pki

type Certificate struct {
	// Organization stores value for 'organization' field in the certificate.
	Organization string `json:"organization,omitempty"`

	// RSABits defines length of RSA private key to generate.
	//
	// Example value: '2048'.
	RSABits int `json:"rsaBits,omitempty"`

	// ValidityDuration defines how long generated certificates should be valid.
	//
	// Example value: '24h'.
	ValidityDuration string `json:"validityDuration,omitempty"`

	// RenewThreshold defines how long before expiry date the certificates should
	// be re-generated.
	RenewThreshold string `json:"renewThreshold,omitempty"`

	// CommonName defined CN field for the certificate.
	CommonName string `json:"commonName,omitempty"`

	// CA controls if certificate should be self-signed while generated.
	CA bool `json:"ca,omitempty"`

	// KeyUsage is a list of key usages. Valid values are:
	// - "digital_signature"
	// - "content_commitment"
	// - "key_encipherment"
	// - "data_encipherment"
	// - "key_agreement"
	// - "cert_signing"
	// - "crl_signing"
	// - "encipher_only"
	// - "decipher_only"
	// - "any_extended"
	// - "server_auth"
	// - "client_auth"
	// - "code_signing"
	// - "email_protection"
	// - "ipsec_end_system"
	// - "ipsec_tunnel"
	// - "ipsec_user"
	// - "timestamping"
	// - "ocsp_signing"
	// - "microsoft_server_gated_crypto"
	// - "netscape_server_gated_crypto"
	KeyUsage []string `json:"keyUsage,omitempty"`

	// IPAddresses defines for which IP addresses the certificate can be used.
	IPAddresses []string `json:"ipAddresses,omitempty"`

	// DNSNames defines extra hostnames, which will be valid for the certificate.
	DNSNames []string `json:"dnsNames,omitempty"`

	// X509Certificate stores generated certificate in X.509 certificate format, PEM encoded.
	X509Certificate types.Certificate `json:"x509Certificate,omitempty"`

	// PublicKey stores generate RSA public key, PEM encoded.
	PublicKey string `json:"publicKey,omitempty"`

	// PrivateKey stores generates RSA private key in PKCS1 format, PEM encoded.
	PrivateKey types.PrivateKey `json:"privateKey,omitempty"`
}

type Etcd struct {
	// Inline Certificate struct, so some settings can be applied as defaults for all etcd certificates.
	Certificate

	// CA stores etcd CA certificate.
	CA *Certificate `json:"ca,omitempty"`

	// Peers is a map of peer certificates to generate, where key is name of the peer and value
	// is the IP address on which peer will be listening on.
	Peers map[string]string `json:"peers,omitempty"`

	// Servers is a map of server certificates to generate, where key is the CN of the client
	// certificate and value is the IP address on which the server will be listening on.
	Servers map[string]string `json:"servers,omitempty"`

	// ClientCNS is a list of client certificate Common Names to generate.
	ClientCNs []string `json:"clientCNs,omitempty"`

	// PeerCertificates defines and stores all peer certificates.
	PeerCertificates map[string]*Certificate `json:"peerCertificates,omitempty"`

	// ServerCertificates defines and stores all server certificates.
	ServerCertificates map[string]*Certificate `json:"serverCertificates,omitempty"`

	// ClientCertificates defined and stores all client certificates.
	ClientCertificates map[string]*Certificate `json:"clientCertificates,omitempty"`
}

type KubeAPIServer struct {
	// Certificate stores default settings for all kube-apiserver certificates.
	Certificate

	// ExternalNames is a helper to ServerCertificate, which allows setting allowed DNS
	// names while connecting to kube-apiserver.
	ExternalNames []string `json:"externalNames,omitempty"`

	// ServerIPs is a helper to ServerCertificate, which allows setting on which IP addresses
	// kube-apiserver can be available.
	ServerIPs []string `json:"serverIPs,omitempty"`

	// ServerCertificate stores service certificate for HTTPS server.
	ServerCertificate *Certificate `json:"serverCertificate,omitempty"`

	// KubeletCertificate stores client certificate used for talking to kubelet on the nodes.
	KubeletCertificate *Certificate `json:"kubeletCertificate,omitempty"`

	// FrontProxyClientCertificate stores client certificate used for talking to extending
	// API servers.
	FrontProxyClientCertificate *Certificate `json:"frontProxyClientCertificate,omitempty"`
}

type Kubernetes struct {
	// Certificate stores default settings for all Kubernetes certificates.
	Certificate

	// CA stores Kubernetes CA certificate and it's settings.
	CA *Certificate `json:"ca,omitempty"`

	// FrontProxyCA stores Kubernetes front-proxy CA certificate, required for API aggregation.
	FrontProxyCA *Certificate `json:"frontProxyCA,omitempty"`

	// KubeAPIServer stores kube-apiserver specific certificates.
	KubeAPIServer *KubeAPIServer `json:"kubeAPIServer,omitempty"`

	// AdminCertificate stores Kubernetes admin certificate.
	AdminCertificate *Certificate `json:"adminCertificate,omitempty"`

	// KubeControllerManagerCertificate stores kube-controller-manager client certificate.
	KubeControllerManagerCertificate *Certificate `json:"kubeControllerManagerCertificate,omitempty"`

	// KubeSchedulerCertificate stores kube-scheduler client certificate.
	KubeSchedulerCertificate *Certificate `json:"kubeSchedulerCertificate,omitempty"`

	// ServiceAccountCertificate stores public and private key used for signing and verifying
	// service account tokens by kube-controller-manager and kube-apiserver.
	ServiceAccountCertificate *Certificate `json:"serviceAccountCertificate,omitempty"`
}

type PKI struct {
	// Certificate contains default settings for all certificates in PKI.
	Certificate

	// RootCA contains configuration and generated root CA certificate and private key.
	RootCA *Certificate `json:"rootCA,omitempty"`

	// Etcd contains configuration and generated all etcd certificates and private keys.
	Etcd *Etcd `json:"etcd,omitempty"`

	// Kubernetes contains configuration and generated all Kubernetes certificates and private keys.
	Kubernetes *Kubernetes `json:"kubernetes,omitempty"`
}