certs

func TLSConfig ¶

func TLSConfig() (tlsConfig *tls.Config, certDir string, err error)

TLSConfig loads TLS certificates from the directory specified by CERTDIR environment variable. If CERTDIR is not set, defaults to /var/run/secrets/spiffe.io (standard k8s SPIFFE path).

Expected files in the cert directory:

• ca.crt: CA certificate for client verification
• tls.crt: Server certificate
• tls.key: Server private key

Returns ErrNotPresent if the CA cert file doesn't exist, allowing callers to fall back to plaintext. Returns a different error if certs exist but are invalid.