Documentation
¶
Overview ¶
Package selfmanaged provides a TLSBackend that generates and manages CA and leaf certificates using Go's crypto/x509 standard library. It supports multi-cycle CA rotation via the WorkflowStep saga.
Index ¶
- Constants
- func BuildCA(namespace, secretName string, spec certificate.TLSSpec) (*corev1.Secret, *ecdsa.PrivateKey, *x509.Certificate, error)
- func CANeedsRenewal(caSecret *corev1.Secret, spec certificate.TLSSpec, now time.Time) (bool, error)
- func ParseCA(caSecret *corev1.Secret) (*x509.Certificate, *ecdsa.PrivateKey, error)
- func SignLeaf(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, spec certificate.TLSSpec) (leafCertPEM, leafKeyPEM []byte, err error)
- type SelfManagedBackend
- func (b *SelfManagedBackend[T]) CertificateSecretName(o T, spec certificate.TLSSpec) string
- func (b *SelfManagedBackend[T]) DesiredLeafWithCA(ctx context.Context, o T, spec certificate.TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)
- func (b *SelfManagedBackend[T]) DesiredObjects(ctx context.Context, o T, spec certificate.TLSSpec) ([]client.Object, error)
- func (b *SelfManagedBackend[T]) LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec certificate.TLSSpec, ...) (certificate.LeafChange, error)
- func (b *SelfManagedBackend[T]) RequiresRotationSaga() bool
Constants ¶
const ( // CASecretSuffix is appended to the SecretName for the CA certificate Secret. CASecretSuffix = "-ca" // CAKey is the key in the Secret data for the CA certificate PEM. CAKey = "ca.crt" // CertKey is the key in the Secret data for the leaf certificate PEM. CertKey = "tls.crt" // KeyKey is the key in the Secret data for the private key PEM. KeyKey = "tls.key" // CAKeyPrivate is the key for the CA private key PEM (kept in a separate Secret). CAKeyPrivate = "ca.key" // CRLKey is the key in the CA Secret data for the DER-encoded CRL. CRLKey = "ca.crl" )
Variables ¶
This section is empty.
Functions ¶
func BuildCA ¶ added in v3.0.4
func BuildCA(namespace, secretName string, spec certificate.TLSSpec) (*corev1.Secret, *ecdsa.PrivateKey, *x509.Certificate, error)
BuildCA generates a fresh CA key + self-signed CA certificate and returns the CA Secret (name secretName+CASecretSuffix), the CA private key, and the parsed CA certificate. When spec.GenerateCRL, ca.crl is added to the Secret.
func CANeedsRenewal ¶ added in v3.0.4
CANeedsRenewal reports whether the CA Secret's ca.crt needs renewal at now.
- nil secret -> true (missing CA).
- ca.crt absent/empty -> true.
- ca.crt malformed -> error.
- within GetValidRenewalDays(spec) of NotAfter -> true; else false.
func ParseCA ¶ added in v3.0.4
func ParseCA(caSecret *corev1.Secret) (*x509.Certificate, *ecdsa.PrivateKey, error)
ParseCA parses a CA Secret's ca.crt (first cert) and ca.key (EC private key).
func SignLeaf ¶ added in v3.0.4
func SignLeaf(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, spec certificate.TLSSpec) (leafCertPEM, leafKeyPEM []byte, err error)
SignLeaf generates a new leaf key + certificate signed by caKey/caCert and returns the PEM-encoded leaf cert and private key. Validity uses GetValidLeafDays; SANs/CN/O come from spec.
Types ¶
type SelfManagedBackend ¶
type SelfManagedBackend[T object.MultiPhaseObject] struct{}
SelfManagedBackend is a TLSBackend that generates CA and leaf certificates using Go's crypto/x509 standard library.
func NewSelfManagedBackend ¶
func NewSelfManagedBackend[T object.MultiPhaseObject]() *SelfManagedBackend[T]
NewSelfManagedBackend creates a new self-managed backend.
func (*SelfManagedBackend[T]) CertificateSecretName ¶
func (b *SelfManagedBackend[T]) CertificateSecretName(o T, spec certificate.TLSSpec) string
CertificateSecretName returns the name of the leaf certificate Secret.
func (*SelfManagedBackend[T]) DesiredLeafWithCA ¶ added in v3.0.4
func (b *SelfManagedBackend[T]) DesiredLeafWithCA(ctx context.Context, o T, spec certificate.TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)
DesiredLeafWithCA re-issues the leaf signed by the CA in caSecret, reusing that CA's key/cert (no new CA). The returned Secret's ca.crt equals caSecret's ca.crt (single CA, no bundle).
func (*SelfManagedBackend[T]) DesiredObjects ¶
func (b *SelfManagedBackend[T]) DesiredObjects(ctx context.Context, o T, spec certificate.TLSSpec) ([]client.Object, error)
DesiredObjects generates CA and leaf certificates and returns them as Kubernetes Secret objects for SSA reconciliation.
func (*SelfManagedBackend[T]) LeafNeedsChange ¶ added in v3.0.4
func (b *SelfManagedBackend[T]) LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec certificate.TLSSpec, now time.Time) (certificate.LeafChange, error)
LeafNeedsChange reports whether the leaf Secret needs regeneration vs spec at now, with single-cert semantics.
func (*SelfManagedBackend[T]) RequiresRotationSaga ¶
func (b *SelfManagedBackend[T]) RequiresRotationSaga() bool
RequiresRotationSaga returns true for the self-managed backend.
Source Files
Directories