Documentation
¶
Overview ¶
Package tlsconfig provides a generic, app-agnostic client-side TLS configuration builder. It has no controller-runtime or client-library dependencies (stdlib + emperror.dev/errors only); operators feed the resulting *tls.Config or *http.Transport into whichever HTTP client library they use.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertificateOptions ¶
type CertificateOptions struct {
// CACert is the PEM-encoded trusted CA certificate (or bundle).
CACert []byte
// CAPath is a path to a PEM-encoded CA file, resolved by Resolve. Paths
// must come from operator-controlled configuration only (never untrusted
// input): Resolve reads whatever file the path points at.
CAPath string
// ClientCert is the PEM-encoded client certificate.
ClientCert []byte
// ClientKey is the PEM-encoded client private key.
ClientKey []byte
// ClientCertPath is a path to the client certificate file, resolved by
// Resolve. Paths must come from operator-controlled configuration only
// (never untrusted input).
ClientCertPath string
// ClientKeyPath is a path to the client private-key file, resolved by
// Resolve. Paths must come from operator-controlled configuration only
// (never untrusted input).
ClientKeyPath string
// InsecureSkipVerify disables server certificate verification. When true,
// Go's TLS stack skips verification entirely, so any CA certificates set
// via CACert/CAPath are ignored for verification (RootCAs is unused while
// InsecureSkipVerify is set).
InsecureSkipVerify bool
// ServerName is the expected server name for certificate verification.
ServerName string
// MinVersion is the minimum TLS version (tls.VersionTLS*).
MinVersion uint16
// MaxVersion is the maximum TLS version (tls.VersionTLS*).
MaxVersion uint16
// contains filtered or unexported fields
}
CertificateOptions describes the desired client-side TLS material: trusted CA certificate(s), an optional client certificate + key, and common TLS knobs. CA and client material may be supplied inline (PEM bytes) or via file paths resolved by Resolve. The zero value means "no customization".
func (*CertificateOptions) BuildHTTPTransport ¶
func (o *CertificateOptions) BuildHTTPTransport() (*http.Transport, error)
BuildHTTPTransport builds an *http.Transport from the options. When the options are zero (no customization) it returns (nil, nil).
func (*CertificateOptions) BuildTLSConfig ¶
func (o *CertificateOptions) BuildTLSConfig() (*tls.Config, error)
BuildTLSConfig builds a *tls.Config from the options. When the options are zero (no customization) it returns (nil, nil).
func (CertificateOptions) IsZero ¶
func (o CertificateOptions) IsZero() bool
IsZero reports whether the options request no customization. A base TLS config or transport (set via WithBaseTLSConfig/WithBaseTransport) counts as customization, so BuildTLSConfig/BuildHTTPTransport clone it rather than returning (nil, nil).
func (*CertificateOptions) Resolve ¶
func (o *CertificateOptions) Resolve() error
Resolve loads file-based sources (CAPath, ClientCertPath, ClientKeyPath) into their inline counterparts. Nil receiver is a no-op.
func (*CertificateOptions) Validate ¶
func (o *CertificateOptions) Validate() error
Validate checks the option combination. Nil receiver is valid (no-op).
type Option ¶
type Option func(*CertificateOptions)
Option mutates a CertificateOptions.
func WithBaseTLSConfig ¶
WithBaseTLSConfig sets the base *tls.Config that BuildTLSConfig clones and layers the options onto.
func WithBaseTransport ¶
WithBaseTransport sets the base *http.Transport that BuildHTTPTransport clones and layers the TLS config onto.
Source Files
Directories