sslutils

Documentation

Index

• Constants
• Variables
• func ApplyCipherSuites(ctx context.Context, in string, out *ssl.SslConfig) error
• func ApplyMaximumTlsVersion(ctx context.Context, in string, out *ssl.SslConfig) error
• func ApplyMinimumTlsVersion(ctx context.Context, in string, out *ssl.SslConfig) error
• func ApplyOneWayTls(ctx context.Context, in string, out *ssl.SslConfig) error
• func ApplySslExtensionOptions(ctx context.Context, in *gwv1.GatewayTLSConfig, out *ssl.SslConfig)
• func ApplyVerifySubjectAltName(ctx context.Context, in string, out *ssl.SslConfig) error
• func ValidateTlsSecret(sslSecret *corev1.Secret) (cleanedCertChain string, err error)
• type SslExtensionOptionFunc

Constants

const (
	GatewaySslOptionsPrefix = wellknown.GatewayAnnotationPrefix + "/ssl"

	GatewaySslCipherSuites         = GatewaySslOptionsPrefix + "/cipher-suites"
	GatewaySslMinimumTlsVersion    = GatewaySslOptionsPrefix + "/minimum-tls-version"
	GatewaySslMaximumTlsVersion    = GatewaySslOptionsPrefix + "/maximum-tls-version"
	GatewaySslOneWayTls            = GatewaySslOptionsPrefix + "/one-way-tls"
	GatewaySslVerifySubjectAltName = GatewaySslOptionsPrefix + "/verify-subject-alt-name"
)

Gateway API has an extension point for implementation specific tls settings, they can be found [here](https://gateway-api.sigs.k8s.io/guides/tls/#extensions)

Variables

var (
	InvalidTlsSecretError = func(secret *corev1.Secret, err error) error {
		errorString := fmt.Sprintf("%v.%v is not a valid TLS secret", secret.Namespace, secret.Name)
		return eris.Wrapf(err, errorString)
	}

	NoCertificateFoundError = eris.New("no certificate information found")
)

var SslExtensionOptionFuncs = map[string]SslExtensionOptionFunc{
	GatewaySslCipherSuites:         ApplyCipherSuites,
	GatewaySslMinimumTlsVersion:    ApplyMinimumTlsVersion,
	GatewaySslMaximumTlsVersion:    ApplyMaximumTlsVersion,
	GatewaySslOneWayTls:            ApplyOneWayTls,
	GatewaySslVerifySubjectAltName: ApplyVerifySubjectAltName,
}

Functions

func ApplyCipherSuites

func ApplyCipherSuites(ctx context.Context, in string, out *ssl.SslConfig) error

func ApplyMaximumTlsVersion

func ApplyMaximumTlsVersion(ctx context.Context, in string, out *ssl.SslConfig) error

func ApplyMinimumTlsVersion

func ApplyMinimumTlsVersion(ctx context.Context, in string, out *ssl.SslConfig) error

func ApplyOneWayTls

func ApplyOneWayTls(ctx context.Context, in string, out *ssl.SslConfig) error

func ApplySslExtensionOptions

func ApplySslExtensionOptions(ctx context.Context, in *gwv1.GatewayTLSConfig, out *ssl.SslConfig)

ApplySslExtensionOptions applies the GatewayTLSConfig options to the SslConfig This function will never exit early, even if an error is encountered. It will apply all options and log all errors encountered.

func ApplyVerifySubjectAltName

func ApplyVerifySubjectAltName(ctx context.Context, in string, out *ssl.SslConfig) error

func ValidateTlsSecret

func ValidateTlsSecret(sslSecret *corev1.Secret) (cleanedCertChain string, err error)

ValidateTlsSecret and return a cleaned cert

Types

type SslExtensionOptionFunc

type SslExtensionOptionFunc = func(ctx context.Context, in string, out *ssl.SslConfig) error