Documentation
¶
Overview ¶
Package secrets generates and defaults all secrets required by the private-cloud Helm chart that are not derived from the installer configuration.
Index ¶
- Variables
- func DeriveDataCenterConfig(primary *files.RootConfig) (*files.RootConfig, error)
- func DeriveDataCenterVault(primary *files.InstallVault) *files.InstallVault
- func EnsureAuthKeys(vault *files.InstallVault) error
- func EnsureCephSSHKeys(vault *files.InstallVault, ceph *files.CephConfig) error
- func EnsureDefaultSecrets(vault *files.InstallVault) error
- func EnsureIngressCA(vault *files.InstallVault, cluster *files.ClusterConfig) error
- func EnsureMounterHmacSecret(vault *files.InstallVault) error
- func EnsureNixSigningKeys(vault *files.InstallVault, host string) error
- func EnsureOpenFgaPresharedKey(vault *files.InstallVault) error
- func EnsurePostgresSecrets(vault *files.InstallVault, postgres *files.PostgresConfig) error
- func EnsurePostgresUsers(vault *files.InstallVault) error
- func EnsureSecrets(vault *files.InstallVault, config *files.RootConfig) error
- func EnsureServiceAccountTokens(vault *files.InstallVault) error
- func EnsureSshWorkspaceProxyHostKey(vault *files.InstallVault) error
- func GenerateCA(cn, country, locality, org string) (keyPEM, certPEM string, err error)
- func GenerateECDSAKeyPair() (privateKey string, publicKey string, err error)
- func GeneratePassword(length int) (string, error)
- func GenerateSSHKeyPair() (privateKey string, publicKey string, err error)
- func GenerateServerCertificate(caKeyPEM, caCertPEM, cn string, ipAddresses []string) (keyPEM, certPEM string, err error)
- func IsDataCenterScopedSecret(name string) bool
- func ParseRSAPrivateKey(keyPEM string) (*rsa.PrivateKey, error)
- func ValidateCertKeyPair(certPEM, keyPEM string) error
Constants ¶
This section is empty.
Variables ¶
var DataCenterScopedSecretNames = []string{ files.SecretSelfSignedCaKeyPem, files.SecretCephSshPrivateKey, files.SecretKubeConfig, files.SecretAcmeEabMacKey, files.SecretPrivNixSigningKey, files.SecretPubNixSigningKey, }
DataCenterScopedSecretNames are the secrets that belong to exactly one data center and must therefore be regenerated for every additional data center of a multi-DC installation.
Everything not listed here (and not matched by DataCenterScopedSecretPrefixes) is shared: the postgres roles because both data centers talk to the same server, and the auth and encryption keys because tokens minted and rows written in one data center are consumed in the other.
var DataCenterScopedSecretPrefixes = []string{"ceph", "csi", "rgw"}
DataCenterScopedSecretPrefixes cover the Ceph cluster credentials that the installer's ceph step writes back into the vault (cephFsId, cephfsAdmin, csiRbdNode, rgwAdminAccessKey, ...). The installer owns those names, so they are matched by prefix rather than enumerated.
Functions ¶
func DeriveDataCenterConfig ¶ added in v1.296.0
func DeriveDataCenterConfig(primary *files.RootConfig) (*files.RootConfig, error)
DeriveDataCenterConfig returns a copy of the primary data center's config with the fields that belong to a single data center reset, so EnsureSecrets fills them in for this data center.
The counterpart of DeriveDataCenterVault: both derive from the primary data center and both run before EnsureSecrets, which regenerates every dropped secret together with the config field paired with it.
func DeriveDataCenterVault ¶ added in v1.296.0
func DeriveDataCenterVault(primary *files.InstallVault) *files.InstallVault
DeriveDataCenterVault returns a copy of the primary data center's vault with all data-center-scoped secrets removed. Running EnsureSecrets over the result regenerates exactly those, while the shared secrets stay byte-identical across data centers.
Derive the config with DeriveDataCenterConfig before running EnsureSecrets, so the config fields paired with the dropped secrets are regenerated along with them.
func EnsureAuthKeys ¶
func EnsureAuthKeys(vault *files.InstallVault) error
EnsureAuthKeys generates RSA-4096 token keys and EC P-256 domain-auth keys in PKCS8/SPKI PEM format if not already present. Each key pair is checked independently.
func EnsureCephSSHKeys ¶
func EnsureCephSSHKeys(vault *files.InstallVault, ceph *files.CephConfig) error
EnsureCephSSHKeys generates the Ceph SSH key pair if not already present in vault. The private key is written to vault; the public key is set on ceph.CephAdmSSHKey.PublicKey.
func EnsureDefaultSecrets ¶
func EnsureDefaultSecrets(vault *files.InstallVault) error
EnsureDefaultSecrets sets dummy defaults for all Helm chart secrets not managed by the installer config. Idempotent: a value the vault already holds is kept.
func EnsureIngressCA ¶
func EnsureIngressCA(vault *files.InstallVault, cluster *files.ClusterConfig) error
EnsureIngressCA generates the cluster ingress CA if not already present in vault. The CA private key is written to vault; the cert PEM is set on cluster.Certificates.CA.CertPem.
func EnsureMounterHmacSecret ¶
func EnsureMounterHmacSecret(vault *files.InstallVault) error
EnsureMounterHmacSecret migrates the legacy 'hmac-secret' to 'mounterHmacSecret' or creates a new 64-character hex secret if neither exists. Idempotent.
func EnsureNixSigningKeys ¶
func EnsureNixSigningKeys(vault *files.InstallVault, host string) error
EnsureNixSigningKeys generates an Ed25519 signing key pair for nix-cache in the format "host:hexKey" if not already present. Idempotent.
func EnsureOpenFgaPresharedKey ¶ added in v1.308.0
func EnsureOpenFgaPresharedKey(vault *files.InstallVault) error
EnsureOpenFgaPresharedKey generates the preshared key that OpenFGA and the Codesphere services authenticate with, as 64 hex characters. Idempotent.
One OpenFGA instance serves a whole installation, so this key is shared rather than per-data-center: every data center's vault must hold the same value, copied over from the one that deploys OpenFGA.
func EnsurePostgresSecrets ¶
func EnsurePostgresSecrets(vault *files.InstallVault, postgres *files.PostgresConfig) error
EnsurePostgresSecrets generates all postgres certificates and passwords if not already present in vault (sentinel: postgresPassword). Private keys and passwords are written to vault; cert PEMs are set on the postgres config struct for inclusion in the config YAML.
func EnsurePostgresUsers ¶ added in v1.199.2
func EnsurePostgresUsers(vault *files.InstallVault) error
func EnsureSecrets ¶
func EnsureSecrets(vault *files.InstallVault, config *files.RootConfig) error
EnsureSecrets generates all secrets required by the Helm chart that are not derived from the installer configuration. Each sub-function is idempotent; the whole call is safe to repeat on an already-populated vault.
func EnsureServiceAccountTokens ¶
func EnsureServiceAccountTokens(vault *files.InstallVault) error
EnsureServiceAccountTokens signs RS512 JWTs for all Codesphere internal service accounts and stores them in vault. Requires tokenPrivateKey to already be present (call EnsureAuthKeys first). Idempotent: skips if authServiceUserToken already exists.
func EnsureSshWorkspaceProxyHostKey ¶ added in v1.211.3
func EnsureSshWorkspaceProxyHostKey(vault *files.InstallVault) error
EnsureSshWorkspaceProxyHostKey generates the SSH host key for the SSH workspace proxy if not already present in vault. Only the private key is stored (as key.pem); the matching public key is derived by the proxy at runtime.
func GenerateCA ¶
GenerateCA generates a self-signed RSA-2048 CA certificate.
func GenerateECDSAKeyPair ¶
func GeneratePassword ¶
func GenerateSSHKeyPair ¶
func GenerateServerCertificate ¶
func GenerateServerCertificate(caKeyPEM, caCertPEM, cn string, ipAddresses []string) (keyPEM, certPEM string, err error)
GenerateServerCertificate generates an RSA-4096 server certificate signed by the given CA. The CA private key may be in either PKCS8 ("PRIVATE KEY") or PKCS1 ("RSA PRIVATE KEY") PEM format to support legacy vaults that were created before the PKCS8 migration.
func IsDataCenterScopedSecret ¶ added in v1.296.0
IsDataCenterScopedSecret reports whether a vault entry belongs to a single data center.
func ParseRSAPrivateKey ¶ added in v1.197.1
func ParseRSAPrivateKey(keyPEM string) (*rsa.PrivateKey, error)
ParseRSAPrivateKey decodes a PEM block and parses an RSA private key in either PKCS8 or legacy PKCS1 format.
func ValidateCertKeyPair ¶
ValidateCertKeyPair verifies that a PEM-encoded certificate's public key matches a PEM-encoded private key.
Types ¶
This section is empty.
Source Files