Documentation
¶
Overview ¶
Package pernode provides a TLSBackend that keeps one certificate per node in a single Secret (multi-cert transport TLS, e.g. Elasticsearch transport).
Index ¶
- Constants
- type NodeSpecProvider
- type PerNodeBackend
- func (b *PerNodeBackend[T]) CertificateSecretName(o T, spec certificate.TLSSpec) string
- func (b *PerNodeBackend[T]) DesiredLeafWithCA(ctx context.Context, o T, spec certificate.TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)
- func (b *PerNodeBackend[T]) DesiredObjects(ctx context.Context, o T, spec certificate.TLSSpec) ([]client.Object, error)
- func (b *PerNodeBackend[T]) ExpectedNodeNames(o T) ([]string, error)
- func (b *PerNodeBackend[T]) LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec certificate.TLSSpec, ...) (certificate.LeafChange, error)
- func (b *PerNodeBackend[T]) NodeSecretKeys() (certSuffix, keySuffix string)
- func (b *PerNodeBackend[T]) RequiresRotationSaga() bool
Constants ¶
const ( // NodeCertSuffix is appended to a node name for its certificate Data key. NodeCertSuffix = ".crt" // NodeKeySuffix is appended to a node name for its private-key Data key. NodeKeySuffix = ".key" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type NodeSpecProvider ¶
type NodeSpecProvider[T object.MultiPhaseObject] interface { // ExpectedNodeNames returns the node names that should have a certificate. ExpectedNodeNames(o T) ([]string, error) // NodeCertSpec returns the CN/DNS/IP SANs for one node's certificate. NodeCertSpec(o T, nodeName string) (cn string, dnsNames []string, ips []string, err error) }
NodeSpecProvider supplies per-node certificate parameters. Operator-implemented.
type PerNodeBackend ¶
type PerNodeBackend[T object.MultiPhaseObject] struct { // contains filtered or unexported fields }
PerNodeBackend emits a CA Secret (<secretName>-ca) plus a single Opaque leaf Secret (<secretName>) with ca.crt and one <node>.crt/<node>.key pair per node.
func NewPerNodeBackend ¶
func NewPerNodeBackend[T object.MultiPhaseObject](provider NodeSpecProvider[T]) *PerNodeBackend[T]
NewPerNodeBackend creates a new per-node backend with the given provider.
func (*PerNodeBackend[T]) CertificateSecretName ¶
func (b *PerNodeBackend[T]) CertificateSecretName(o T, spec certificate.TLSSpec) string
CertificateSecretName returns the name of the leaf certificate Secret.
func (*PerNodeBackend[T]) DesiredLeafWithCA ¶
func (b *PerNodeBackend[T]) DesiredLeafWithCA(ctx context.Context, o T, spec certificate.TLSSpec, caSecret *corev1.Secret) (*corev1.Secret, error)
DesiredLeafWithCA re-issues all expected nodes' certs with the existing CA (no new CA), returning the Opaque leaf Secret whose ca.crt equals the CA secret's ca.crt.
func (*PerNodeBackend[T]) DesiredObjects ¶
func (b *PerNodeBackend[T]) DesiredObjects(ctx context.Context, o T, spec certificate.TLSSpec) ([]client.Object, error)
DesiredObjects generates a fresh CA and one cert/key pair per expected node.
func (*PerNodeBackend[T]) ExpectedNodeNames ¶
func (b *PerNodeBackend[T]) ExpectedNodeNames(o T) ([]string, error)
ExpectedNodeNames delegates to the provider.
func (*PerNodeBackend[T]) LeafNeedsChange ¶
func (b *PerNodeBackend[T]) LeafNeedsChange(ctx context.Context, o T, leafSecret *corev1.Secret, spec certificate.TLSSpec, now time.Time) (certificate.LeafChange, error)
LeafNeedsChange reports whether the per-node leaf Secret needs regeneration vs spec at now.
func (*PerNodeBackend[T]) NodeSecretKeys ¶
func (b *PerNodeBackend[T]) NodeSecretKeys() (certSuffix, keySuffix string)
NodeSecretKeys returns the cert and key Data-key suffixes.
func (*PerNodeBackend[T]) RequiresRotationSaga ¶
func (b *PerNodeBackend[T]) RequiresRotationSaga() bool
RequiresRotationSaga returns true for the per-node backend.
Source Files