tls

Documentation

Index

• Constants
• Variables
• func CertificateToPem(certificateDER []byte) []byte
• func GenerateCACert(certValidityDuration time.Duration) (*KeyPair, *PemPair, error)
• func GeneratePrivateKey() (*rsa.PrivateKey, error)
• func IsKyvernoInRollingUpdate(deploy map[string]interface{}, logger logr.Logger) bool
• func IsTLSPairShouldBeUpdated(tlsPair *PemPair) bool
• func PrivateKeyToPem(rsaKey *rsa.PrivateKey) []byte
• func ReadRootCASecret(restConfig *rest.Config, client *client.Client) (result []byte, err error)
• type CertRenewer
  • func NewCertRenewer(client *client.Client, clientConfig *rest.Config, ...) *CertRenewer
  • func (c *CertRenewer) Client() *client.Client
  • func (c *CertRenewer) ClientConfig() *rest.Config
  • func (c *CertRenewer) InitTLSPemPair() (*PemPair, error)
  • func (c *CertRenewer) RollingUpdate() error
  • func (c *CertRenewer) ValidCert() (bool, error)
  • func (c *CertRenewer) WriteCACertToSecret(caPEM *PemPair, props CertificateProps) error
  • func (c *CertRenewer) WriteTLSPairToSecret(props CertificateProps, pemPair *PemPair) error
• type CertificateProps
  • func GetTLSCertProps(configuration *rest.Config) (certProps CertificateProps, err error)
• type KeyPair
• type PemPair
  • func GenerateCertPem(caCert *KeyPair, props CertificateProps, serverIP string, ...) (*PemPair, error)
  • func ReadTLSPair(restConfig *rest.Config, client *client.Client) (*PemPair, error)

Constants

const (
	// ManagedByLabel is added to Kyverno managed secrets
	ManagedByLabel string = "cert.kyverno.io/managed-by"

	SelfSignedAnnotation string = "self-signed-cert"
	RootCAKey            string = "rootCA.crt"
)

const CertRenewalInterval time.Duration = 12 * time.Hour

CertRenewalInterval is the renewal interval for rootCA

const CertValidityDuration time.Duration = 365 * 24 * time.Hour

CertValidityDuration is the valid duration for a new cert

Variables

var ErrorsNotFound = "root CA certificate not found"

Functions

func CertificateToPem

func CertificateToPem(certificateDER []byte) []byte

CertificateToPem ...

func GenerateCACert

func GenerateCACert(certValidityDuration time.Duration) (*KeyPair, *PemPair, error)

GenerateCACert creates the self-signed CA cert and private key it will be used to sign the webhook server certificate

func GeneratePrivateKey

func GeneratePrivateKey() (*rsa.PrivateKey, error)

GeneratePrivateKey Generates RSA private key

func IsKyvernoInRollingUpdate

func IsKyvernoInRollingUpdate(deploy map[string]interface{}, logger logr.Logger) bool

IsKyvernoInRollingUpdate returns true if Kyverno is in rolling update

func IsTLSPairShouldBeUpdated

func IsTLSPairShouldBeUpdated(tlsPair *PemPair) bool

IsTLSPairShouldBeUpdated checks if TLS pair has expited and needs to be updated

func PrivateKeyToPem

func PrivateKeyToPem(rsaKey *rsa.PrivateKey) []byte

PrivateKeyToPem Creates PEM block from private key object

func ReadRootCASecret

func ReadRootCASecret(restConfig *rest.Config, client *client.Client) (result []byte, err error)

ReadRootCASecret returns the RootCA from the pre-defined secret

Types

type CertRenewer

type CertRenewer struct {
	// contains filtered or unexported fields
}

CertRenewer creates rootCA and pem pair to register webhook configurations and webhook server renews RootCA at the given interval

func NewCertRenewer

func NewCertRenewer(client *client.Client, clientConfig *rest.Config, certRenewalInterval, certValidityDuration time.Duration, serverIP string, log logr.Logger) *CertRenewer

NewCertRenewer returns an instance of CertRenewer

func (*CertRenewer) Client

func (c *CertRenewer) Client() *client.Client

func (*CertRenewer) ClientConfig

func (c *CertRenewer) ClientConfig() *rest.Config

func (*CertRenewer) InitTLSPemPair

func (c *CertRenewer) InitTLSPemPair() (*PemPair, error)

InitTLSPemPair Loads or creates PEM private key and TLS certificate for webhook server. Created pair is stored in cluster's secret. Returns struct with key/certificate pair.

func (*CertRenewer) RollingUpdate

func (c *CertRenewer) RollingUpdate() error

RollingUpdate triggers a rolling update of Kyverno pod. It is used when the rootCA is renewed, the restart of Kyverno pod will register webhook server with new cert

func (*CertRenewer) ValidCert

func (c *CertRenewer) ValidCert() (bool, error)

ValidCert validates the CA Cert

func (*CertRenewer) WriteCACertToSecret

func (c *CertRenewer) WriteCACertToSecret(caPEM *PemPair, props CertificateProps) error

WriteCACertToSecret stores the CA cert in secret

func (*CertRenewer) WriteTLSPairToSecret

func (c *CertRenewer) WriteTLSPairToSecret(props CertificateProps, pemPair *PemPair) error

WriteTLSPairToSecret Writes the pair of TLS certificate and key to the specified secret. Updates existing secret or creates new one.

type CertificateProps

type CertificateProps struct {
	Service       string
	Namespace     string
	APIServerHost string
	ServerIP      string
}

CertificateProps Properties of TLS certificate which should be issued for webhook server

func GetTLSCertProps

func GetTLSCertProps(configuration *rest.Config) (certProps CertificateProps, err error)

GetTLSCertProps provides the TLS Certificate Properties

type KeyPair

type KeyPair struct {
	Cert *x509.Certificate
	Key  *rsa.PrivateKey
}

KeyPair ...

type PemPair

type PemPair struct {
	Certificate []byte
	PrivateKey  []byte
}

PemPair The pair of TLS certificate corresponding private key, both in PEM format

func GenerateCertPem

func GenerateCertPem(caCert *KeyPair, props CertificateProps, serverIP string, certValidityDuration time.Duration) (*PemPair, error)

GenerateCertPem takes the results of GenerateCACert and uses it to create the PEM-encoded public certificate and private key, respectively

func ReadTLSPair

func ReadTLSPair(restConfig *rest.Config, client *client.Client) (*PemPair, error)

ReadTLSPair returns the pem pair from the pre-defined secret