Documentation
¶
Index ¶
- Variables
- func NewClient(params params) out
- func NewFakeClient() identity.Provider
- type Client
- func (c *Client) Delete(ctx context.Context, id string) error
- func (c *Client) DeleteBatch(ctx context.Context, ids []string) error
- func (c *Client) GetSpireEntryConfig() SpireEntryConfig
- func (c *Client) GetSpireTrustDomain() string
- func (c *Client) Initialized() <-chan struct{}
- func (c *Client) List(ctx context.Context) ([]string, error)
- func (c *Client) Upsert(ctx context.Context, id string) error
- func (c *Client) UpsertBatch(ctx context.Context, ids []string) error
- type ClientConfig
- type MutualAuthConfig
- type SpireEntryConfig
Constants ¶
This section is empty.
Variables ¶
var Cell = cell.Module( "spire-client", "Spire Server API Client", cell.Config(defaultMutualAuthConfig), cell.Config(defaultClientConfig), cell.Provide(func(zfg ztunnel.Config) SpireEntryConfig { if zfg.EnableZTunnel { return ZtunnelSpireEntryConfig() } return DefaultSpireEntryConfig() }), cell.Provide(NewClient), )
Cell is the cell for the SPIRE client.
var FakeCellClient = cell.Module( "fake-spire-client", "Fake Spire Server API Client", cell.Config(defaultMutualAuthConfig), cell.Config(defaultClientConfig), cell.Provide(DefaultSpireEntryConfig), cell.Provide(NewFakeClient), )
Functions ¶
func NewClient ¶
func NewClient(params params) out
NewClient creates a new SPIRE client. If the mutual authentication is not enabled, it returns a noop client. When ztunnel is enabled, the client is still created but the identity.Provider returned is a noop since ztunnel handles identity differently.
func NewFakeClient ¶
NewFakeClient creates a new fake SPIRE client.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func (*Client) Delete ¶
Delete deletes the SPIFFE ID for the given ID. The SPIFFE ID path is determined by the SpireEntryConfig.
func (*Client) DeleteBatch ¶ added in v1.19.4
DeleteBatch deletes multiple SPIFFE entries at once. It lists all entries by parent ID, filters to the requested IDs, and deletes in batches. This is more efficient than looking up each entry individually.
func (*Client) GetSpireEntryConfig ¶ added in v1.19.4
func (c *Client) GetSpireEntryConfig() SpireEntryConfig
GetSpireEntryConfig returns the SPIRE entry configuration.
func (*Client) GetSpireTrustDomain ¶ added in v1.19.4
GetSpireTrustDomain returns the SPIFFE trust domain.
func (*Client) Initialized ¶ added in v1.19.4
func (c *Client) Initialized() <-chan struct{}
Initialized returns a channel that is closed when the client is initialized.
type ClientConfig ¶
type ClientConfig struct {
SpireAgentSocketPath string `mapstructure:"mesh-auth-spire-agent-socket"`
SpireServerAddress string `mapstructure:"mesh-auth-spire-server-address"`
SpireServerConnectionTimeout time.Duration `mapstructure:"mesh-auth-spire-server-connection-timeout"`
SpiffeTrustDomain string `mapstructure:"mesh-auth-spiffe-trust-domain"`
}
ClientConfig contains the configuration for the SPIRE client.
func (ClientConfig) Flags ¶
func (cfg ClientConfig) Flags(flags *pflag.FlagSet)
Flags adds the flags used by ClientConfig.
type MutualAuthConfig ¶ added in v1.17.2
type MutualAuthConfig struct {
Enabled bool `mapstructure:"mesh-auth-mutual-enabled"`
}
MutualAuthConfig contains general configuration for mutual authentication.
func (MutualAuthConfig) Flags ¶ added in v1.17.2
func (cfg MutualAuthConfig) Flags(flags *pflag.FlagSet)
Flags adds the flags used by ClientConfig.
type SpireEntryConfig ¶ added in v1.19.4
type SpireEntryConfig struct {
ParentID string
PathFunc func(string) string
SelectorsFunc func(string) []*types.Selector
}
SpireEntryConfig contains the configuration for SPIRE entry generation. This allows the SPIRE client to be configured for different use cases such as mutual-auth or ztunnel.
func DefaultSpireEntryConfig ¶ added in v1.19.4
func DefaultSpireEntryConfig() SpireEntryConfig
DefaultSpireEntryConfig returns the default SpireEntryConfig for mutual-auth mode.
func ZtunnelSpireEntryConfig ¶ added in v1.19.4
func ZtunnelSpireEntryConfig() SpireEntryConfig
ZtunnelSpireEntryConfig returns the SpireEntryConfig for ztunnel mode. In ztunnel mode: - ParentID is "/ztunnel" - Path format is "/ns/{namespace}/sa/{serviceaccount}" - Selectors are k8s namespace and service account selectors
Source Files