Documentation
¶
Index ¶
- Variables
- func GetHumanCertDetail(certificate *x509.Certificate) string
- type CAContentProvider
- type CertKeyContentProvider
- type ConfigMapCAController
- func (c *ConfigMapCAController) AddListener(listener Listener)
- func (c *ConfigMapCAController) CurrentCABundleContent() []byte
- func (c *ConfigMapCAController) Name() string
- func (c *ConfigMapCAController) Run(workers int, stopCh <-chan struct{})
- func (c *ConfigMapCAController) RunOnce() error
- func (c *ConfigMapCAController) VerifyOptions() (x509.VerifyOptions, bool)
- type ControllerRunner
- type DynamicCertKeyPairContent
- func (c *DynamicCertKeyPairContent) AddListener(listener Listener)
- func (c *DynamicCertKeyPairContent) CurrentCertKeyContent() ([]byte, []byte)
- func (c *DynamicCertKeyPairContent) Name() string
- func (c *DynamicCertKeyPairContent) Run(workers int, stopCh <-chan struct{})
- func (c *DynamicCertKeyPairContent) RunOnce() error
- type DynamicFileCAContent
- func (c *DynamicFileCAContent) AddListener(listener Listener)
- func (c *DynamicFileCAContent) CurrentCABundleContent() (cabundle []byte)
- func (c *DynamicFileCAContent) Name() string
- func (c *DynamicFileCAContent) Run(workers int, stopCh <-chan struct{})
- func (c *DynamicFileCAContent) RunOnce() error
- func (c *DynamicFileCAContent) VerifyOptions() (x509.VerifyOptions, bool)
- type DynamicFileSNIContent
- type DynamicServingCertificateController
- func (c *DynamicServingCertificateController) BuildNamedCertificates(sniCerts []sniCertKeyContent) (map[string]*tls.Certificate, error)
- func (c *DynamicServingCertificateController) Enqueue()
- func (c *DynamicServingCertificateController) GetConfigForClient(clientHello *tls.ClientHelloInfo) (*tls.Config, error)
- func (c *DynamicServingCertificateController) Run(workers int, stopCh <-chan struct{})
- func (c *DynamicServingCertificateController) RunOnce() error
- type Listener
- type Notifier
- type SNICertKeyContentProvider
Constants ¶
This section is empty.
Variables ¶
var FileRefreshDuration = 1 * time.Minute
FileRefreshDuration is exposed so that integration tests can crank up the reload speed.
Functions ¶
func GetHumanCertDetail ¶
func GetHumanCertDetail(certificate *x509.Certificate) string
GetHumanCertDetail is a convenient method for printing compact details of certificate that helps when debugging kube-apiserver usage of certs.
Types ¶
type CAContentProvider ¶
type CAContentProvider interface {
// Name is just an identifier
Name() string
// CurrentCABundleContent provides ca bundle byte content. Errors can be contained to the controllers initializing
// the value. By the time you get here, you should always be returning a value that won't fail.
CurrentCABundleContent() []byte
// VerifyOptions provides VerifyOptions for authenticators
VerifyOptions() (x509.VerifyOptions, bool)
}
CAContentProvider provides ca bundle byte content
func NewStaticCAContent ¶
func NewStaticCAContent(name string, caBundle []byte) (CAContentProvider, error)
NewStaticCAContent returns a CAContentProvider that always returns the same value
func NewUnionCAContentProvider ¶
func NewUnionCAContentProvider(caContentProviders ...CAContentProvider) CAContentProvider
NewUnionCAContentProvider returns a CAContentProvider that is a union of other CAContentProviders
type CertKeyContentProvider ¶
type CertKeyContentProvider interface {
// Name is just an identifier
Name() string
// CurrentCertKeyContent provides cert and key byte content
CurrentCertKeyContent() ([]byte, []byte)
}
CertKeyContentProvider provides a certificate and matching private key
func NewStaticCertKeyContent ¶
func NewStaticCertKeyContent(name string, cert, key []byte) (CertKeyContentProvider, error)
NewStaticCertKeyContent returns a CertKeyContentProvider that always returns the same value
type ConfigMapCAController ¶
type ConfigMapCAController struct {
// contains filtered or unexported fields
}
ConfigMapCAController provies a CAContentProvider that can dynamically react to configmap changes It also fulfills the authenticator interface to provide verifyoptions
func NewDynamicCAFromConfigMapController ¶
func NewDynamicCAFromConfigMapController(purpose, namespace, name, key string, kubeClient kubernetes.Interface) (*ConfigMapCAController, error)
NewDynamicCAFromConfigMapController returns a CAContentProvider based on a configmap that automatically reloads content. It is near-realtime via an informer.
func (*ConfigMapCAController) AddListener ¶
func (c *ConfigMapCAController) AddListener(listener Listener)
AddListener adds a listener to be notified when the CA content changes.
func (*ConfigMapCAController) CurrentCABundleContent ¶
func (c *ConfigMapCAController) CurrentCABundleContent() []byte
CurrentCABundleContent provides ca bundle byte content
func (*ConfigMapCAController) Name ¶
func (c *ConfigMapCAController) Name() string
Name is just an identifier
func (*ConfigMapCAController) Run ¶
func (c *ConfigMapCAController) Run(workers int, stopCh <-chan struct{})
Run starts the kube-apiserver and blocks until stopCh is closed.
func (*ConfigMapCAController) RunOnce ¶
func (c *ConfigMapCAController) RunOnce() error
RunOnce runs a single sync loop
func (*ConfigMapCAController) VerifyOptions ¶
func (c *ConfigMapCAController) VerifyOptions() (x509.VerifyOptions, bool)
VerifyOptions provides verifyoptions compatible with authenticators
type ControllerRunner ¶
type ControllerRunner interface {
// RunOnce runs the sync loop a single time. This useful for synchronous priming
RunOnce() error
// Run should be called a go .Run
Run(workers int, stopCh <-chan struct{})
}
ControllerRunner is a generic interface for starting a controller
type DynamicCertKeyPairContent ¶ added in v0.18.0
type DynamicCertKeyPairContent struct {
// contains filtered or unexported fields
}
DynamicCertKeyPairContent provides a CertKeyContentProvider that can dynamically react to new file content
func NewDynamicServingContentFromFiles ¶
func NewDynamicServingContentFromFiles(purpose, certFile, keyFile string) (*DynamicCertKeyPairContent, error)
NewDynamicServingContentFromFiles returns a dynamic CertKeyContentProvider based on a cert and key filename
func (*DynamicCertKeyPairContent) AddListener ¶ added in v0.18.0
func (c *DynamicCertKeyPairContent) AddListener(listener Listener)
AddListener adds a listener to be notified when the serving cert content changes.
func (*DynamicCertKeyPairContent) CurrentCertKeyContent ¶ added in v0.18.0
func (c *DynamicCertKeyPairContent) CurrentCertKeyContent() ([]byte, []byte)
CurrentCertKeyContent provides cert and key byte content
func (*DynamicCertKeyPairContent) Name ¶ added in v0.18.0
func (c *DynamicCertKeyPairContent) Name() string
Name is just an identifier
func (*DynamicCertKeyPairContent) Run ¶ added in v0.18.0
func (c *DynamicCertKeyPairContent) Run(workers int, stopCh <-chan struct{})
Run starts the controller and blocks until stopCh is closed.
func (*DynamicCertKeyPairContent) RunOnce ¶ added in v0.18.0
func (c *DynamicCertKeyPairContent) RunOnce() error
RunOnce runs a single sync loop
type DynamicFileCAContent ¶
type DynamicFileCAContent struct {
// contains filtered or unexported fields
}
DynamicFileCAContent provies a CAContentProvider that can dynamically react to new file content It also fulfills the authenticator interface to provide verifyoptions
func NewDynamicCAContentFromFile ¶
func NewDynamicCAContentFromFile(purpose, filename string) (*DynamicFileCAContent, error)
NewDynamicCAContentFromFile returns a CAContentProvider based on a filename that automatically reloads content
func (*DynamicFileCAContent) AddListener ¶
func (c *DynamicFileCAContent) AddListener(listener Listener)
AddListener adds a listener to be notified when the CA content changes.
func (*DynamicFileCAContent) CurrentCABundleContent ¶
func (c *DynamicFileCAContent) CurrentCABundleContent() (cabundle []byte)
CurrentCABundleContent provides ca bundle byte content
func (*DynamicFileCAContent) Name ¶
func (c *DynamicFileCAContent) Name() string
Name is just an identifier
func (*DynamicFileCAContent) Run ¶
func (c *DynamicFileCAContent) Run(workers int, stopCh <-chan struct{})
Run starts the kube-apiserver and blocks until stopCh is closed.
func (*DynamicFileCAContent) RunOnce ¶
func (c *DynamicFileCAContent) RunOnce() error
RunOnce runs a single sync loop
func (*DynamicFileCAContent) VerifyOptions ¶
func (c *DynamicFileCAContent) VerifyOptions() (x509.VerifyOptions, bool)
VerifyOptions provides verifyoptions compatible with authenticators
type DynamicFileSNIContent ¶
type DynamicFileSNIContent struct {
*DynamicCertKeyPairContent
// contains filtered or unexported fields
}
DynamicFileSNIContent provides a SNICertKeyContentProvider that can dynamically react to new file content
func NewDynamicSNIContentFromFiles ¶
func NewDynamicSNIContentFromFiles(purpose, certFile, keyFile string, sniNames ...string) (*DynamicFileSNIContent, error)
NewDynamicSNIContentFromFiles returns a dynamic SNICertKeyContentProvider based on a cert and key filename and explicit names
func (*DynamicFileSNIContent) SNINames ¶
func (c *DynamicFileSNIContent) SNINames() []string
SNINames returns explicitly set SNI names for the certificate. These are not dynamic.
type DynamicServingCertificateController ¶
type DynamicServingCertificateController struct {
// contains filtered or unexported fields
}
DynamicServingCertificateController dynamically loads certificates and provides a golang tls compatible dynamic GetCertificate func.
func NewDynamicServingCertificateController ¶
func NewDynamicServingCertificateController( baseTLSConfig *tls.Config, clientCA CAContentProvider, servingCert CertKeyContentProvider, sniCerts []SNICertKeyContentProvider, eventRecorder events.EventRecorder, ) *DynamicServingCertificateController
NewDynamicServingCertificateController returns a controller that can be used to keep a TLSConfig up to date.
func (*DynamicServingCertificateController) BuildNamedCertificates ¶
func (c *DynamicServingCertificateController) BuildNamedCertificates(sniCerts []sniCertKeyContent) (map[string]*tls.Certificate, error)
BuildNamedCertificates returns a map of *tls.Certificate by name. It's suitable for use in tls.Config#NamedCertificates. Returns an error if any of the certs is invalid. Returns nil if len(certs) == 0
func (*DynamicServingCertificateController) Enqueue ¶
func (c *DynamicServingCertificateController) Enqueue()
Enqueue a method to allow separate control loops to cause the certificate controller to trigger and read content.
func (*DynamicServingCertificateController) GetConfigForClient ¶
func (c *DynamicServingCertificateController) GetConfigForClient(clientHello *tls.ClientHelloInfo) (*tls.Config, error)
GetConfigForClient is an implementation of tls.Config.GetConfigForClient
func (*DynamicServingCertificateController) Run ¶
func (c *DynamicServingCertificateController) Run(workers int, stopCh <-chan struct{})
Run starts the kube-apiserver and blocks until stopCh is closed.
func (*DynamicServingCertificateController) RunOnce ¶
func (c *DynamicServingCertificateController) RunOnce() error
RunOnce runs a single sync step to ensure that we have a valid starting configuration.
type Listener ¶
type Listener interface {
// Enqueue should be called when an input may have changed
Enqueue()
}
Listener is an interface to use to notify interested parties of a change.
type Notifier ¶
type Notifier interface {
// AddListener is adds a listener to be notified of potential input changes
AddListener(listener Listener)
}
Notifier is a way to add listeners
type SNICertKeyContentProvider ¶
type SNICertKeyContentProvider interface {
CertKeyContentProvider
// SNINames provides names used for SNI. May return nil.
SNINames() []string
}
SNICertKeyContentProvider provides a certificate and matching private key as well as optional explicit names
func NewStaticSNICertKeyContent ¶
func NewStaticSNICertKeyContent(name string, cert, key []byte, sniNames ...string) (SNICertKeyContentProvider, error)
NewStaticSNICertKeyContent returns a SNICertKeyContentProvider that always returns the same value
Source Files