Documentation
¶
Overview ¶
Package client is how a mesh component reads from its control plane. Node and router share it, so the body cap, the status handling and the signature check on /keys are a single code path. It depends on api/ only: importing it pulls in none of the control plane server.
Index ¶
Constants ¶
const MaxBodyBytes = 8 << 20
MaxBodyBytes caps every response body read from a control plane: a misbehaving or impersonated server must not be able to make a client buffer arbitrary amounts of memory. It is sized for the largest legitimate answer, the ban set in /info at roughly 55 bytes per peer ID, so about 150k banned peers fit; the policy is bounded by the control plane's own 1 MiB cap on POST /policies, and /keys is a few hundred bytes.
Variables ¶
var ErrBodyTooLarge = errors.New("control plane answer exceeds the body cap")
ErrBodyTooLarge marks an answer over MaxBodyBytes. It is an error, never a prefix: a protobuf message cut at a field boundary still decodes, so a truncated ban set or router list would be read as a smaller, valid one.
Functions ¶
func NewHTTPClient ¶
NewHTTPClient is the HTTP client for every request a mesh component makes to its control plane. A nil allowInsecure never allows plaintext.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client reads the pull side of the mesh protocol from one control plane.
func New ¶
New normalizes baseURL, https:// when no scheme is given and no trailing slash, and speaks through httpClient, which the caller builds with NewHTTPClient so its own transport policy applies.
func (*Client) FetchInfo ¶
FetchInfo is GET /info: the router addresses, the ban set and the OIDC details a node needs to enroll.
func (*Client) FetchKeys ¶
func (c *Client) FetchKeys(ctx context.Context, trusted []ed25519.PublicKey) ([]ed25519.PublicKey, error)
FetchKeys is GET /keys: the control plane's currently valid signing keys. The set is accepted only if signed by a key in trusted (api.VerifyKeysResponse): whoever answers the URL must already be the control plane, not become it.
func (*Client) FetchPolicy ¶
func (c *Client) FetchPolicy(ctx context.Context, biscuit []byte) (*api.PolicyConfigGetResponse, error)
FetchPolicy is GET /policies, authenticated with the caller's biscuit: the roles and bindings a node compiles into its authorization rules.
Source Files