Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CSRClientFunc ¶
type CSRClientFunc func(current *tls.Certificate) (certificatesclient.CertificateSigningRequestInterface, error)
CSRClientFunc returns a new client for requesting CSRs. It passes the current certificate if one is available and valid.
type Config ¶
type Config struct {
// ClientFn will be used to create a client for
// signing new certificate requests generated when a key rotation occurs.
// It must be set at initialization. The function will never be invoked
// in parallel. It is passed the current client certificate if one exists.
ClientFn CSRClientFunc
// Template is the CertificateRequest that will be used as a template for
// generating certificate signing requests for all new keys generated as
// part of rotation. It follows the same rules as the template parameter of
// crypto.x509.CreateCertificateRequest in the Go standard libraries.
Template *x509.CertificateRequest
// GetTemplate returns the CertificateRequest that will be used as a template for
// generating certificate signing requests for all new keys generated as
// part of rotation. It follows the same rules as the template parameter of
// crypto.x509.CreateCertificateRequest in the Go standard libraries.
// If no template is available, nil may be returned, and no certificate will be requested.
// If specified, takes precedence over Template.
GetTemplate func() *x509.CertificateRequest
// Usages is the types of usages that certificates generated by the manager
// can be used for.
Usages []certificates.KeyUsage
// CertificateStore is a persistent store where the current cert/key is
// kept and future cert/key pairs will be persisted after they are
// generated.
CertificateStore Store
// BootstrapCertificatePEM is the certificate data that will be returned
// from the Manager if the CertificateStore doesn't have any cert/key pairs
// currently available and has not yet had a chance to get a new cert/key
// pair from the API. If the CertificateStore does have a cert/key pair,
// this will be ignored. If there is no cert/key pair available in the
// CertificateStore, as soon as Start is called, it will request a new
// cert/key pair from the CertificateSigningRequestClient. This is intended
// to allow the first boot of a component to be initialized using a
// generic, multi-use cert/key pair which will be quickly replaced with a
// unique cert/key pair.
BootstrapCertificatePEM []byte
// BootstrapKeyPEM is the key data that will be returned from the Manager
// if the CertificateStore doesn't have any cert/key pairs currently
// available. If the CertificateStore does have a cert/key pair, this will
// be ignored. If the bootstrap cert/key pair are used, they will be
// rotated at the first opportunity, possibly well in advance of expiring.
// This is intended to allow the first boot of a component to be
// initialized using a generic, multi-use cert/key pair which will be
// quickly replaced with a unique cert/key pair.
BootstrapKeyPEM []byte
// CertificateExpiration will record a metric that shows the remaining
// lifetime of the certificate. This metric is a gauge because only the
// current cert expiry time is really useful. Reading this metric at any
// time simply gives the next expiration date, no need to keep some
// history (histogram) of all previous expiry dates.
CertificateExpiration Gauge
// CertificateRotation will record a metric showing the time in seconds
// that certificates lived before being rotated. This metric is a histogram
// because there is value in keeping a history of rotation cadences. It
// allows one to setup monitoring and alerting of unexpected rotation
// behavior and track trends in rotation frequency.
CertificateRotation Histogram
}
Config is the set of configuration parameters available for a new Manager.
type FileStore ¶
type FileStore interface {
Store
// CurrentPath returns the path on disk of the current certificate/key
// pair encoded as PEM files.
CurrentPath() string
}
FileStore is a store that provides certificate retrieval as well as the path on disk of the current PEM.
func NewFileStore ¶
func NewFileStore( pairNamePrefix string, certDirectory string, keyDirectory string, certFile string, keyFile string) (FileStore, error)
NewFileStore returns a concrete implementation of a Store that is based on storing the cert/key pairs in a single file per pair on disk in the designated directory. When starting up it will look for the currently selected cert/key pair in:
1. ${certDirectory}/${pairNamePrefix}-current.pem - both cert and key are in the same file. 2. ${certFile}, ${keyFile} 3. ${certDirectory}/${pairNamePrefix}.crt, ${keyDirectory}/${pairNamePrefix}.key
The first one found will be used. If rotation is enabled, future cert/key updates will be written to the ${certDirectory} directory and ${certDirectory}/${pairNamePrefix}-current.pem will be created as a soft link to the currently selected cert/key pair.
type Gauge ¶
type Gauge interface {
Set(float64)
}
Gauge will record the remaining lifetime of the certificate each time it is updated.
type Histogram ¶ added in v0.17.0
type Histogram interface {
Observe(float64)
}
Histogram will record the time a rotated certificate was used before being rotated.
type Manager ¶
type Manager interface {
// Start the API server status sync loop.
Start()
// Stop the cert manager loop.
Stop()
// Current returns the currently selected certificate from the
// certificate manager, as well as the associated certificate and key data
// in PEM format.
Current() *tls.Certificate
// ServerHealthy returns true if the manager is able to communicate with
// the server. This allows a caller to determine whether the cert manager
// thinks it can potentially talk to the API server. The cert manager may
// be very conservative and only return true if recent communication has
// occurred with the server.
ServerHealthy() bool
}
Manager maintains and updates the certificates in use by this certificate manager. In the background it communicates with the API server to get new certificates for certificates about to expire.
func NewManager ¶
NewManager returns a new certificate manager. A certificate manager is responsible for being the authoritative source of certificates in the Kubelet and handling updates due to rotation.
type NoCertKeyError ¶
type NoCertKeyError string
NoCertKeyError indicates there is no cert/key currently available.
func (*NoCertKeyError) Error ¶
func (e *NoCertKeyError) Error() string
type Store ¶
type Store interface {
// Current returns the currently selected certificate, as well as the
// associated certificate and key data in PEM format. If the Store doesn't
// have a cert/key pair currently, it should return a NoCertKeyError so
// that the Manager can recover by using bootstrap certificates to request
// a new cert/key pair.
Current() (*tls.Certificate, error)
// Update accepts the PEM data for the cert/key pair and makes the new
// cert/key pair the 'current' pair, that will be returned by future calls
// to Current().
Update(cert, key []byte) (*tls.Certificate, error)
}
Store is responsible for getting and updating the current certificate. Depending on the concrete implementation, the backing store for this behavior may vary.
Source Files
Directories