Documentation
¶
Index ¶
- type CredentialProvider
- func (p *CredentialProvider) CertificateProvider() (sign.CertificateProvider, *sign.CertificateProviderOptions)
- func (p *CredentialProvider) Close() error
- func (p *CredentialProvider) Intermediates() []*x509.Certificate
- func (p *CredentialProvider) Keypair() sign.Keypair
- func (p *CredentialProvider) Prepare(ctx context.Context) error
- type Options
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CredentialProvider ¶
type CredentialProvider struct {
Options Options
// Source is the SVID source used by the keypair and cert provider. When
// nil, Prepare opens a workloadapi.X509Source against Options.SocketPath.
// Tests inject a fake source to exercise the provider without a running
// Workload API.
Source x509svid.Source
// contains filtered or unexported fields
}
CredentialProvider implements bundle.CredentialProvider using X.509-SVIDs from the SPIFFE Workload API. The Workload API stream is opened at Prepare time and rotates automatically; callers should invoke Close when done.
func NewCredentialProvider ¶
func NewCredentialProvider(opts Options) *CredentialProvider
NewCredentialProvider creates a SPIFFE CredentialProvider with the given options.
func (*CredentialProvider) CertificateProvider ¶
func (p *CredentialProvider) CertificateProvider() (sign.CertificateProvider, *sign.CertificateProviderOptions)
CertificateProvider returns the provider that yields the current SVID leaf. No provider options are required for the SPIFFE path.
func (*CredentialProvider) Close ¶
func (p *CredentialProvider) Close() error
Close releases any workloadapi.X509Source opened by Prepare. Sources injected by callers are not closed here — the caller owns their lifecycle.
func (*CredentialProvider) Intermediates ¶
func (p *CredentialProvider) Intermediates() []*x509.Certificate
Intermediates returns the certs between the SVID leaf and the trust domain root, taken from the current SVID. The trust anchor itself is NOT included — verifiers pin it out-of-band.
func (*CredentialProvider) Keypair ¶
func (p *CredentialProvider) Keypair() sign.Keypair
Keypair returns the sign.Keypair backed by the SVID private key.
type Options ¶
type Options struct {
// SocketPath is the Workload API endpoint (typically "unix:///...").
// When empty, go-spiffe reads SPIFFE_ENDPOINT_SOCKET from the environment.
SocketPath string
// ExpectedTrustDomain, when non-zero, asserts that the issued SVID
// belongs to this trust domain. Mismatch causes Prepare to fail.
ExpectedTrustDomain spiffeid.TrustDomain
}
Options configures a SPIFFE CredentialProvider.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package verifier validates SPIFFE-signed bundles against a pinned SPIRE trust root and enforces SPIFFE identity matchers on the SVID leaf.
|
Package verifier validates SPIFFE-signed bundles against a pinned SPIRE trust root and enforces SPIFFE identity matchers on the SVID leaf. |