Documentation
¶
Overview ¶
Package credbundle handles credential bundle files written by Kubernetes Pod Certificates.
A credential bundle is a single file with multiple PEM entries. The first entry is a PRIVATE KEY block, and all remaining entries are CERTIFICATE blocks. The CERTIFICATE blocks are in leaf-to-root order, and may or may not include the root.
Index ¶
- func ClientLoader(path string) func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
- func Loader(path string) func(*tls.ClientHelloInfo) (*tls.Certificate, error)
- func Parse(bundlePath string) (*tls.Certificate, error)
- func ParsePool(path string) (*x509.CertPool, error)
- func PoolLoader(path string) func() (*x509.CertPool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClientLoader ¶ added in v0.1.0
func ClientLoader(path string) func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
ClientLoader is the client-side counterpart to Loader. It returns a function suitable for use as GetClientCertificate in a tls.Config, caching the parsed bundle in the same way so that pod-certificate rotations are picked up on the next handshake.
func Loader ¶
func Loader(path string) func(*tls.ClientHelloInfo) (*tls.Certificate, error)
Loader reads a private key and certificate chain from a credential bundle file as written by the Kubernetes Pod Certificates mechanism.
Returns a function that can be used as GetCertificate in a tls.Config. The parsed bundle is cached: each handshake stats the file and re-reads it only when the file has changed, so pod-certificate rotations are picked up on the next handshake without paying the read and parse cost when nothing changed.
func Parse ¶
func Parse(bundlePath string) (*tls.Certificate, error)
Parse reads a private key and certificate chain from a credential bundle file as written by the Kubernetes Pod Certificates mechanism.
func ParsePool ¶ added in v0.2.0
ParsePool reads a PEM trust-bundle file into an *x509.CertPool. It returns an error if the file holds no certificates: an empty trust pool would silently reject every peer, which is never what a workload should receive.
func PoolLoader ¶ added in v0.2.0
PoolLoader reads a set of trust anchors from a PEM trust-bundle file, as projected from a Kubernetes ClusterTrustBundle, and returns a function that yields the parsed *x509.CertPool.
A tls.Config's ClientCAs (and RootCAs) is frozen once the config is in use, so a pool built at startup never sees a CA rotation. Calling the returned function per connection — from GetConfigForClient on the server side — keeps verification current: the parsed pool is cached and the file re-read only when it changes, mirroring Loader, so a rotation is picked up on the next handshake without paying the read and parse cost when nothing changed.
Types ¶
This section is empty.
Source Files