bootstrap

Documentation

Index

• Variables
• func BuildChallengeServerCertificate(clusterName string) (*tls.Certificate, error)
• type Authenticator
• type Challenge
• type ChallengeClient
  • func NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error)
  • func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, ...) error
• type ChallengeListener
  • func (s *ChallengeListener) CreateChallenge() *nodeup.ChallengeRequest
  • func (s *ChallengeListener) Endpoint() string
  • func (s *ChallengeListener) Stop()
• type ChallengeServer
  • func NewChallengeServer(clusterName string, caBundle []byte) (*ChallengeServer, error)
  • func (s *ChallengeServer) Challenge(ctx context.Context, req *pb.ChallengeRequest) (*pb.ChallengeResponse, error)
  • func (s *ChallengeServer) NewListener(ctx context.Context, listen string) (*ChallengeListener, error)
• type Verifier
• type VerifyResult

Variables

var ErrAlreadyExists = errors.New("node already exists")

Functions

func BuildChallengeServerCertificate

func BuildChallengeServerCertificate(clusterName string) (*tls.Certificate, error)

Types

type Authenticator

type Authenticator interface {
	CreateToken(body []byte) (string, error)
}

Authenticator generates authentication credentials for requests.

type Challenge

type Challenge struct {
	ChallengeID     string
	ChallengeSecret []byte
}

type ChallengeClient

type ChallengeClient struct {
	// contains filtered or unexported fields
}

func NewChallengeClient

func NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error)

func (*ChallengeClient) DoCallbackChallenge

func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error

type ChallengeListener

type ChallengeListener struct {
	// contains filtered or unexported fields
}

func (*ChallengeListener) CreateChallenge

func (s *ChallengeListener) CreateChallenge() *nodeup.ChallengeRequest

func (*ChallengeListener) Endpoint

func (s *ChallengeListener) Endpoint() string

func (*ChallengeListener) Stop

func (s *ChallengeListener) Stop()

type ChallengeServer

type ChallengeServer struct {
	RequiredSubject pkix.Name

	pb.UnimplementedCallbackServiceServer
	// contains filtered or unexported fields
}

func NewChallengeServer

func NewChallengeServer(clusterName string, caBundle []byte) (*ChallengeServer, error)

func (*ChallengeServer) Challenge

func (s *ChallengeServer) Challenge(ctx context.Context, req *pb.ChallengeRequest) (*pb.ChallengeResponse, error)

Answers challenges to cross-check bootstrap requests.

func (*ChallengeServer) NewListener

func (s *ChallengeServer) NewListener(ctx context.Context, listen string) (*ChallengeListener, error)

type Verifier

type Verifier interface {
	VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte, useInstanceIDForNodeName bool) (*VerifyResult, error)
}

Verifier verifies authentication credentials for requests.

type VerifyResult

type VerifyResult struct {
	// Nodename is the name that this node is authorized to use.
	NodeName string

	// InstanceGroupName is the name of the kops InstanceGroup this node is a member of.
	InstanceGroupName string

	// CertificateNames is the alternate names the node is authorized to use for certificates.
	CertificateNames []string

	// ChallengeEndpoint is a valid endpoints to which we should issue a challenge request,
	// corresponding to the node the request identified as.
	// This should be sourced from e.g. the cloud, and acts as a cross-check
	// that this is the correct instance.
	ChallengeEndpoint string
}

VerifyResult is the result of a successfully verified request.