secrets

func CacheDir ¶

func CacheDir() (string, error)

CacheDir returns the on-disk secrets cache directory, creating it if it does not yet exist. The path is resolved at call time so $EDUCATES_CLI_DATA_HOME (and tests using t.Setenv) take effect.

func GenerateSelfSignedCA ¶

func GenerateSelfSignedCA(commonName string) (certPEM, keyPEM []byte, err error)

GenerateSelfSignedCA produces a fresh self-signed CA certificate + private key suitable for the EducatesLocalConfig laptop flow. cert-manager's CA-typed ClusterIssuer signs workshop certs from it.

Choices:

• RSA 2048 — broad cert-manager + browser compatibility, fast on a laptop, no transitive Go-toolchain concerns.
• 10-year validity — laptops live longer than 1 year, expiry surprises are annoying, and the trust is scoped to one user's keychain so the wide window is acceptable.
• CommonName + Organization carry "educates" so the cert is visually identifiable in browser cert UIs.
• KeyUsageCertSign + IsCA + BasicConstraintsValid so cert-manager can sign downstream leaf certs.

func ListCachedSecretNames ¶

func ListCachedSecretNames() ([]string, error)

ListCachedSecretNames returns the names (without the .yaml suffix) of all secrets in the cache, sorted. The cache directory is created if needed.

func LoadCachedSecret ¶

func LoadCachedSecret(name string) (*apiv1.Secret, error)

LoadCachedSecret reads and decodes the cached secret named name. It returns a clear "no secret named" error when the secret is not cached, so callers can surface that directly.

func LocalCachedSecretForCertificateAuthority ¶

func LocalCachedSecretForCertificateAuthority(domain string) string

func LocalCachedSecretForIngressDomain ¶

func LocalCachedSecretForIngressDomain(domain string) string

func NewCASecret ¶

func NewCASecret(name string, certPEM, keyPEM []byte, ingressDomain string) *apiv1.Secret

NewCASecret builds the Secret for a signing CA. In the v4 CustomCA flow cert-manager signs workshop certificates from this CA, so it carries both tls.crt and tls.key and is structurally a kubernetes.io/tls secret — identical in shape to NewTLSSecret.

func NewDockerRegistrySecret ¶

func NewDockerRegistrySecret(name, server, username, password, email string) *apiv1.Secret

NewDockerRegistrySecret builds a kubernetes.io/dockerconfigjson Secret holding credentials for a single registry server.

func NewTLSSecret ¶

func NewTLSSecret(name string, certPEM, keyPEM []byte, ingressDomain string) *apiv1.Secret

NewTLSSecret builds a kubernetes.io/tls Secret from PEM-encoded cert and key bytes. When ingressDomain is non-empty it is recorded in the training.educates.dev/domain annotation so the lookup helpers can match the secret to a wildcard ingress domain.

func RemoveCachedSecret ¶

func RemoveCachedSecret(name string) error

RemoveCachedSecret deletes the cached secret named name. Removing a secret that is not cached is not an error.

func SyncLocalCachedSecretsToCluster ¶

func SyncLocalCachedSecretsToCluster(client *kubernetes.Clientset) error

*

• SyncSecretsToCluster copies secrets from the local cache to the cluster.

func ValidateSecretName ¶

func ValidateSecretName(name string) error

ValidateSecretName reports whether name is a valid local secret name, returning a descriptive error (naming the offending value and the allowed pattern) when it is not. Commands call this from their cobra Args validator so an invalid name is rejected before any work runs.

func WriteCachedSecret ¶

func WriteCachedSecret(secret *apiv1.Secret) error

WriteCachedSecret marshals secret to YAML and writes it to the cache as <name>.yaml, replacing any existing file of that name.