Documentation
¶
Overview ¶
Package certs scans TLS Secrets, Ingress TLS references, and admission webhook caBundles for upcoming expiry. Operators routinely lose service to a cert that nobody had a calendar reminder for; surfacing the soonest expiring cert per cluster in a comparison report removes that surprise.
Index ¶
Constants ¶
const Name = "certs"
Name is the registry key for this scanner.
Variables ¶
This section is empty.
Functions ¶
func NewScanner ¶
NewScanner returns a scanner that enumerates TLS certificates across the cluster. Errors fetching one source do not abort the whole scan; the result reflects whatever was successfully read and is marked StateDegraded with a reason naming any list that failed.
Types ¶
type Cert ¶
type Cert struct {
// Name is the secret or webhook configuration name.
Name string `json:"name"`
// Namespace is empty for cluster-scoped resources (webhook configurations).
Namespace string `json:"namespace,omitempty"`
// Kind is "Secret", "MutatingWebhookConfiguration", or "ValidatingWebhookConfiguration".
Kind string `json:"kind"`
// Subject is the certificate subject common name when parseable.
Subject string `json:"subject,omitempty"`
// NotAfter is when the certificate expires.
NotAfter time.Time `json:"not_after"`
// DaysRemaining is the number of days until expiry.
DaysRemaining int `json:"days_remaining"`
}
Cert describes a single TLS certificate observed in the cluster.
type Data ¶
type Data struct {
// TotalCerts is the number of certificates inspected.
TotalCerts int `json:"total_certs"`
// Critical is the count of certs expiring within criticalDays.
Critical int `json:"critical"`
// Warning is the count of certs expiring within warningDays.
Warning int `json:"warning"`
// Info is the count of certs expiring within infoDays.
Info int `json:"info"`
// Soonest is the lowest DaysRemaining observed; -1 when no certs were found.
Soonest int `json:"soonest_days"`
// Certs lists individual certificate records.
Certs []Cert `json:"certs"`
}
Data holds certificate expiry results for one cluster.