certificatemanagement

Documentation

Index

• Constants
• Variables
• func CSRClusterRole() client.Object
• func CSRClusterRoleBinding(name, namespace string) *rbacv1.ClusterRoleBinding
• func CertificateVolumeSource(certificateManagement *operatorv1.CertificateManagement, secretName string) corev1.VolumeSource
• func CreateCSRInitContainer(certificateManagement *operatorv1.CertificateManagement, image string, ...) corev1.Container
• func ParseCertificate(certBytes []byte) (*x509.Certificate, error)
• func ResolveCSRInitImage(inst *operatorv1.InstallationSpec, is *operatorv1.ImageSet) (string, error)
• type CertificateInterface
  • func NewCertificate(name string, pem []byte, issuer CertificateInterface) CertificateInterface
• type KeyPair
  • func (k *KeyPair) BYO() bool
  • func (k *KeyPair) GetCertificatePEM() []byte
  • func (k *KeyPair) GetIssuer() CertificateInterface
  • func (k *KeyPair) GetName() string
  • func (k *KeyPair) HashAnnotationKey() string
  • func (k *KeyPair) HashAnnotationValue() string
  • func (k *KeyPair) InitContainer(namespace string) corev1.Container
  • func (k *KeyPair) Secret(namespace string) *corev1.Secret
  • func (k *KeyPair) UseCertificateManagement() bool
  • func (k *KeyPair) Volume() corev1.Volume
  • func (k *KeyPair) VolumeMount() corev1.VolumeMount
  • func (k *KeyPair) VolumeMountCertificateFilePath() string
  • func (k *KeyPair) VolumeMountKeyFilePath() string
• type KeyPairInterface
  • func NewKeyPair(secret *corev1.Secret, dnsNames []string, clusterDomain string) (KeyPairInterface, error)
• type TrustedBundle
  • func CreateTrustedBundle(certificates ...CertificateInterface) TrustedBundle

Constants

const (
	CSRClusterRoleName = "tigera-csr-creator"
	CSRCMountPath      = "/certs-share"
)

const (
	CASecretName                = "tigera-ca-private"
	TrustedCertConfigMapName    = "tigera-ca-bundle"
	TrustedCertConfigMapKeyName = "tigera-ca-bundle.crt"
	TrustedCertVolumeMountPath  = "/etc/pki/tls/certs/"
	TrustedCertBundleMountPath  = "/etc/pki/tls/certs/tigera-ca-bundle.crt"
)

Variables

var (
	ErrInvalidCertNoPEMData = errors.New("cert has no PEM data")
)

Functions

func CSRClusterRole

func CSRClusterRole() client.Object

CSRClusterRole returns a role with the necessary permissions to create certificate signing requests.

func CSRClusterRoleBinding

func CSRClusterRoleBinding(name, namespace string) *rbacv1.ClusterRoleBinding

CSRClusterRoleBinding returns a role binding with the necessary permissions to create certificate signing requests.

func CertificateVolumeSource

func CertificateVolumeSource(certificateManagement *operatorv1.CertificateManagement, secretName string) corev1.VolumeSource

func CreateCSRInitContainer

func CreateCSRInitContainer(
	certificateManagement *operatorv1.CertificateManagement,
	image string,
	mountName string,
	commonName string,
	keyName string,
	certName string,
	dnsNames []string,
	appNameLabel string) corev1.Container

CreateCSRInitContainer creates an init container that can be added to a pod spec in order to create a CSR for its TLS certificates. It uses the provided params and the k8s downward api to be able to specify certificate subject information.

func ParseCertificate

func ParseCertificate(certBytes []byte) (*x509.Certificate, error)

func ResolveCSRInitImage

func ResolveCSRInitImage(inst *operatorv1.InstallationSpec, is *operatorv1.ImageSet) (string, error)

ResolveCsrInitImage resolves the image needed for the CSR init image taking into account the specified ImageSet

Types

type CertificateInterface

type CertificateInterface interface {
	GetIssuer() CertificateInterface
	GetCertificatePEM() []byte
	GetName() string
}

Certificate wraps the certificate. Combine this with a TrustedBundle, to mount a trusted certificate bundle to a pod.

func NewCertificate

func NewCertificate(name string, pem []byte, issuer CertificateInterface) CertificateInterface

NewCertificate creates a new certificate.

type KeyPair

type KeyPair struct {
	CSRImage       string
	Name           string
	PrivateKeyPEM  []byte
	CertificatePEM []byte
	ClusterDomain  string
	*operatorv1.CertificateManagement
	DNSNames []string
	Issuer   KeyPairInterface
}

func (*KeyPair) BYO

func (k *KeyPair) BYO() bool

BYO returns true if this KeyPair was provided by the user. If BYO is true, UseCertificateManagement is false.

func (*KeyPair) GetCertificatePEM

func (k *KeyPair) GetCertificatePEM() []byte

func (*KeyPair) GetIssuer

func (k *KeyPair) GetIssuer() CertificateInterface

func (*KeyPair) GetName

func (k *KeyPair) GetName() string

func (*KeyPair) HashAnnotationKey

func (k *KeyPair) HashAnnotationKey() string

func (*KeyPair) HashAnnotationValue

func (k *KeyPair) HashAnnotationValue() string

func (*KeyPair) InitContainer

func (k *KeyPair) InitContainer(namespace string) corev1.Container

InitContainer contains an init container for making a CSR. is only applicable when certificate management is enabled.

func (*KeyPair) Secret

func (k *KeyPair) Secret(namespace string) *corev1.Secret

func (*KeyPair) UseCertificateManagement

func (k *KeyPair) UseCertificateManagement() bool

UseCertificateManagement is true if this secret is not BYO and certificate management is used to provide the a pair to a pod.

func (*KeyPair) Volume

func (k *KeyPair) Volume() corev1.Volume

func (*KeyPair) VolumeMount

func (k *KeyPair) VolumeMount() corev1.VolumeMount

func (*KeyPair) VolumeMountCertificateFilePath

func (k *KeyPair) VolumeMountCertificateFilePath() string

func (*KeyPair) VolumeMountKeyFilePath

func (k *KeyPair) VolumeMountKeyFilePath() string

type KeyPairInterface

type KeyPairInterface interface {
	//UseCertificateManagement returns true if this key pair was not user provided and certificate management has been configured.
	UseCertificateManagement() bool
	// BYO returns true if this KeyPair was provided by the user. If BYO is true, UseCertificateManagement is false.
	BYO() bool
	InitContainer(namespace string) corev1.Container
	VolumeMount() corev1.VolumeMount
	VolumeMountKeyFilePath() string
	VolumeMountCertificateFilePath() string
	Volume() corev1.Volume
	Secret(namespace string) *corev1.Secret
	HashAnnotationKey() string
	HashAnnotationValue() string
	CertificateInterface
}

KeyPairInterface wraps a Secret object that contains a private key and a certificate. Whether CertificateManagement is configured or not, KeyPair returns the right InitContainer, VolumeMount or Volume (when applicable).

func NewKeyPair

func NewKeyPair(secret *corev1.Secret, dnsNames []string, clusterDomain string) (KeyPairInterface, error)

NewKeyPair returns a KeyPair, which wraps a Secret object that contains a private key and a certificate. Whether certificate management is configured or not, KeyPair returns the right InitContainer, Volumemount or Volume (when applicable).

type TrustedBundle

type TrustedBundle interface {
	MountPath() string
	ConfigMap(namespace string) *corev1.ConfigMap
	HashAnnotations() map[string]string
	VolumeMount() corev1.VolumeMount
	Volume() corev1.Volume
	AddCertificates(certificates ...CertificateInterface)
}

TrustedBundle is used to create a trusted certificate bundle of the CertificateManager CA and 0 or more Certificates.

func CreateTrustedBundle

func CreateTrustedBundle(certificates ...CertificateInterface) TrustedBundle

CreateTrustedBundle creates a TrustedBundle, which provides standardized methods for mounting a bundle of certificates to trust.