Documentation ¶
Index ¶
- func MaxSVIDTTL() time.Duration
- func MaxSVIDTTLForCATTL(caTTL time.Duration) time.Duration
- func MinCATTLForSVIDTTL(svidTTL time.Duration) time.Duration
- type AuthorityManager
- type Config
- type Journal
- func (j *Journal) AppendJWTKey(ctx context.Context, slotID string, issuedAt time.Time, jwtKey *ca.JWTKey) error
- func (j *Journal) AppendX509CA(ctx context.Context, slotID string, issuedAt time.Time, x509CA *ca.X509CA) error
- func (j *Journal) UpdateJWTKeyStatus(ctx context.Context, authorityID string, status journal.Status) error
- func (j *Journal) UpdateX509CAStatus(ctx context.Context, authorityID string, status journal.Status) error
- type JwtKeyPublisher
- type ManagedCA
- type Manager
- func (m *Manager) ActivateJWTKey(ctx context.Context)
- func (m *Manager) ActivateX509CA(ctx context.Context)
- func (m *Manager) Close()
- func (m *Manager) GetCurrentJWTKeySlot() Slot
- func (m *Manager) GetCurrentX509CASlot() Slot
- func (m *Manager) GetNextJWTKeySlot() Slot
- func (m *Manager) GetNextX509CASlot() Slot
- func (m *Manager) IsUpstreamAuthority() bool
- func (m *Manager) NotifyBundleLoaded(ctx context.Context) error
- func (m *Manager) NotifyTaintedX509Authority(ctx context.Context, authorityID string) error
- func (m *Manager) PrepareJWTKey(ctx context.Context) (err error)
- func (m *Manager) PrepareX509CA(ctx context.Context) (err error)
- func (m *Manager) ProcessBundleUpdates(ctx context.Context)
- func (m *Manager) PruneBundle(ctx context.Context) (err error)
- func (m *Manager) PruneCAJournals(ctx context.Context) (err error)
- func (m *Manager) PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error)
- func (m *Manager) RotateJWTKey(ctx context.Context)
- func (m *Manager) RotateX509CA(ctx context.Context)
- type Slot
- type SlotLoader
- type SlotPosition
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MaxSVIDTTL ¶
MaxSVIDTTL returns the maximum SVID lifetime that can be guaranteed to not be cut artificially short by a scheduled rotation.
func MaxSVIDTTLForCATTL ¶
MaxSVIDTTLForCATTL returns the maximum SVID TTL that can be guaranteed given a specific CA TTL. In other words, given a CA TTL, what is the largest SVID TTL that is guaranteed to not be cut artificially short by a scheduled rotation?
func MinCATTLForSVIDTTL ¶
MinCATTLForSVIDTTL returns the minimum CA TTL necessary to guarantee an SVID TTL of the provided value. In other words, given an SVID TTL, what is the minimum CA TTL that will guarantee that the SVIDs lifetime won't be cut artificially short by a scheduled rotation?
Types ¶
type AuthorityManager ¶ added in v1.10.2
type AuthorityManager interface { GetCurrentJWTKeySlot() Slot GetNextJWTKeySlot() Slot PrepareJWTKey(ctx context.Context) error RotateJWTKey(ctx context.Context) GetCurrentX509CASlot() Slot GetNextX509CASlot() Slot PrepareX509CA(ctx context.Context) error RotateX509CA(ctx context.Context) IsUpstreamAuthority() bool PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error) NotifyTaintedX509Authority(ctx context.Context, authorityID string) error }
type Config ¶
type Config struct { CredBuilder *credtemplate.Builder CredValidator *credvalidator.Validator CA ManagedCA Catalog catalog.Catalog TrustDomain spiffeid.TrustDomain X509CAKeyType keymanager.KeyType JWTKeyType keymanager.KeyType Dir string Log logrus.FieldLogger Metrics telemetry.Metrics Clock clock.Clock }
type Journal ¶
type Journal struct {
// contains filtered or unexported fields
}
Journal stores X509 CAs and JWT keys on disk as they are rotated by the manager. The data format is a PEM encoded protocol buffer.
func (*Journal) AppendJWTKey ¶
func (*Journal) AppendX509CA ¶
type JwtKeyPublisher ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
func (*Manager) ActivateJWTKey ¶
func (*Manager) ActivateX509CA ¶
func (*Manager) GetCurrentJWTKeySlot ¶
func (*Manager) GetCurrentX509CASlot ¶
func (*Manager) GetNextJWTKeySlot ¶
func (*Manager) GetNextX509CASlot ¶
func (*Manager) IsUpstreamAuthority ¶ added in v1.10.2
func (*Manager) NotifyBundleLoaded ¶
func (*Manager) NotifyTaintedX509Authority ¶ added in v1.11.0
func (*Manager) ProcessBundleUpdates ¶ added in v1.11.0
ProcessBundleUpdates Notify any bundle update, or process tainted authorities
func (*Manager) PruneCAJournals ¶ added in v1.9.0
func (*Manager) PublishJWTKey ¶
func (m *Manager) PublishJWTKey(ctx context.Context, jwtKey *common.PublicKey) ([]*common.PublicKey, error)
PublishJWTKey publishes the passed JWK to the upstream server using the configured UpstreamAuthority plugin, then appends to the bundle the JWKs returned by the upstream server, and finally it returns the updated list of JWT keys contained in the bundle.
The following cases may arise when calling this function:
- The UpstreamAuthority plugin doesn't implement PublishJWTKey, in which case we receive an Unimplemented error from the upstream server, and hence we log a one time warning about this, append the passed JWK to the bundle, and return the updated list of JWT keys.
- The UpstreamAuthority plugin returned an error, then we return the error.
- There is no UpstreamAuthority plugin configured, then assumes we are the root server and just appends the passed JWK to the bundle and returns the updated list of JWT keys.
func (*Manager) RotateJWTKey ¶
func (*Manager) RotateX509CA ¶
type Slot ¶
type Slot interface { KmKeyID() string IsEmpty() bool Reset() ShouldPrepareNext(now time.Time) bool ShouldActivateNext(now time.Time) bool Status() journal.Status UpstreamAuthorityID() string AuthorityID() string // TODO: This will be removed as part of #5390 PublicKey() crypto.PublicKey NotAfter() time.Time }
type SlotLoader ¶
type SlotLoader struct { TrustDomain spiffeid.TrustDomain Log logrus.FieldLogger Dir string Catalog catalog.Catalog UpstreamClient *ca.UpstreamClient }
type SlotPosition ¶
type SlotPosition int
const ( CurrentX509CASlot SlotPosition = iota NextX509CASlot CurrentJWTKeySlot NextJWTKeySlot )