Documentation
¶
Overview ¶
Package policy evaluates a ClusterIssuer's policy against a Certificate request: the namespace selector, the duration bound and the allowed DNS, URI, email and IP names; the subject common name is checked against the DNS expressions. It is pure: the caller (the Certificate controller) passes the namespace labels, the ServiceAccount of the Pod the Certificate belongs to and the already assembled names, and a Violation says what was denied.
violation := policy.Evaluate(issuer.Spec.Policy, policy.Request{
Namespace: cert.Namespace,
NamespaceLabels: ns.Labels,
Name: cert.Name,
ServiceAccount: serviceAccount, // of the owning Pod, "" otherwise
ClusterDomain: "cluster.local",
CommonName: cert.Spec.CommonName,
SAN: san, // *csr.SAN from csr.ParseSAN
})
Compile checks the regexes of a policy once, so the ClusterIssuer controller can report a bad policy instead of denying every request.
Index ¶
Constants ¶
const ( PlaceholderNamespace = "${NAMESPACE}" PlaceholderName = "${NAME}" PlaceholderServiceAccount = "${SERVICE_ACCOUNT}" PlaceholderClusterDomain = "${CLUSTER_DOMAIN}" )
Placeholders substituted, regex-quoted, in the allowed-name expressions.
const ( TypeCommonName = "common name" TypeDNS = "DNS name" TypeURI = "URI" TypeEmail = "email address" TypeIP = "IP address" )
Name types reported in a Violation.
const ( ReasonNamespaceNotAllowed = "NamespaceNotAllowed" ReasonNameNotAllowed = "NameNotAllowed" ReasonInvalidPolicy = "InvalidPolicy" )
Violation reasons.
Variables ¶
This section is empty.
Functions ¶
func BoundDuration ¶
BoundDuration returns the certificate lifetime: the requested duration (the profile expiry when zero) bounded by the profile expiry and by the policy's maxDuration (ignored when zero).
func Compile ¶
func Compile(p *v1alpha1.IssuerPolicy) error
Compile checks that every expression of the policy is a valid RE2 regex after substitution and that the namespace selector is valid; it returns the first error. Used by the ClusterIssuer controller.
func MaxDuration ¶
func MaxDuration(p *v1alpha1.IssuerPolicy) time.Duration
MaxDuration returns the policy's maxDuration or 0.
Types ¶
type Request ¶
type Request struct {
// Namespace and NamespaceLabels of the Certificate.
Namespace string
NamespaceLabels map[string]string
// Name of the Certificate (${NAME}).
Name string
// ServiceAccount of the Pod the Certificate belongs to
// (${SERVICE_ACCOUNT}); empty for a direct Certificate.
ServiceAccount string
// ClusterDomain is the cluster DNS suffix the operator derives names
// with (${CLUSTER_DOMAIN}).
ClusterDomain string
// CommonName of the subject; checked against allowedDNSNames, since
// the CA signs it as given and a profile rarely constrains it.
CommonName string
// SAN are the parsed, deduplicated names.
SAN *csr.SAN
}
Request is what the policy is evaluated against.
type Violation ¶
Violation is a denied request: the Reason is a CamelCase word for the condition, the Message names what was denied.
func Evaluate ¶
func Evaluate(p *v1alpha1.IssuerPolicy, req Request) *Violation
Evaluate returns nil when the request satisfies the policy, else the first Violation found. A nil policy allows everything. A policy whose selector or regexes do not compile is reported as InvalidPolicy. The common name is checked like a DNS name (allowedDNSNames) because it is an identity to clients that still read it, while the SAN lists are the names a verifier matches.
Source Files