Directories
¶
| Path | Synopsis |
|---|---|
|
Package certinit implements the init-container side of the CSR flow: name discovery for a Pod, key and CSR generation, submission of a CertificateSigningRequest and the wait for its certificate.
|
Package certinit implements the init-container side of the CSR flow: name discovery for a Pod, key and CSR generation, submission of a CertificateSigningRequest and the wait for its certificate. |
|
Package controller implements the CertificateSigningRequest signing controller of the kubeca command: CertificateSigningRequestSigningReconciler signs every CSR whose signerName maps to a loaded issuer and profile, after the in-process approver has approved it when -approve is enforce (KUBECA-001).
|
Package controller implements the CertificateSigningRequest signing controller of the kubeca command: CertificateSigningRequestSigningReconciler signs every CSR whose signerName maps to a loaded issuer and profile, after the in-process approver has approved it when -approve is enforce (KUBECA-001). |
|
Package k8snames derives the names a Kubernetes Pod may carry in a certificate: its Pod DNS name, the hostname/subdomain name, the names and addresses of the Services that select it, and its SPIFFE ID.
|
Package k8snames derives the names a Kubernetes Pod may carry in a certificate: its Pod DNS name, the hostname/subdomain name, the names and addresses of the Services that select it, and its SPIFFE ID. |
|
Package logr adapts an xlog.KeyValueLogger to the go-logr LogSink interface so that controller-runtime logs through the same formatter as the rest of the process.
|
Package logr adapts an xlog.KeyValueLogger to the go-logr LogSink interface so that controller-runtime logs through the same formatter as the rest of the process. |
|
Package operator wires the KubeCA operator into a controller-runtime manager: the scheme, the informer cache restrictions, the field indexes, the ClusterIssuer, Certificate and Pod controllers and the Pod mutating webhook with its self-issued serving certificate.
|
Package operator wires the KubeCA operator into a controller-runtime manager: the scheme, the informer cache restrictions, the field indexes, the ClusterIssuer, Certificate and Pod controllers and the Pod mutating webhook with its self-issued serving certificate. |
|
certificate
Package certificate implements the Certificate controller: for every Certificate it resolves the ClusterIssuer and the xpki profile, evaluates the policy, decides whether an issuance is needed (needsIssuance in renewal.go), generates the key and the CSR, signs with the Authority, writes the kubernetes.io/tls Secret (secret.go), records the status and requeues itself for the renewal time.
|
Package certificate implements the Certificate controller: for every Certificate it resolves the ClusterIssuer and the xpki profile, evaluates the policy, decides whether an issuance is needed (needsIssuance in renewal.go), generates the key and the CSR, signs with the Authority, writes the kubernetes.io/tls Secret (secret.go), records the status and requeues itself for the renewal time. |
|
index
Package index registers the field indexes the operator controllers list Certificates by, so that a ClusterIssuer or a Service change maps to the Certificates it affects.
|
Package index registers the field indexes the operator controllers list Certificates by, so that a ClusterIssuer or a Service change maps to the Certificates it affects. |
|
issuer
Package issuer implements the ClusterIssuer controller: it resolves spec.issuerLabel in the running xpki Authority, checks the exposed profiles and the policy, publishes the CA certificate, the root bundle, the subject key id and the profiles in the status, flags an expiring or expired CA, and writes the root bundle into the ConfigMap named by spec.caBundle in every namespace that holds a Certificate of the issuer.
|
Package issuer implements the ClusterIssuer controller: it resolves spec.issuerLabel in the running xpki Authority, checks the exposed profiles and the policy, publishes the CA certificate, the root bundle, the subject key id and the profiles in the status, flags an expiring or expired CA, and writes the root bundle into the ConfigMap named by spec.caBundle in every namespace that holds a Certificate of the issuer. |
|
metrics
Package metrics defines the Prometheus metrics of the operator and registers them with controller-runtime's registry, so the manager's /metrics endpoint serves them next to the controller_runtime_* and xpki metrics.
|
Package metrics defines the Prometheus metrics of the operator and registers them with controller-runtime's registry, so the manager's /metrics endpoint serves them next to the controller_runtime_* and xpki metrics. |
|
pod
Package pod implements the Pod controller of the operator: for every Pod labeled kubeca.effectivesecurity/inject=true it derives the names the Pod may carry (internal/k8snames), the SPIFFE ID of its ServiceAccount when the ClusterIssuer has a trust domain, and the names of the san annotation, and creates or updates a Certificate owned by the Pod.
|
Package pod implements the Pod controller of the operator: for every Pod labeled kubeca.effectivesecurity/inject=true it derives the names the Pod may carry (internal/k8snames), the SPIFFE ID of its ServiceAccount when the ClusterIssuer has a trust domain, and the names of the san annotation, and creates or updates a Certificate owned by the Pod. |
|
policy
Package policy evaluates a ClusterIssuer's policy against a Certificate request: the namespace selector, the duration bound and the allowed DNS, URI, email and IP names; the subject common name is checked against the DNS expressions.
|
Package policy evaluates a ClusterIssuer's policy against a Certificate request: the namespace selector, the duration bound and the allowed DNS, URI, email and IP names; the subject common name is checked against the DNS expressions. |
|
webhook
Package webhook implements the operator's mutating admission webhook for Pods and the bootstrap of its own serving certificate.
|
Package webhook implements the operator's mutating admission webhook for Pods and the bootstrap of its own serving certificate. |
|
Package signerr classifies the errors xpki's authority.Issuer.Sign returns into permanent failures (a request the policy or the parser rejects, which no retry fixes) and transient ones (the crypto provider, KMS or anything unknown).
|
Package signerr classifies the errors xpki's authority.Issuer.Sign returns into permanent failures (a request the policy or the parser rejects, which no retry fixes) and transient ones (the crypto provider, KMS or anything unknown). |
|
Package testauthority builds an xpki authority.Authority for unit tests: a root and an issuing CA generated with xpki's testca, their keys in memory (inmemcrypto), and the profiles of testdata/ca-config.yaml (the chart's profiles without the Helm templating) loaded through authority.LoadConfig.
|
Package testauthority builds an xpki authority.Authority for unit tests: a root and an issuing CA generated with xpki's testca, their keys in memory (inmemcrypto), and the profiles of testdata/ca-config.yaml (the chart's profiles without the Helm templating) loaded through authority.LoadConfig. |
|
Package version exposes the build version of the binaries.
|
Package version exposes the build version of the binaries. |
Click to show internal directories.
Click to hide internal directories.