certificates

Documentation

Index

• Constants
• func CABundleConfigMapCreator(name string, caBundle fmt.Stringer) reconciling.NamedConfigMapCreatorGetter
• func FrontProxyCACreator() reconciling.NamedSecretCreatorGetter
• func GetCACreator(commonName string) reconciling.SecretCreator
• func GetClientCertificateCreator(name, commonName string, organizations []string, ...) reconciling.NamedSecretCreatorGetter
• func GetECDSACACertAndKey() (cert []byte, key []byte, err error)
• func GetECDSAClientCertificateCreator(name, commonName string, organizations []string, ...) reconciling.SecretCreator
• func GetSignedECDSACertAndKey(notAfter time.Duration, cfg certutil.Config, caCert *x509.Certificate, ...) (cert []byte, key []byte, err error)
• func GlobalCABundle(ctx context.Context, client ctrlruntimeclient.Client, ...) (*corev1.ConfigMap, error)
• func RootCACreator(data caCreatorData) reconciling.NamedSecretCreatorGetter
• func ValidateCABundle(bundle string) error
• func ValidateCABundleConfigMap(cm *corev1.ConfigMap) error
• type CABundle
  • func NewCABundleFromBytes(bytes []byte) (*CABundle, error)
  • func NewCABundleFromFile(filename string) (*CABundle, error)
  • func NewFakeCABundle() *CABundle
  • func (b *CABundle) CertPool() *x509.CertPool
  • func (b *CABundle) String() string

Constants

const Duration365d = time.Hour * 24 * 365

Duration365d is a time.Duration that represents a year.

Functions

func CABundleConfigMapCreator

func CABundleConfigMapCreator(name string, caBundle fmt.Stringer) reconciling.NamedConfigMapCreatorGetter

CABundleConfigMapCreator returns a ConfigMapCreatorGetter that creates a ca-bundle ConfigMap for use in seeds and userclusters.

TODO: Do not use fmt.Stringer, but a better type for the CA bundle

parameter. "*CABundle" is not viable because most of the codebase
deals with "resources.CABundle", which in turn exists to
prevent an import loop between this and the "resources" package.

func FrontProxyCACreator

func FrontProxyCACreator() reconciling.NamedSecretCreatorGetter

FrontProxyCACreator returns a function to create a secret with front proxy ca.

func GetCACreator

func GetCACreator(commonName string) reconciling.SecretCreator

GetCACreator returns a function to create a secret containing a CA with the specified name.

func GetClientCertificateCreator

func GetClientCertificateCreator(name, commonName string, organizations []string, dataCertKey, dataKeyKey string, getCA caGetter) reconciling.NamedSecretCreatorGetter

GetClientCertificateCreator is a generic function to return a secret generator to create a client certificate signed by the cluster CA.

func GetECDSACACertAndKey

func GetECDSACACertAndKey() (cert []byte, key []byte, err error)

GetECDSACACertAndKey returns a pem-encoded ECDSA certificate and key.

func GetECDSAClientCertificateCreator

func GetECDSAClientCertificateCreator(name, commonName string, organizations []string, dataCertKey, dataKeyKey string, getCA ecdsaCAGetter) reconciling.SecretCreator

GetECDSAClientCertificateCreator is a generic function to return a secret generator to create a client certificate signed by the cert returned by the passed getCA func. The resulting secret has no ownerRef.

func GetSignedECDSACertAndKey

func GetSignedECDSACertAndKey(notAfter time.Duration, cfg certutil.Config, caCert *x509.Certificate, caKey *ecdsa.PrivateKey) (cert []byte, key []byte, err error)

GetSignedECDSACertAndKey creates and returns a signed ECDSA x509 certificate and key.

func GlobalCABundle

func GlobalCABundle(ctx context.Context, client ctrlruntimeclient.Client, config *kubermaticv1.KubermaticConfiguration) (*corev1.ConfigMap, error)

func RootCACreator

func RootCACreator(data caCreatorData) reconciling.NamedSecretCreatorGetter

RootCACreator returns a function to create a secret with the root ca.

func ValidateCABundle

func ValidateCABundle(bundle string) error

func ValidateCABundleConfigMap

func ValidateCABundleConfigMap(cm *corev1.ConfigMap) error

Types

type CABundle

type CABundle struct {
	// contains filtered or unexported fields
}

CABundle represents an x509.CertPool that was loaded from a file and which needs to be access both as a cert pool (i.e. parsed) _and_ as a file/PEM string.

func NewCABundleFromBytes

func NewCABundleFromBytes(bytes []byte) (*CABundle, error)

func NewCABundleFromFile

func NewCABundleFromFile(filename string) (*CABundle, error)

func NewFakeCABundle

func NewFakeCABundle() *CABundle

NewFakeCABundle returns a CA bundle that contains a single certificate that cannot validate anything.

func (*CABundle) CertPool

func (b *CABundle) CertPool() *x509.CertPool

func (*CABundle) String

func (b *CABundle) String() string