daemoncred

type CSRApprover struct {
	// contains filtered or unexported fields
}

type CSRApproverOptions struct {
	// SignerName is the certificates.k8s.io signerName this approver handles.
	// Defaults to kubernetes.io/kube-apiserver-client when empty.
	SignerName string

	// DaemonGroup is the non-privileged group requested in the issued certificate
	// alongside system:nodes. It is required and must not use reserved names.
	DaemonGroup string

	// BootstrapGroup is the bootstrap-token requester group allowed to request
	// initial daemon-controller certificates. It is required and intentionally not
	// derived from DaemonGroup so integrations can choose their own bootstrap group.
	BootstrapGroup string

	// MaxExpirationSeconds is the maximum allowed spec.expirationSeconds value.
	// Defaults to 365 days when unset.
	MaxExpirationSeconds int32

	// AuthorizeBootstrap validates implementation-specific bootstrap-token to node
	// binding after the generic CSR shape and requester group checks pass.
	AuthorizeBootstrap RequestAuthorizationFunc

	// CredentialBootstrapRequester is an optional exact requester identity allowed
	// to bootstrap with a credential ID instead of a Kubernetes bootstrap token.
	// AuthorizeCredentialBootstrap must also be set when this is set.
	CredentialBootstrapRequester string

	// AuthorizeCredentialBootstrap validates the credential ID to node binding
	// after the exact requester identity and credential ID shape checks pass.
	AuthorizeCredentialBootstrap CredentialRequestAuthorizationFunc

	// AuthorizeRenewal validates implementation-specific existing-cert to node
	// binding after the generic CSR shape and requester identity checks pass.
	AuthorizeRenewal RequestAuthorizationFunc
}

type CSRApproverReconciler struct {
	// Client reads CertificateSigningRequest objects from the controller cache.
	client.Client

	// KubeClient updates the CSR approval subresource.
	KubeClient kubernetes.Interface

	// Approver evaluates CSR requests.
	Approver CSREvaluator

	// EventFilter optionally customizes which CSR events enqueue reconcile work.
	// When nil, create, update, and generic events are processed and deletes are ignored.
	EventFilter predicate.Predicate
}

type CSRDecision struct {
	// Ignore is true when the CSR is for another signer and should not be touched.
	Ignore bool

	// AlreadyDecided is true when the CSR already has a terminal approval state or certificate.
	AlreadyDecided bool

	// Approve is true for approval decisions and false for denial decisions.
	Approve bool

	// Message is written to the CSR approval or denial condition.
	Message string
}

type CSREvaluator interface {
	Evaluate(context.Context, *certificatesv1.CertificateSigningRequest) (CSRDecision, error)
}

type ControllerCertificateOptions struct {
	// Name identifies this certificate manager in logs.
	Name string

	// SignerName is the certificates.k8s.io signerName used for daemon-controller CSRs.
	// Defaults to kubernetes.io/kube-apiserver-client when empty.
	SignerName string

	// DaemonGroup is the additional group requested alongside system:nodes.
	// It is required and must not use reserved or privileged group names.
	DaemonGroup string

	// CredentialDir stores the daemon-controller certificate material.
	// It is required.
	CredentialDir string

	// WaitTimeout is how long initial certificate issuance waits before failing.
	// Defaults to 10 seconds when unset.
	WaitTimeout time.Duration

	// WaitPoll is the polling interval used while waiting for initial issuance.
	// Defaults to 500 milliseconds when unset.
	WaitPoll time.Duration

	// ExpirationDuration is the requested lifetime for issued certificates.
	// Defaults to 365 days when unset.
	ExpirationDuration time.Duration

	// ReloadPeriod is how often the REST config provider checks for rotation.
	// Defaults to 10 seconds when unset.
	ReloadPeriod time.Duration
}

type CredentialRequestAuthorizationFunc func(context.Context, *certificatesv1.CertificateSigningRequest, string, string) (bool, error)

type KubeletClientCSRApprover struct {
	// contains filtered or unexported fields
}

type KubeletClientCSRApproverOptions struct {
	// Requester is the exact CSR spec.username this approver handles. CSRs
	// from any other requester are ignored so other approvers keep working.
	Requester string

	// MaxExpirationSeconds is the maximum allowed spec.expirationSeconds value.
	// Defaults to 365 days when unset.
	MaxExpirationSeconds int32

	// AuthorizeNode binds the requester credential to the requested node.
	AuthorizeNode KubeletNodeAuthorizationFunc
}

type KubeletNodeAuthorizationFunc func(ctx context.Context, csr *certificatesv1.CertificateSigningRequest, nodeName, credentialID string) (bool, string, error)

type RESTConfigProvider struct {
	// contains filtered or unexported fields
}

type RequestAuthorizationFunc func(context.Context, *certificatesv1.CertificateSigningRequest, string) (bool, error)