provider

type CSRProvisioner ¶ added in v1.1.0

type CSRProvisioner struct {
	// contains filtered or unexported fields
}

CSRProvisioner handles certificate provisioning through Certificate Signing Requests. It generates a private key and CSR, submits it to the management server, and polls for approval and certificate issuance. This supports the standard Kubernetes CSR workflow.

func NewCSRProvisioner(deviceName string, csrClient csrClient, identityProvider identity.ExportableProvider, cfg *CSRProvisionerConfig) (*CSRProvisioner, error)

func (p *CSRProvisioner) Provision(ctx context.Context, _ certmanager.ProvisionRequest) (*certmanager.ProvisionResult, error)

type CSRProvisionerConfig ¶ added in v1.1.0

type CSRProvisionerConfig struct {
	// Signer is the name of the signer for CSR provisioning
	Signer string `json:"signer"`
	// CommonName is the common name for the certificate
	CommonName string `json:"common-name,omitempty"`
	// Usages specifies a set of key usages requested in the issued certificate (e.g., "clientAuth", "serverAuth")
	Usages []string `json:"usages,omitempty"`
	// ExpirationSeconds requests a specific certificate validity duration (in seconds); signer may ignore
	ExpirationSeconds *int32 `json:"expiration-seconds,omitempty"`
	// IdentityType specifies the type of identity to use for this certificate ("software", "tpm", or empty for default)
	IdentityType string `json:"identity-type,omitempty"`
	// Additional CSR-specific configuration (future extensions)
	Config map[string]interface{} `json:"config,omitempty"`
}

CSRProvisionerConfig defines configuration for Certificate Signing Request (CSR) based provisioning. This provisioner generates a private key and CSR, submits it to the management server, and waits for approval and signing by the certificate authority.

type CSRProvisionerFactory ¶ added in v1.1.0

type CSRProvisionerFactory struct {
	// contains filtered or unexported fields
}

CSRProvisionerFactory implements ProvisionerFactory for CSR-based provisioners. It creates CSR provisioners with device-specific configuration and validates CSR configs.

func NewCSRProvisionerFactory(deviceName string, managementClient csrClient, identityFactory identity.ExportableFactory) *CSRProvisionerFactory

func (f *CSRProvisionerFactory) New(log certmanager.Logger, cc certmanager.CertificateConfig) (certmanager.ProvisionerProvider, error)

func (f *CSRProvisionerFactory) Type() string

func (f *CSRProvisionerFactory) Validate(log certmanager.Logger, cc certmanager.CertificateConfig) error

type DropInConfigProvider ¶ added in v1.1.0

type DropInConfigProvider struct {
	// contains filtered or unexported fields
}

DropInConfigProvider reads a base certificate configuration file and merges overrides from a derived ".d" directory. Certificates are keyed by Name; a drop-in with the same certificate name overrides the base definition. Example:

• Base: /etc/flightctl/certs.yaml
• Drop-ins dir: /etc/flightctl/certs.d/

All files in the drop-ins dir with .yaml/.yml extensions are applied in lexical order. Only YAML is supported for base and drop-ins.

func NewDropInConfigProvider(rw fileio.ReadWriter, basePath string) *DropInConfigProvider

func (p *DropInConfigProvider) GetCertificateConfigs() ([]certmanager.CertificateConfig, error)

func (p *DropInConfigProvider) Name() string

type FileSystemStorage ¶ added in v1.1.0

type FileSystemStorage struct {
	// Path where the certificate file will be stored
	CertPath string
	// Path where the private key file will be stored
	KeyPath string
	// contains filtered or unexported fields
}

FileSystemStorage handles certificate storage on the local filesystem. It stores certificates and private keys as managed files with appropriate permissions and supports loading existing certificates from the filesystem.

func NewFileSystemStorage(certPath, keyPath string, rw fileio.ReadWriter, log certmanager.Logger) *FileSystemStorage

func (fs *FileSystemStorage) LoadCertificate(_ context.Context) (*x509.Certificate, error)

func (fs *FileSystemStorage) Store(ctx context.Context, req certmanager.StoreRequest) error

type FileSystemStorageConfig ¶ added in v1.1.0

type FileSystemStorageConfig struct {
	// CertPath is the path where the certificate will be stored
	CertPath string `json:"cert-path"`
	// KeyPath is the path where the private key will be stored
	KeyPath string `json:"key-path"`
}

FileSystemStorageConfig defines configuration for filesystem-based certificate storage. It specifies where certificates and private keys should be stored on the filesystem and what permissions should be applied to the files.

type FileSystemStorageFactory ¶ added in v1.1.0

type FileSystemStorageFactory struct {
	// contains filtered or unexported fields
}

FileSystemStorageFactory implements StorageFactory for filesystem-based certificate storage. It creates filesystem storage providers that store certificates and keys as files on disk.

func NewFileSystemStorageFactory(rw fileio.ReadWriter) *FileSystemStorageFactory

func (f *FileSystemStorageFactory) New(log certmanager.Logger, cc certmanager.CertificateConfig) (certmanager.StorageProvider, error)

func (f *FileSystemStorageFactory) Type() string

func (f *FileSystemStorageFactory) Validate(log certmanager.Logger, cc certmanager.CertificateConfig) error