manager

package
v1.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 23, 2024 License: Apache-2.0 Imports: 33 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func MaxSVIDTTL 

func MaxSVIDTTL() time.Duration

MaxSVIDTTL returns the maximum SVID lifetime that can be guaranteed to not be cut artificially short by a scheduled rotation.

func MaxSVIDTTLForCATTL 

func MaxSVIDTTLForCATTL(caTTL time.Duration) time.Duration

MaxSVIDTTLForCATTL returns the maximum SVID TTL that can be guaranteed given a specific CA TTL. In other words, given a CA TTL, what is the largest SVID TTL that is guaranteed to not be cut artificially short by a scheduled rotation?

func MinCATTLForSVIDTTL 

func MinCATTLForSVIDTTL(svidTTL time.Duration) time.Duration

MinCATTLForSVIDTTL returns the minimum CA TTL necessary to guarantee an SVID TTL of the provided value. In other words, given an SVID TTL, what is the minimum CA TTL that will guarantee that the SVIDs lifetime won't be cut artificially short by a scheduled rotation?

Types

type AuthorityManager added in v1.10.2 

type AuthorityManager interface {
	GetCurrentJWTKeySlot() Slot
	GetNextJWTKeySlot() Slot
	PrepareJWTKey(ctx context.Context) error
	RotateJWTKey(ctx context.Context)
	GetCurrentX509CASlot() Slot
	GetNextX509CASlot() Slot
	PrepareX509CA(ctx context.Context) error
	RotateX509CA(ctx context.Context)
	IsUpstreamAuthority() bool
	PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error)
	NotifyTaintedX509Authority(ctx context.Context, authorityID string) error
}

type Config 

type Config struct {
	CredBuilder   *credtemplate.Builder
	CredValidator *credvalidator.Validator
	CA            ManagedCA
	Catalog       catalog.Catalog
	TrustDomain   spiffeid.TrustDomain
	X509CAKeyType keymanager.KeyType
	JWTKeyType    keymanager.KeyType
	Dir           string
	Log           logrus.FieldLogger
	Metrics       telemetry.Metrics
	Clock         clock.Clock
}

type Journal 

type Journal struct {
	// contains filtered or unexported fields
}

Journal stores X509 CAs and JWT keys on disk as they are rotated by the manager. The data format on disk is a PEM encoded protocol buffer.

func LoadJournal 

func LoadJournal(ctx context.Context, config *journalConfig) (*Journal, error)

func (*Journal) AppendJWTKey 

func (j *Journal) AppendJWTKey(ctx context.Context, slotID string, issuedAt time.Time, jwtKey *ca.JWTKey) error

func (*Journal) AppendX509CA 

func (j *Journal) AppendX509CA(ctx context.Context, slotID string, issuedAt time.Time, x509CA *ca.X509CA) error

func (*Journal) UpdateJWTKeyStatus added in v1.7.1 

func (j *Journal) UpdateJWTKeyStatus(ctx context.Context, issuedAt time.Time, status journal.Status) error

UpdateJWTKeyStatus updates a stored JWTKey entry to have the given status, updating the journal file.

func (*Journal) UpdateX509CAStatus added in v1.7.1 

func (j *Journal) UpdateX509CAStatus(ctx context.Context, issuedAt time.Time, status journal.Status) error

UpdateX509CAStatus updates a stored X509CA entry to have the given status, updating the journal file.

type JwtKeyPublisher 

type JwtKeyPublisher interface {
	PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error)
}

type ManagedCA 

type ManagedCA interface {
	SetX509CA(*ca.X509CA)
	SetJWTKey(*ca.JWTKey)
	NotifyTaintedX509Authorities([]*x509.Certificate)
}

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager 

func NewManager(ctx context.Context, c Config) (*Manager, error)

func (*Manager) ActivateJWTKey 

func (m *Manager) ActivateJWTKey(ctx context.Context)

func (*Manager) ActivateX509CA 

func (m *Manager) ActivateX509CA(ctx context.Context)

func (*Manager) Close 

func (m *Manager) Close()

func (*Manager) GetCurrentJWTKeySlot 

func (m *Manager) GetCurrentJWTKeySlot() Slot

func (*Manager) GetCurrentX509CASlot 

func (m *Manager) GetCurrentX509CASlot() Slot

func (*Manager) GetNextJWTKeySlot 

func (m *Manager) GetNextJWTKeySlot() Slot

func (*Manager) GetNextX509CASlot 

func (m *Manager) GetNextX509CASlot() Slot

func (*Manager) IsUpstreamAuthority added in v1.10.2 

func (m *Manager) IsUpstreamAuthority() bool

func (*Manager) NotifyBundleLoaded 

func (m *Manager) NotifyBundleLoaded(ctx context.Context) error

func (*Manager) NotifyTaintedX509Authority added in v1.11.0 

func (m *Manager) NotifyTaintedX509Authority(ctx context.Context, authorityID string) error

func (*Manager) PrepareJWTKey 

func (m *Manager) PrepareJWTKey(ctx context.Context) (err error)

func (*Manager) PrepareX509CA 

func (m *Manager) PrepareX509CA(ctx context.Context) (err error)

func (*Manager) ProcessBundleUpdates added in v1.11.0 

func (m *Manager) ProcessBundleUpdates(ctx context.Context)

ProcessBundleUpdates Notify any bundle update, or process tainted authorities

func (*Manager) PruneBundle 

func (m *Manager) PruneBundle(ctx context.Context) (err error)

func (*Manager) PruneCAJournals added in v1.9.0 

func (m *Manager) PruneCAJournals(ctx context.Context) (err error)

func (*Manager) PublishJWTKey 

func (m *Manager) PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error)

PublishJWTKey publishes the passed JWK to the upstream server using the configured UpstreamAuthority plugin, then appends to the bundle the JWKs returned by the upstream server, and finally it returns the updated list of JWT keys contained in the bundle.

The following cases may arise when calling this function:

- The UpstreamAuthority plugin doesn't implement PublishJWTKey, in which case we receive an Unimplemented error from the upstream server, and hence we log a one time warning about this, append the passed JWK to the bundle, and return the updated list of JWT keys.

- The UpstreamAuthority plugin returned an error, then we return the error.

- There is no UpstreamAuthority plugin configured, then assumes we are the root server and just appends the passed JWK to the bundle and returns the updated list of JWT keys.

func (*Manager) RotateJWTKey 

func (m *Manager) RotateJWTKey(ctx context.Context)

func (*Manager) RotateX509CA 

func (m *Manager) RotateX509CA(ctx context.Context)

type Slot 

type Slot interface {
	KmKeyID() string
	IsEmpty() bool
	Reset()
	ShouldPrepareNext(now time.Time) bool
	ShouldActivateNext(now time.Time) bool
	Status() journal.Status
	UpstreamAuthorityID() string
	AuthorityID() string
	// TODO: This will be removed as part of #5390
	PublicKey() crypto.PublicKey
	NotAfter() time.Time
}

type SlotLoader 

type SlotLoader struct {
	TrustDomain spiffeid.TrustDomain

	Log            logrus.FieldLogger
	Dir            string
	Catalog        catalog.Catalog
	UpstreamClient *ca.UpstreamClient
}

type SlotPosition 

type SlotPosition int
const (
	CurrentX509CASlot SlotPosition = iota
	NextX509CASlot
	CurrentJWTKeySlot
	NextJWTKeySlot
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.