Documentation
¶
Overview ¶
Package issuer implements the ClusterIssuer controller: it resolves spec.issuerLabel in the running xpki Authority, checks the exposed profiles and the policy, publishes the CA certificate, the root bundle, the subject key id and the profiles in the status, flags an expiring or expired CA, and writes the root bundle into the ConfigMap named by spec.caBundle in every namespace that holds a Certificate of the issuer.
The Authority is loaded once at start-up, so a ClusterIssuer that is not Ready because of IssuerNotFound stays so until kubeca restarts with a configuration that serves the label.
Index ¶
Constants ¶
const (
// ControllerName is the name of the controller in metrics and logs.
ControllerName = "clusterissuer"
)
Variables ¶
var IssuerRefChanged = predicate.Funcs{ UpdateFunc: func(e event.UpdateEvent) bool { before, ok := e.ObjectOld.(*v1alpha1.Certificate) after, ok2 := e.ObjectNew.(*v1alpha1.Certificate) return ok && ok2 && before.Spec.IssuerRef.Name != after.Spec.IssuerRef.Name }, }
IssuerRefChanged passes the creation and deletion of a Certificate and the updates that change spec.issuerRef.name, the only updates that change the namespaces an issuer publishes its CA bundle into.
Functions ¶
Types ¶
type Reconciler ¶
type Reconciler struct {
client.Client
// APIReader reads ConfigMaps the cache does not hold (not labeled
// managed=true) before creating one.
APIReader client.Reader
Scheme *runtime.Scheme
Authority *authority.Authority
Recorder record.EventRecorder
// Clock is the time source; tests inject a fake.
Clock clock.Clock
}
Reconciler reconciles ClusterIssuers.
func (*Reconciler) Reconcile ¶
Reconcile evaluates the ClusterIssuer, patches its status when it changed and maintains the CA bundle ConfigMaps: written while the issuer is Ready, pruned whatever its state. Only API errors are returned.
func (*Reconciler) SetupWithManager ¶
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers the controller: it watches ClusterIssuers and, for the CA bundle ConfigMaps, the creation and deletion of Certificates and the updates that move one to another issuer (IssuerRefChanged; the map handler enqueues the issuers of the old and the new object).
Source Files