certificates

func EnqueueCertificatesForResourceUsingPredicates ¶ added in v1.8.0

func EnqueueCertificatesForResourceUsingPredicates[U metav1.Object](
	log logr.Logger, queue workqueue.TypedInterface[types.NamespacedName],
	lister cmlisters.CertificateLister,
	predicateBuilders ...predicate.ExtractorFunc[*cmapi.Certificate, U],
) func(metav1.Object)

EnqueueCertificatesForResourceUsingPredicates will return a function that can be used as an OnAdd handler for a SharedIndexInformer. It should be used as a handler for resources that are referenced in some way by Certificates. The namespace of the object being processed will be used in the List call when enqueuing Certificate resources. If no predicate constructors are given, all Certificate resources will be enqueued on every invocation.

func GetNextPrivateKeySecret ¶ added in v1.21.3

func GetNextPrivateKeySecret(lister corelisters.SecretNamespaceLister, crt *cmapi.Certificate) (*corev1.Secret, error)

GetNextPrivateKeySecret returns the Secret named by crt.Status.NextPrivateKeySecretName, but only if IsNextPrivateKeySecret accepts it. An unset or empty name is reported as not found.

The name alone must not be trusted. status.nextPrivateKeySecretName is writable by any principal with access to the certificates/status subresource, which is a weaker permission than reading Secrets in the namespace. Without this check, such a principal can name any Secret in the namespace and have its private key copied into spec.secretName.

A Secret that exists but fails these checks is reported as not found, so that callers wait for the keymanager controller to reconcile the field back to a Secret it owns, exactly as they do when the Secret is absent.

The lookup is a label-selected LIST rather than a GET by name so that a Secret the keymanager did not create is never read from the API server: the filtered lister answers a GET for an unlabeled Secret with a live request that returns the whole Secret, private key included.

func IsNextPrivateKeySecret ¶ added in v1.21.3

func IsNextPrivateKeySecret(secret *corev1.Secret, crt *cmapi.Certificate) bool

IsNextPrivateKeySecret reports whether secret is one the keymanager controller created for crt: it must carry the `cert-manager.io/next-private-key` label, have crt as its controller, and not be the Secret named by spec.secretName.

The last check is needed because spec.secretTemplate.labels can put the label on spec.secretName, and --enable-certificate-owner-ref gives that Secret the controller reference. Without it the keymanager would treat the served certificate Secret as a temporary private key Secret and delete it.

Every consumer of status.nextPrivateKeySecretName relies on this check, so it lives in one place.

func ListCertificateRequestsMatchingPredicates ¶ added in v1.8.0

func ListCertificateRequestsMatchingPredicates(lister cmlisters.CertificateRequestNamespaceLister, predicates ...predicate.Func[*cmapi.CertificateRequest]) ([]*cmapi.CertificateRequest, error)

ListCertificateRequestsMatchingPredicates will list CertificateRequest resources using the provided lister, optionally applying the given predicate functions to filter the CertificateRequest resources returned.

func ListCertificatesMatchingPredicates ¶ added in v1.8.0

func ListCertificatesMatchingPredicates(lister cmlisters.CertificateNamespaceLister, selector labels.Selector, predicates ...predicate.Func[*cmapi.Certificate]) ([]*cmapi.Certificate, error)

ListCertificatesMatchingPredicates will list Certificate resources using the provided lister, optionally applying the given predicate functions to filter the Certificate resources returned.

func ListNextPrivateKeySecrets ¶ added in v1.21.3

func ListNextPrivateKeySecrets(lister corelisters.SecretNamespaceLister, crt *cmapi.Certificate) ([]*corev1.Secret, error)

ListNextPrivateKeySecrets returns every Secret that IsNextPrivateKeySecret accepts for crt.

func ListSecretsMatchingPredicates ¶ added in v1.8.0

func ListSecretsMatchingPredicates(lister corelisters.SecretNamespaceLister, selector labels.Selector, predicates ...predicate.Func[*corev1.Secret]) ([]*corev1.Secret, error)

ListSecretsMatchingPredicates will list Secret resources using the provided lister, optionally applying the given predicate functions to filter the Secret resources returned.