certificates

package
v1.27.0-rc.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 6, 2023 License: Apache-2.0 Imports: 11 Imported by: 520

Documentation

Index

Constants

View Source 
const (
	// Signs certificates that will be honored as client-certs by the
	// kube-apiserver. Never auto-approved by kube-controller-manager.
	KubeAPIServerClientSignerName = "kubernetes.io/kube-apiserver-client"

	// Signs client certificates that will be honored as client-certs by the
	// kube-apiserver for a kubelet.
	// May be auto-approved by kube-controller-manager.
	KubeAPIServerClientKubeletSignerName = "kubernetes.io/kube-apiserver-client-kubelet"

	// Signs serving certificates that are honored as a valid kubelet serving
	// certificate by the kube-apiserver, but has no other guarantees.
	KubeletServingSignerName = "kubernetes.io/kubelet-serving"

	// Has no guarantees for trust at all. Some distributions may honor these
	// as client certs, but that behavior is not standard kubernetes behavior.
	LegacyUnknownSignerName = "kubernetes.io/legacy-unknown"
)

Built in signerName values that are honoured by kube-controller-manager. None of these usages are related to ServiceAccount token secrets `.data[ca.crt]` in any way.

View Source 
const GroupName = "certificates.k8s.io"

GroupName is the group name use in this package

Variables

View Source 
var (
	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
	AddToScheme   = SchemeBuilder.AddToScheme
)
View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}

SchemeGroupVersion is group version used to register these objects

Functions

func IsKubeletClientCSR added in v1.19.0 

func IsKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) bool

func IsKubeletServingCSR added in v1.19.0 

func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool

func Kind 

func Kind(kind string) schema.GroupKind

Kind takes an unqualified kind and returns a Group qualified GroupKind

func ParseCSR added in v1.6.0 

func ParseCSR(pemBytes []byte) (*x509.CertificateRequest, error)

ParseCSR extracts the CSR from the bytes and decodes it.

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

func ValidateKubeletClientCSR added in v1.19.0 

func ValidateKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) error

func ValidateKubeletServingCSR added in v1.19.0 

func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error

Types

type CertificateSigningRequest 

type CertificateSigningRequest struct {
	metav1.TypeMeta
	// +optional
	metav1.ObjectMeta

	// The certificate request itself and any additional information.
	// +optional
	Spec CertificateSigningRequestSpec

	// Derived information about the request.
	// +optional
	Status CertificateSigningRequestStatus
}

Describes a certificate signing request

func (*CertificateSigningRequest) DeepCopy added in v1.8.0 

func (in *CertificateSigningRequest) DeepCopy() *CertificateSigningRequest

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequest.

func (*CertificateSigningRequest) DeepCopyInto added in v1.8.0 

func (in *CertificateSigningRequest) DeepCopyInto(out *CertificateSigningRequest)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CertificateSigningRequest) DeepCopyObject added in v1.8.0 

func (in *CertificateSigningRequest) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type CertificateSigningRequestCondition 

type CertificateSigningRequestCondition struct {
	// type of the condition. Known conditions include "Approved", "Denied", and "Failed".
	Type RequestConditionType
	// Status of the condition, one of True, False, Unknown.
	// Approved, Denied, and Failed conditions may not be "False" or "Unknown".
	// If unset, should be treated as "True".
	// +optional
	Status api.ConditionStatus
	// brief reason for the request state
	// +optional
	Reason string
	// human readable message with details about the request state
	// +optional
	Message string
	// timestamp for the last update to this condition
	// +optional
	LastUpdateTime metav1.Time
	// lastTransitionTime is the time the condition last transitioned from one status to another.
	// +optional
	LastTransitionTime metav1.Time
}

func (*CertificateSigningRequestCondition) DeepCopy added in v1.8.0 

func (in *CertificateSigningRequestCondition) DeepCopy() *CertificateSigningRequestCondition

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestCondition.

func (*CertificateSigningRequestCondition) DeepCopyInto added in v1.8.0 

func (in *CertificateSigningRequestCondition) DeepCopyInto(out *CertificateSigningRequestCondition)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type CertificateSigningRequestList 

type CertificateSigningRequestList struct {
	metav1.TypeMeta
	// +optional
	metav1.ListMeta

	// +optional
	Items []CertificateSigningRequest
}

func (*CertificateSigningRequestList) DeepCopy added in v1.8.0 

func (in *CertificateSigningRequestList) DeepCopy() *CertificateSigningRequestList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestList.

func (*CertificateSigningRequestList) DeepCopyInto added in v1.8.0 

func (in *CertificateSigningRequestList) DeepCopyInto(out *CertificateSigningRequestList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CertificateSigningRequestList) DeepCopyObject added in v1.8.0 

func (in *CertificateSigningRequestList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type CertificateSigningRequestSpec 

type CertificateSigningRequestSpec struct {
	// Base64-encoded PKCS#10 CSR data
	Request []byte

	// signerName indicates the requested signer, and is a qualified name.
	//
	// List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.
	//
	// Well-known Kubernetes signers are:
	//  1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver.
	//   Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager.
	//  2. "kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver.
	//   Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
	//  3. "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely.
	//   Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
	//
	// More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
	//
	// Custom signerNames can also be specified. The signer defines:
	//  1. Trust distribution: how trust (CA bundles) are distributed.
	//  2. Permitted subjects: and behavior when a disallowed subject is requested.
	//  3. Required, permitted, or forbidden x509 extensions in the request (including whether subjectAltNames are allowed, which types, restrictions on allowed values) and behavior when a disallowed extension is requested.
	//  4. Required, permitted, or forbidden key usages / extended key usages.
	//  5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.
	//  6. Whether or not requests for CA certificates are allowed.
	SignerName string

	// expirationSeconds is the requested duration of validity of the issued
	// certificate. The certificate signer may issue a certificate with a different
	// validity duration so a client must check the delta between the notBefore and
	// and notAfter fields in the issued certificate to determine the actual duration.
	//
	// The v1.22+ in-tree implementations of the well-known Kubernetes signers will
	// honor this field as long as the requested duration is not greater than the
	// maximum duration they will honor per the --cluster-signing-duration CLI
	// flag to the Kubernetes controller manager.
	//
	// Certificate signers may not honor this field for various reasons:
	//
	//   1. Old signer that is unaware of the field (such as the in-tree
	//      implementations prior to v1.22)
	//   2. Signer whose configured maximum is shorter than the requested duration
	//   3. Signer whose configured minimum is longer than the requested duration
	//
	// The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
	//
	// +optional
	ExpirationSeconds *int32

	// usages specifies a set of usage contexts the key will be
	// valid for.
	// See:
	//	https://tools.ietf.org/html/rfc5280#section-4.2.1.3
	//	https://tools.ietf.org/html/rfc5280#section-4.2.1.12
	Usages []KeyUsage

	// Information about the requesting user.
	// See user.Info interface for details.
	// +optional
	Username string
	// UID information about the requesting user.
	// See user.Info interface for details.
	// +optional
	UID string
	// Group information about the requesting user.
	// See user.Info interface for details.
	// +optional
	Groups []string
	// Extra information about the requesting user.
	// See user.Info interface for details.
	// +optional
	Extra map[string]ExtraValue
}

This information is immutable after the request is created. Only the Request and Usages fields can be set on creation, other fields are derived by Kubernetes and cannot be modified by users.

func (*CertificateSigningRequestSpec) DeepCopy added in v1.8.0 

func (in *CertificateSigningRequestSpec) DeepCopy() *CertificateSigningRequestSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestSpec.

func (*CertificateSigningRequestSpec) DeepCopyInto added in v1.8.0 

func (in *CertificateSigningRequestSpec) DeepCopyInto(out *CertificateSigningRequestSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type CertificateSigningRequestStatus 

type CertificateSigningRequestStatus struct {
	// Conditions applied to the request, such as approval or denial.
	// +optional
	Conditions []CertificateSigningRequestCondition

	// If request was approved, the controller will place the issued certificate here.
	// +optional
	Certificate []byte
}

func (*CertificateSigningRequestStatus) DeepCopy added in v1.8.0 

func (in *CertificateSigningRequestStatus) DeepCopy() *CertificateSigningRequestStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestStatus.

func (*CertificateSigningRequestStatus) DeepCopyInto added in v1.8.0 

func (in *CertificateSigningRequestStatus) DeepCopyInto(out *CertificateSigningRequestStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ClusterTrustBundle added in v1.27.0 

type ClusterTrustBundle struct {
	metav1.TypeMeta
	// +optional
	metav1.ObjectMeta

	// Spec contains the signer (if any) and trust anchors.
	// +optional
	Spec ClusterTrustBundleSpec
}

ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).

ClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster.

It can be optionally associated with a particular assigner, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer.

func (*ClusterTrustBundle) DeepCopy added in v1.27.0 

func (in *ClusterTrustBundle) DeepCopy() *ClusterTrustBundle

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundle.

func (*ClusterTrustBundle) DeepCopyInto added in v1.27.0 

func (in *ClusterTrustBundle) DeepCopyInto(out *ClusterTrustBundle)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterTrustBundle) DeepCopyObject added in v1.27.0 

func (in *ClusterTrustBundle) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterTrustBundleList added in v1.27.0 

type ClusterTrustBundleList struct {
	metav1.TypeMeta
	// +optional
	metav1.ListMeta

	// Items is a collection of ClusterTrustBundle objects
	Items []ClusterTrustBundle
}

ClusterTrustBundleList is a collection of ClusterTrustBundle objects

func (*ClusterTrustBundleList) DeepCopy added in v1.27.0 

func (in *ClusterTrustBundleList) DeepCopy() *ClusterTrustBundleList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundleList.

func (*ClusterTrustBundleList) DeepCopyInto added in v1.27.0 

func (in *ClusterTrustBundleList) DeepCopyInto(out *ClusterTrustBundleList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterTrustBundleList) DeepCopyObject added in v1.27.0 

func (in *ClusterTrustBundleList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterTrustBundleSpec added in v1.27.0 

type ClusterTrustBundleSpec struct {
	// SignerName indicates the associated signer, if any.
	SignerName string

	// TrustBundle contains the individual X.509 trust anchors for this
	// bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
	//
	// The data must consist only of PEM certificate blocks that parse as valid
	// X.509 certificates.  Each certificate must include a basic constraints
	// extension with the CA bit set.  The API server will reject objects that
	// contain duplicate certificates, or that use PEM block headers.
	//
	// Users of ClusterTrustBundles, including Kubelet, are free to reorder and
	// deduplicate certificate blocks in this file according to their own logic,
	// as well as to drop PEM block headers and inter-block data.
	TrustBundle string
}

ClusterTrustBundleSpec contains the signer and trust anchors.

func (*ClusterTrustBundleSpec) DeepCopy added in v1.27.0 

func (in *ClusterTrustBundleSpec) DeepCopy() *ClusterTrustBundleSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundleSpec.

func (*ClusterTrustBundleSpec) DeepCopyInto added in v1.27.0 

func (in *ClusterTrustBundleSpec) DeepCopyInto(out *ClusterTrustBundleSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ExtraValue added in v1.6.0 

type ExtraValue []string

ExtraValue masks the value so protobuf can generate

func (ExtraValue) DeepCopy added in v1.10.0 

func (in ExtraValue) DeepCopy() ExtraValue

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraValue.

func (ExtraValue) DeepCopyInto added in v1.10.0 

func (in ExtraValue) DeepCopyInto(out *ExtraValue)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type KeyUsage added in v1.6.0 

type KeyUsage string

KeyUsages specifies valid usage contexts for keys. See: 

https://tools.ietf.org/html/rfc5280#section-4.2.1.3
https://tools.ietf.org/html/rfc5280#section-4.2.1.12

const (
	UsageSigning           KeyUsage = "signing"
	UsageDigitalSignature  KeyUsage = "digital signature"
	UsageContentCommitment KeyUsage = "content commitment"
	UsageKeyEncipherment   KeyUsage = "key encipherment"
	UsageKeyAgreement      KeyUsage = "key agreement"
	UsageDataEncipherment  KeyUsage = "data encipherment"
	UsageCertSign          KeyUsage = "cert sign"
	UsageCRLSign           KeyUsage = "crl sign"
	UsageEncipherOnly      KeyUsage = "encipher only"
	UsageDecipherOnly      KeyUsage = "decipher only"
	UsageAny               KeyUsage = "any"
	UsageServerAuth        KeyUsage = "server auth"
	UsageClientAuth        KeyUsage = "client auth"
	UsageCodeSigning       KeyUsage = "code signing"
	UsageEmailProtection   KeyUsage = "email protection"
	UsageSMIME             KeyUsage = "s/mime"
	UsageIPsecEndSystem    KeyUsage = "ipsec end system"
	UsageIPsecTunnel       KeyUsage = "ipsec tunnel"
	UsageIPsecUser         KeyUsage = "ipsec user"
	UsageTimestamping      KeyUsage = "timestamping"
	UsageOCSPSigning       KeyUsage = "ocsp signing"
	UsageMicrosoftSGC      KeyUsage = "microsoft sgc"
	UsageNetscapeSGC       KeyUsage = "netscape sgc"
)

type RequestConditionType 

type RequestConditionType string
const (
	CertificateApproved RequestConditionType = "Approved"
	CertificateDenied   RequestConditionType = "Denied"
	CertificateFailed   RequestConditionType = "Failed"
)

These are the possible conditions for a certificate request.

Source Files

View all Source files

Directories

Path Synopsis
Package install installs the certificates API group, making it available as an option to all of the API encoding/decoding machinery.
 Package install installs the certificates API group, making it available as an option to all of the API encoding/decoding machinery.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.