selfmanaged

package
v3.0.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 21, 2026 License: MIT Imports: 18 Imported by: 0

Documentation

Overview

Package selfmanaged provides a TLSBackend that generates and manages CA and leaf certificates using Go's crypto/x509 standard library. It supports multi-cycle CA rotation via the WorkflowStep saga.

Index

Constants

View Source 
const (
	// CASecretSuffix is appended to the SecretName for the CA certificate Secret.
	CASecretSuffix = "-ca"

	// CAKey is the key in the Secret data for the CA certificate PEM.
	CAKey = "ca.crt"

	// CertKey is the key in the Secret data for the leaf certificate PEM.
	CertKey = "tls.crt"

	// KeyKey is the key in the Secret data for the private key PEM.
	KeyKey = "tls.key"

	// CAKeyPrivate is the key for the CA private key PEM (kept in a separate Secret).
	CAKeyPrivate = "ca.key"

	// CRLKey is the key in the CA Secret data for the DER-encoded CRL.
	CRLKey = "ca.crl"
)

Variables

This section is empty.

Functions

func BuildCA added in v3.0.4 

func BuildCA(namespace, secretName string, spec certificate.TLSSpec) (*corev1.Secret, *ecdsa.PrivateKey, *x509.Certificate, error)

BuildCA generates a fresh ECDSA CA key + self-signed CA certificate and returns the CA Secret (name secretName+CASecretSuffix), the CA private key, and the parsed CA certificate. When spec.GenerateCRL, ca.crl is added.

This is the ECDSA wrapper around BuildCASigner; it errors if spec requests a non-ECDSA key algorithm.

func BuildCASigner added in v3.0.6 

func BuildCASigner(namespace, secretName string, spec certificate.TLSSpec) (*corev1.Secret, crypto.Signer, *x509.Certificate, error)

BuildCASigner generates a fresh CA key (ECDSA or RSA per spec) + self-signed CA certificate and returns the CA Secret, the CA crypto.Signer, and the parsed CA certificate. The CA subject is spec.ResolvedCASubject(); its key usage is fixed at CertSign|CRLSign.

func CAContentChanged added in v3.0.6 

func CAContentChanged(caSecret *corev1.Secret, spec certificate.TLSSpec) (bool, error)

CAContentChanged reports whether the CA cert's subject, public-key algorithm or public-key size differs from spec (used to trigger a CA saga on content change, not just expiry). For ECDSA the public-key size is implied by the curve, and for RSA it is the modulus length; in both cases a requested key-strength change must rotate the CA so the operator's hardening intent is actually applied rather than silently ignored.

func CANeedsRenewal added in v3.0.4 

func CANeedsRenewal(caSecret *corev1.Secret, spec certificate.TLSSpec, now time.Time) (bool, error)

CANeedsRenewal reports whether the CA Secret's ca.crt needs renewal at now.

  • nil secret -> true (missing CA).
  • ca.crt absent/empty -> true.
  • ca.crt malformed -> error.
  • within GetValidRenewalDays(spec) of NotAfter -> true; else false.

func KeyChanged added in v3.0.6 

func KeyChanged(spec certificate.TLSSpec, cert *x509.Certificate) (bool, error)

KeyChanged reports whether cert's public-key algorithm or bit size differs from spec.

func OrganizationsEqual added in v3.0.6 

func OrganizationsEqual(spec certificate.TLSSpec, cert *x509.Certificate) bool

OrganizationsEqual reports whether cert's Organization RDN matches spec's effective leaf organizations (order-insensitive, empty treated as absent).

func ParseCA added in v3.0.4 

func ParseCA(caSecret *corev1.Secret) (*x509.Certificate, *ecdsa.PrivateKey, error)

ParseCA parses a CA Secret's ca.crt (first cert) and ca.key (EC private key). This is the ECDSA wrapper around ParseCASigner; it errors if the stored key is not an EC key.

func ParseCASigner added in v3.0.6 

func ParseCASigner(caSecret *corev1.Secret) (*x509.Certificate, crypto.Signer, error)

ParseCASigner parses a CA Secret's ca.crt (first cert) and ca.key (EC or RSA private key) and returns the parsed CA certificate and crypto.Signer.

func SignLeaf added in v3.0.4 

func SignLeaf(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, spec certificate.TLSSpec) (leafCertPEM, leafKeyPEM []byte, err error)

SignLeaf generates a new leaf key + certificate signed by caKey/caCert and returns the PEM-encoded leaf cert and private key. The leaf key algorithm follows spec (ECDSA or RSA), not always ECDSA; this simply delegates to SignLeafSigner.

func SignLeafSigner added in v3.0.6 

func SignLeafSigner(caCert *x509.Certificate, caSigner crypto.Signer, spec certificate.TLSSpec) (leafCertPEM, leafKeyPEM []byte, err error)

SignLeafSigner generates a new leaf key (ECDSA or RSA per spec) + certificate signed by caCert/caSigner and returns the PEM-encoded leaf cert and private key. Subject, key algorithm/size, usages and SANs all come from spec.

func SubjectRestEqual added in v3.0.6 

func SubjectRestEqual(a, b pkix.Name) bool

SubjectRestEqual compares every RDN field except CommonName and Organization.

func UsagesChanged added in v3.0.6 

func UsagesChanged(spec certificate.TLSSpec, cert *x509.Certificate) (bool, error)

UsagesChanged reports whether cert's KeyUsage/ExtKeyUsage differ from spec.

Types

type SelfManagedBackend 

type SelfManagedBackend[T object.MultiPhaseObject] struct{}

SelfManagedBackend is a TLSBackend that generates CA and leaf certificates using Go's crypto/x509 standard library.

func NewSelfManagedBackend 

func NewSelfManagedBackend[T object.MultiPhaseObject]() *SelfManagedBackend[T]

NewSelfManagedBackend creates a new self-managed backend.

func (*SelfManagedBackend[T]) CertificateSecretName 

func (b *SelfManagedBackend[T]) CertificateSecretName(o T, spec certificate.TLSSpec) string

CertificateSecretName returns the name of the leaf certificate Secret.

func (*SelfManagedBackend[T]) DesiredLeafWithCA added in v3.0.4 

func (b *SelfManagedBackend[T]) DesiredLeafWithCA(ctx context.Context, o T, spec certificate.TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)

DesiredLeafWithCA re-issues the leaf signed by the CA in caSecret, reusing that CA's key/cert (no new CA). The returned Secret's ca.crt equals caSecret's ca.crt (single CA, no bundle).

func (*SelfManagedBackend[T]) DesiredObjects 

func (b *SelfManagedBackend[T]) DesiredObjects(ctx context.Context, o T, spec certificate.TLSSpec) ([]client.Object, error)

DesiredObjects generates CA and leaf certificates and returns them as Kubernetes Secret objects for SSA reconciliation.

func (*SelfManagedBackend[T]) LeafNeedsChange added in v3.0.4 

func (b *SelfManagedBackend[T]) LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec certificate.TLSSpec, now time.Time) (certificate.LeafChange, error)

LeafNeedsChange reports whether the leaf Secret needs regeneration vs spec at now, with single-cert semantics.

func (*SelfManagedBackend[T]) RequiresRotationSaga 

func (b *SelfManagedBackend[T]) RequiresRotationSaga() bool

RequiresRotationSaga returns true for the self-managed backend.

Source Files

View all Source files

Directories

Path Synopsis
Package pernode provides a TLSBackend that keeps one certificate per node in a single Secret (multi-cert transport TLS, e.g.
 Package pernode provides a TLSBackend that keeps one certificate per node in a single Secret (multi-cert transport TLS, e.g.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.