certificatemanager

Documentation

Index

• func ErrInvalidCertDNSNames(secretName, secretNamespace string) error
• func GetKeyCertPEM(secret *corev1.Secret) ([]byte, []byte)
• func HasExpectedDNSNames(secretName, secretNamespace string, cert *x509.Certificate, ...) error
• func HasRequiredKeyUsage(cert *x509.Certificate, required []x509.ExtKeyUsage) bool
• func IsCertExtKeyUsageError(err error) bool
• type CertExtKeyUsageError
  • func (cue *CertExtKeyUsageError) Error() string
• type CertificateManager
  • func Create(cli client.Client, installation *operatorv1.InstallationSpec, ...) (CertificateManager, error)

Functions

func ErrInvalidCertDNSNames

func ErrInvalidCertDNSNames(secretName, secretNamespace string) error

func GetKeyCertPEM

func GetKeyCertPEM(secret *corev1.Secret) ([]byte, []byte)

func HasExpectedDNSNames

func HasExpectedDNSNames(secretName, secretNamespace string, cert *x509.Certificate, expectedDNSNames []string) error

func HasRequiredKeyUsage

func HasRequiredKeyUsage(cert *x509.Certificate, required []x509.ExtKeyUsage) bool

HasRequiredKeyUsage returns true if the given certificate is valid for use as both a server certificate, as well as a client certificate for mTLS connections.

func IsCertExtKeyUsageError

func IsCertExtKeyUsageError(err error) bool

Returns true if the error is a CertExtKeyUsageError

Types

type CertExtKeyUsageError

type CertExtKeyUsageError struct {
	// contains filtered or unexported fields
}

This type will be returned for errors that do not have the correct Ext Key usage types for a specific secert certificate.

func (*CertExtKeyUsageError) Error

func (cue *CertExtKeyUsageError) Error() string

type CertificateManager

type CertificateManager interface {
	// GetKeyPair returns an existing KeyPair. If the KeyPair is not found, nil is returned.
	GetKeyPair(cli client.Client, secretName, secretNamespace string) (certificatemanagement.KeyPairInterface, error)
	// GetOrCreateKeyPair returns a KeyPair. If one exists, some checks are performed. Otherwise, a new KeyPair is created.
	GetOrCreateKeyPair(cli client.Client, secretName, secretNamespace string, dnsNames []string) (certificatemanagement.KeyPairInterface, error)
	// GetCertificate returns a Certificate. If the certificate is not found, nil is returned.
	GetCertificate(cli client.Client, secretName, secretNamespace string) (certificatemanagement.CertificateInterface, error)
	// CreateTrustedBundle creates a TrustedBundle, which provides standardized methods for mounting a bundle of certificates to trust.
	// It will include:
	// - A bundle with Calico's root certificates + any user supplied certificates in /etc/pki/tls/certs/tigera-ca-bundle.crt.
	CreateTrustedBundle(certificates ...certificatemanagement.CertificateInterface) certificatemanagement.TrustedBundle
	// CreateTrustedBundleWithSystemRootCertificates creates a TrustedBundle, which provides standardized methods for mounting a bundle of certificates to trust.
	// It will include:
	// - A bundle with Calico's root certificates + any user supplied certificates in /etc/pki/tls/certs/tigera-ca-bundle.crt.
	// - A system root certificate bundle in /etc/pki/tls/certs/ca-bundle.crt.
	CreateTrustedBundleWithSystemRootCertificates(certificates ...certificatemanagement.CertificateInterface) (certificatemanagement.TrustedBundle, error)
	// AddToStatusManager lets the status manager monitor pending CSRs if the certificate management is enabled.
	AddToStatusManager(manager status.StatusManager, namespace string)
	// KeyPair Returns the CA KeyPairInterface, so it can be rendered in the operator namespace.
	KeyPair() certificatemanagement.KeyPairInterface
}

CertificateManager can sign new certificates and has methods to retrieve existing KeyPairs and Certificates. If a user brings their own secrets, CertificateManager will preserve and return them.

func Create

func Create(cli client.Client, installation *operatorv1.InstallationSpec, clusterDomain string) (CertificateManager, error)

Create creates a signer of new certificates and has methods to retrieve existing KeyPairs and Certificates. If a user brings their own secrets, CertificateManager will preserve and return them.