crypto

Documentation

Index

• func IPAddressesDNSNames(hosts []string) ([]net.IP, []string)
• func NewKeyPair() (crypto.PublicKey, crypto.PrivateKey, error)
• type CA
  • func InitCA(dir string, name string) (*CA, error)
  • func (ca *CA) MakeClientConfig(clientId string, u user.Info, baseKubeconfig clientcmdapi.Config) (kclient.Config, error)
  • func (ca *CA) MakeServerCert(name string, hostnames []string) (*TLSCertificateConfig, error)
• type TLSCertificateConfig

Functions

func IPAddressesDNSNames

func IPAddressesDNSNames(hosts []string) ([]net.IP, []string)

func NewKeyPair

func NewKeyPair() (crypto.PublicKey, crypto.PrivateKey, error)

Types

type CA

type CA struct {
	Dir        string
	SerialFile string
	Serial     int64
	Config     *TLSCertificateConfig
}

func InitCA

func InitCA(dir string, name string) (*CA, error)

InitCA ensures a certificate authority structure exists in the given directory, creating it if necessary:

<dir>/
  ca/
root.crt	- Root certificate bundle.
cert.crt	- Signing certificate
key.key	 - Private key
serial.txt  - Stores the highest serial number generated by this CA

func (*CA) MakeClientConfig

func (ca *CA) MakeClientConfig(clientId string, u user.Info, baseKubeconfig clientcmdapi.Config) (kclient.Config, error)

MakeClientConfig creates a folder containing certificates for the given client:

<CA.dir>/
  <clientId>/
    root.crt - Root certificate bundle.
    cert.crt - Client certificate
    key.key  - Private key
    .kubeconfig - baseKubeconfig with root.crt added to all clusters, and client user added to all contexts

The generated certificate has the following attributes:

Subject:
  SerialNumber: user.GetUID()
  CommonName:   user.GetName()
  Organization: user.GetGroups()
ExtKeyUsage: ExtKeyUsageClientAuth

func (*CA) MakeServerCert

func (ca *CA) MakeServerCert(name string, hostnames []string) (*TLSCertificateConfig, error)

MakeServerCert creates a folder containing certificates for the given server:

<CA.dir>/
 <name>/
root.crt	- Root certificate bundle.
cert.crt	- Server certificate
key.key	 - Private key

The generated certificate has the following attributes:

CommonName: hostnames[0]
DNSNames subjectAltNames containing all specified hostnames
IPAddresses subjectAltNames containing all specified hostnames which are IP addresses
ExtKeyUsage: ExtKeyUsageServerAuth

type TLSCertificateConfig

type TLSCertificateConfig struct {
	CAFile   string
	CertFile string
	KeyFile  string

	Roots []*x509.Certificate
	Certs []*x509.Certificate
	Key   crypto.PrivateKey
}