manager

type GenerateOption func(Interface, secretsutils.ConfigInterface, *GenerateOptions) error

type GenerateOptions struct {
	// Persist specifies whether the 'persist=true' label should be added to the secret resources.
	Persist bool
	// RotationStrategy specifies how the secret should be rotated in case it needs to get rotated.
	RotationStrategy rotationStrategy
	// IgnoreOldSecrets specifies whether old secrets should be dropped.
	IgnoreOldSecrets bool
	// IgnoreOldSecretsAfter specifies that old secrets should be dropped once a given duration after rotation has passed.
	IgnoreOldSecretsAfter *time.Duration
	// Validity specifies for how long the secret should be valid.
	Validity time.Duration
	// RenewAfterValidityPercentage sets the percentage of the validity when the certificate should be renewed.
	// The effective check for renewal is after the given percentage of validity or 10d before the end of validity.
	// Zero value means the default percentage is used (80%).
	RenewAfterValidityPercentage int
	// IgnoreConfigChecksumForCASecretName specifies whether the secret config checksum should be ignored when
	// computing the secret name for CA secrets.
	IgnoreConfigChecksumForCASecretName bool
	// Namespace overwrites the namespace in which the secret should be created.
	Namespace string
	// contains filtered or unexported fields
}

type GetOption interface {
	// ApplyToOptions applies this configuration to the given options.
	ApplyToOptions(*GetOptions)
}

type GetOptions struct {
	// Class specifies whether which secret should be returned. By default, the bundle secret is returned. If there is
	// no bundle secret then it falls back to the current secret.
	Class *secretClass
}

type Interface interface {
	// Generate generates a secret based on the provided configuration. If the secret for the provided configuration
	// already exists then it is returned with re-generation. The function also automatically rotates/re-generates the
	// secret only if necessary (e.g., when the config or the signing CA changes).
	Generate(context.Context, secretsutils.ConfigInterface, ...GenerateOption) (*corev1.Secret, error)

	Reader

	// Cleanup deletes no longer required secrets. No longer required secrets are those still existing in the system
	// which weren't detected by prior Generate calls. Consequently, only call Cleanup after you have executed Generate
	// calls for all desired secrets.
	Cleanup(context.Context) error
}

type NewOption func(*NewOptions)

type NewOptions struct {
	// Namespaces is the list of namespaces the secrets manager should operate on.
	Namespaces []string
	// CASecretAutoRotation states whether CA secrets are considered for automatic rotation (defaults to false).
	CASecretAutoRotation bool
	// SecretNamesToTimes is a map whose keys are secret names and whose values are the last rotation initiation
	// times.
	SecretNamesToTimes map[string]time.Time
	// DisableAutomaticSecretRenewal states whether automatic secret renewal should be disabled even if a secret's
	// configuration would otherwise require it.
	DisableAutomaticSecretRenewal bool
}

type Reader interface {
	// Get returns the secret object for the secret with the given name. By default, the bundle secret will be returned.
	// If there is no bundle secret then it falls back to the current secret. Note that only those secrets are known
	// which were detected or generated by prior Generate calls.
	Get(string, ...GetOption) (*corev1.Secret, bool)
}

type SignedByCAOption interface {
	// ApplyToOptions applies this configuration to the given options.
	ApplyToOptions(*SignedByCAOptions)
}

type SignedByCAOptions struct {
	// CAClass specifies which CA should be used to sign the requested certificate. Server certificates are signed with
	// the old CA by default, however one might want to use the current CA instead. Similarly, client certificates are
	// signed with the current CA by default, however one might want to use the old CA instead.
	CAClass *secretClass
	// LoadMissingCAFromClusterCtx enables loading a missing signing CA from the cluster when it is not found in the
	// internal store, and specifies the context.Context to use for the LIST call. This is useful when generating
	// certificates signed by CAs that were not created by this secrets manager instance.
	LoadMissingCAFromClusterCtx context.Context
}