certs

type CertType string

type KeyPair struct {
	// The private key PEM block
	Private []byte

	// The certificate PEM block
	Certificate []byte
}

type PublicKeyInfrastructure struct {
	// Where to store the certificates
	CertDir string

	// The name of the secret where the CA certificate will be stored
	CaSecretName string

	// The name of the secret where the certificates will be stored
	SecretName string

	// The name of the service where the webhook server will be reachable
	ServiceName string

	// The name of the namespace where the operator is set up
	OperatorNamespace string

	// The name of the mutating webhook configuration in k8s, used to
	// inject the caBundle
	MutatingWebhookConfigurationName string

	// The name of the validating webhook configuration in k8s, used
	// to inject the caBundle
	ValidatingWebhookConfigurationName string

	// The labelSelector to be used to get the operators deployment,
	// e.g. "app.kubernetes.io/name=cloudnative-pg"
	OperatorDeploymentLabelSelector string

	// ManageWebhookConfigurations controls whether the operator injects the CA
	// bundle into the mutating and validating webhook configurations. When
	// false, the serving certificate is still managed but the webhook
	// configurations are left untouched, as they are managed externally.
	ManageWebhookConfigurations bool
}

type TLSConfigOptions struct {
	// Client is the Kubernetes client used to fetch the CA secret.
	Client client.Client

	// CASecret is the namespaced name of the secret containing the server CA certificate.
	CASecret types.NamespacedName

	// ClientCert is the certificate presented to the server during the TLS handshake.
	// Pass nil when the caller does not need to authenticate itself (e.g. isolation
	// probes, diagnostic commands).
	ClientCert *tls.Certificate
}