gcetpm

Documentation

Index

• Constants
• type AuthToken
• type AuthTokenData
• type TPMVerifierOptions

Constants

const AudienceNodeAuthentication = "kops.k8s.io/node-bootstrap"

AudienceNodeAuthentication is used in case we have multiple audiences using the TPM in future

const GCETPMAuthenticationTokenPrefix = "x-gce-tpm "

GCETPMAuthenticationTokenPrefix is the prefix used for authentication using the GCE TPM

Types

type AuthToken

type AuthToken struct {
	// Signature is the TPM signature for data
	Signature []byte `json:"signature,omitempty"`

	// Data is the data we are signing.
	// It is a JSON encoded form of AuthTokenData.
	Data []byte `json:"data,omitempty"`
}

AuthToken describes the authentication header data when using GCE TPM authentication.

type AuthTokenData

type AuthTokenData struct {
	// GCPProjectID is the GCP project we claim to be part of
	GCPProjectID string `json:"gcpProjectID,omitempty"`

	// Zone is the availability zone we claim to be part of
	Zone string `json:"zone,omitempty"`

	// Instance is the name/id of the instance we are claiming
	Instance string `json:"instance,omitempty"`

	// RequestHash is the hash of the request
	RequestHash []byte `json:"requestHash,omitempty"`

	// Timestamp is the time of this request (to help prevent replay attacks)
	Timestamp int64 `json:"timestamp,omitempty"`

	// Audience is the audience for this request (to help prevent replay attacks)
	Audience string `json:"audience,omitempty"`
}

AuthTokenData is the code data that is signed as part of the header.

type TPMVerifierOptions

type TPMVerifierOptions struct {
	// ProjectID is the GCP project we require
	ProjectID string `json:"projectID,omitempty"`

	// Region is the region we require instances to be in.
	Region string `json:"region,omitempty"`

	// ClusterName is the cluster-name tag we require
	ClusterName string `json:"clusterName,omitempty"`

	// MaxTimeSkew is the maximum time skew to allow (in seconds)
	MaxTimeSkew int64 `json:"MaxTimeSkew,omitempty"`
}

TPMVerifierOptions describes how we authenticate instances with GCE TPM authentication.