Documentation
¶
Overview ¶
Package credbundle handles credential bundle files written by Kubernetes Pod Certificates.
A credential bundle is a single file with multiple PEM entries. The first entry is a PRIVATE KEY block, and all remaining entries are CERTIFICATE blocks. The CERTIFICATE blocks are in leaf-to-root order, and may or may not include the root.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClientLoader ¶ added in v0.1.0
func ClientLoader(path string) func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
ClientLoader is the client-side counterpart to Loader. It returns a function suitable for use as GetClientCertificate in a tls.Config, caching the parsed bundle in the same way so that pod-certificate rotations are picked up on the next handshake.
func Loader ¶
func Loader(path string) func(*tls.ClientHelloInfo) (*tls.Certificate, error)
Loader reads a private key and certificate chain from a credential bundle file as written by the Kubernetes Pod Certificates mechanism.
Returns a function that can be used as GetCertificate in a tls.Config. The parsed bundle is cached: each handshake stats the file and re-reads it only when the file has changed, so pod-certificate rotations are picked up on the next handshake without paying the read and parse cost when nothing changed.
Types ¶
This section is empty.
Source Files