

func WriteCert(pkiPath, name string, cert *x509.Certificate) error

WriteCert stores the given certificate at the given location

func WriteCertAndKey

func WriteCertAndKey(pkiPath string, name string, cert *x509.Certificate, key crypto.Signer) error

WriteCertAndKey stores certificate and key at the specified location

func WriteKey

func WriteKey(pkiPath, name string, key crypto.Signer) error

WriteKey stores the given key at the given location

Types

type CertConfig

type CertConfig struct {
	certutil.Config
	NotAfter           *time.Time
	PublicKeyAlgorithm x509.PublicKeyAlgorithm
}

CertConfig is a wrapper around certutil.Config extending it with PublicKeyAlgorithm.

type KubekeyCert

type KubekeyCert struct {
	Name     string
	LongName string
	BaseName string
	CAName   string
	Config   CertConfig
}

KubekeyCert represents a certificate that Kubeadm will create to function properly.

func (*KubekeyCert) CreateFromCA

func (k *KubekeyCert) CreateFromCA(kubeConf *common.KubeConf, pkiPath string, caCert *x509.Certificate, caKey crypto.Signer) error

CreateFromCA makes and writes a certificate using the given CA cert and key.

func (*KubekeyCert) GetConfig

func (k *KubekeyCert) GetConfig(_ *common.KubeConf) (*CertConfig, error)

GetConfig returns the definition for the given cert given the provided InitConfiguration