authentication

Documentation

Index

• Variables
• type CertInfo
  • func BuildWebhookCertInfoWithCSR(client api.MingleClient, svcOpts *selfsigned.CertOptions) (*CertInfo, error)
  • func BuildWebhookCertInfoWithSelf(rootOpts, svcOpts *selfsigned.CertOptions, expireTime time.Duration) (*CertInfo, error)
  • func (ci *CertInfo) SaveTLSToPath(path string) error
  • func (ci *CertInfo) UpdateCABundleToMutatingWebhook(client api.MingleClient, mutatingName, svcName, svcNamespace string) error
• type SignedWay

Variables

var (
	SelfSigned SignedWay = "SelfSigned"
	CSRSigned  SignedWay = "CSRSigned"

	CSRBaseOrganization = "system:nodes"
	CSRCommonNamePrefix = "system:node:"
)

Types

type CertInfo

type CertInfo struct {
	// client verify Certificate
	CABundle []byte

	// server load
	TLSKey  []byte
	TLSCert []byte
}

func BuildWebhookCertInfoWithCSR

func BuildWebhookCertInfoWithCSR(client api.MingleClient, svcOpts *selfsigned.CertOptions) (*CertInfo, error)

BuildWebhookCertInfoWithCSR build Cert with CertificateSigningRequests

1. completedSVCOption: completed svcOpts with Organization and CommonName Organization: must have "system:nodes" CommonName: must start with "system:node:", default is "system:node:symcn-webhook"
2. submitCSR
3. approveCSR
4. readSignedCertificate

This way may use those rules:

• apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests"] verbs: ["create", "get", "watch"]
• apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests/approval"] verbs: ["update"]
• apiGroups: ["certificates.k8s.io"] resources: ["signers"] resourceNames: ["kubernetes.io/kubelet-serving"] verbs: ["approve"]

func BuildWebhookCertInfoWithSelf

func BuildWebhookCertInfoWithSelf(rootOpts, svcOpts *selfsigned.CertOptions, expireTime time.Duration) (*CertInfo, error)

func (*CertInfo) SaveTLSToPath

func (ci *CertInfo) SaveTLSToPath(path string) error

SaveTLSToDir save TLSKey and TLSCert to path filename is tls.key and tls.crt

func (*CertInfo) UpdateCABundleToMutatingWebhook

func (ci *CertInfo) UpdateCABundleToMutatingWebhook(client api.MingleClient, mutatingName, svcName, svcNamespace string) error

UpdateCABundleToMutatingWebhook update CABundle to MutatingWebhookConfigurations use this way need those rules:

• apiGroups: ["admissionregistration.k8s.io"] resources: ["mutatingwebhookconfigurations"] verbs: ["get", "update"]

type SignedWay

type SignedWay string