controller

Documentation

Index

• Constants
• func ConstructCustomDNSNames(serviceAccounts []string, serviceNames []string, namespace string, ...) map[string]*DNSNameEntry
• func GetSecretName(saName string) string
• type DNSNameEntry
• type SecretController
  • func NewSecretController(ca ca.CertificateAuthority, requireOptIn bool, certTTL time.Duration, ...) (*SecretController, error)
  • func (sc *SecretController) Run(stopCh chan struct{})

Constants

const (
	// The Istio secret annotation type
	IstioSecretType = "istio.io/key-and-cert"

	// The ID/name for the certificate chain file.
	CertChainID = "cert-chain.pem"
	// The ID/name for the private key file.
	PrivateKeyID = "key.pem"
	// The ID/name for the CA root certificate file.
	RootCertID = "root-cert.pem"
	// The key to specify corresponding service account in the annotation of K8s secrets.
	ServiceAccountNameAnnotationKey = "istio.io/service-account.name"
)

#nosec: disable gas linter

Functions

func ConstructCustomDNSNames

func ConstructCustomDNSNames(serviceAccounts []string, serviceNames []string,
	namespace string, customDNSNames string) map[string]*DNSNameEntry

ConstructCustomDNSNames creates DNS entries for given service accounts and allows customization of the DNS names used in the certificate SAN field. By default the DNS name used in the SAN field are in the form of service.namespace and service.namespace.svc. When a custom DNS is specified, we set an additional DNS SAN for the service account. The customDNSNames string contains a list of comma separated entries, with each entry formatted as <service-account-name>:<custom-DNS-value-for-SAN>

func GetSecretName

func GetSecretName(saName string) string

GetSecretName returns the secret name for a given service account name.

Types

type DNSNameEntry

type DNSNameEntry struct {
	// ServiceName is the name of the service account to match
	ServiceName string

	// Namespace restricts to a specific namespace.
	Namespace string

	// CustomDomain allows adding a user-defined domain.
	CustomDomains []string
}

DNSNameEntry stores the service name and namespace to construct the DNS id. Service accounts matching the ServiceName and Namespace will have additional DNS SANs: ServiceName.Namespace.svc, ServiceName.Namespace and optionall CustomDomain. This is intended for control plane and trusted services.

type SecretController

type SecretController struct {
	// contains filtered or unexported fields
}

SecretController manages the service accounts' secrets that contains Istio keys and certificates.

func NewSecretController

func NewSecretController(ca ca.CertificateAuthority, requireOptIn bool, certTTL time.Duration,
	gracePeriodRatio float32, minGracePeriod time.Duration, dualUse bool,
	core corev1.CoreV1Interface, forCA bool, pkcs8Key bool, namespaces []string,
	dnsNames map[string]*DNSNameEntry) (*SecretController, error)

NewSecretController returns a pointer to a newly constructed SecretController instance.

func (*SecretController) Run

func (sc *SecretController) Run(stopCh chan struct{})

Run starts the SecretController until a value is sent to stopCh.