Documentation
¶
Overview ¶
Package certinit implements the init-container side of the CSR flow: name discovery for a Pod, key and CSR generation, submission of a CertificateSigningRequest and the wait for its certificate.
The init-container flow is deprecated since v0.9: it issues one certificate per Pod start and never renews it. New workloads use the operator's Certificate resource or the inject label (Documentation/design/operator.md); the package is kept for the migration period. (The package is not marked with a Deprecated: tag so that cmd/kubecertinit, the command of this flow, stays staticcheck clean.)
client, err := certinit.NewClient("", namespace) // "" = in-cluster config
if err != nil {
return err
}
r := &certinit.Request{
Namespace: namespace,
PodName: podName,
SignerName: "kubeca.svc/peer",
CertDir: "/etc/tls",
ClusterDomain: "cluster.local", // suffix of the names -query-k8s derives
QueryK8s: true,
}
return r.Create(ctx, client)
CertClient holds the three narrow interfaces the package needs (MinPods, MinServices, MinCertificates), so the tests use testify mocks instead of a cluster.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertClient ¶
type CertClient struct {
Pods MinPods
Services MinServices
Certificates MinCertificates
}
CertClient provides minimum interfaces to create a CSR
func NewClient ¶
func NewClient(kubeconfig, namespace string) (*CertClient, error)
NewClient returns new client
type MinCertificates ¶
type MinCertificates interface {
Create(ctx context.Context, certificateSigningRequest *capi.CertificateSigningRequest, opts metaV1.CreateOptions) (*capi.CertificateSigningRequest, error)
Get(ctx context.Context, name string, opts metaV1.GetOptions) (*capi.CertificateSigningRequest, error)
Watch(ctx context.Context, opts metaV1.ListOptions) (watch.Interface, error)
}
MinCertificates is minimum Certificates interface. Watch follows the CSR after it is created (KUBECA-006); a Watch error falls back to polling with Get.
type MinPods ¶
type MinPods interface {
Get(ctx context.Context, name string, opts metaV1.GetOptions) (*v1.Pod, error)
}
MinPods is minimum Pods interface
type MinServices ¶
type MinServices interface {
List(ctx context.Context, opts metaV1.ListOptions) (*v1.ServiceList, error)
}
MinServices is minimum Services interface
type Request ¶
type Request struct {
// Namespace as defined by pod.metadata.namespace
Namespace string
// PodName name as defined by pod.metadata.name
PodName string
// CertDir is directory where the TLS certs should be written
CertDir string
// ClusterDomain specifies kubernetes cluster domain
ClusterDomain string
// Labels to include in CertificateSigningRequest object; comma separated list of key=value
Labels string
// QueryK8s specifies to query kubernetes for names appropriate to this Pod
QueryK8s bool
// SAN is additional comma separated DNS, IP, URI or Emails to include in SAN
SAN string
// ServiceNames lists Services in the Pod's namespace that resolve to this
// Pod; comma separated. Each name is added to the SAN as
// <name>.<namespace>.svc.<cluster-domain> and, with IncludeUnqualified,
// <name>.<namespace>.svc.
ServiceNames string
// IncludeUnqualified specifies to include unqualified .svc domains in names from --query-k8s
IncludeUnqualified bool
// SignerName specifies the signer name
SignerName string
// Usages overrides the Kubernetes key usages requested in the CSR; comma
// separated certificates.k8s.io KeyUsage values. Required for a profile
// other than peer, server or client. The CA ignores them and applies the
// profile's usages.
Usages string
// contains filtered or unexported fields
}
Request parameters
Source Files