Documentation
¶
Index ¶
- Constants
- func AddClientTLSFlagsToCmd(cmd *cobra.Command) func() (Configuration, error)
- func AddClientTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (Configuration, error)
- func AddTLSFlagsToCmd(cmd *cobra.Command) func() (ConfigCustomizer, error)
- func AddTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (ConfigCustomizer, error)
- func BestEffortSystemCertPool() *x509.CertPool
- func CreateServerTLSConfig(tlsCertPath, tlsKeyPath string, hosts []string, clientCAPath string) (*tls.Config, error)
- func EncodeX509KeyPair(cert tls.Certificate) ([]byte, []byte)
- func EncodeX509KeyPairString(cert tls.Certificate) (string, string)
- func GenerateHealthCheckClientCert() (*tls.Certificate, error)
- func GenerateX509KeyPair(opts CertOptions) (*tls.Certificate, error)
- func LoadX509Cert(path string) (*x509.Certificate, error)
- func LoadX509CertPool(paths ...string) (*x509.CertPool, error)
- type CertOptions
- type ConfigCustomizer
- type Configuration
Constants ¶
const ( DefaultRSABits = 2048 // The default TLS cipher suites to provide to clients - see https://cipherlist.eu for updates // Note that for TLS v1.3, cipher suites are not configurable and will be chosen automatically. DefaultTLSCipherSuite = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" // The default minimum TLS version to provide to clients DefaultTLSMinVersion = "1.2" // The default maximum TLS version to provide to clients DefaultTLSMaxVersion = "1.3" )
Variables ¶
This section is empty.
Functions ¶
func AddClientTLSFlagsToCmd ¶ added in v1.8.8
func AddClientTLSFlagsToCmd(cmd *cobra.Command) func() (Configuration, error)
func AddClientTLSFlagsToCmdWithPrefix ¶ added in v1.8.8
func AddClientTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (Configuration, error)
func AddTLSFlagsToCmd ¶ added in v0.9.0
func AddTLSFlagsToCmd(cmd *cobra.Command) func() (ConfigCustomizer, error)
AddTLSFlagsToCmd adds TLS server-related command line options to a command and returns a TLS config customizer object, set up to the options specified
func AddTLSFlagsToCmdWithPrefix ¶ added in v1.8.8
func AddTLSFlagsToCmdWithPrefix(cmd *cobra.Command, prefix string) func() (ConfigCustomizer, error)
func BestEffortSystemCertPool ¶ added in v0.12.0
BestEffortSystemCertPool returns system cert pool as best effort, otherwise an empty cert pool
func CreateServerTLSConfig ¶ added in v1.8.8
func CreateServerTLSConfig(tlsCertPath, tlsKeyPath string, hosts []string, clientCAPath string) (*tls.Config, error)
CreateServerTLSConfig will provide a TLS configuration for a server. It will either use a certificate and key provided at tlsCertPath and tlsKeyPath, or if these are not given, will generate a self-signed certificate valid for the specified list of hosts. If hosts is nil or empty, self-signed cert creation will be disabled.
func EncodeX509KeyPair ¶
func EncodeX509KeyPair(cert tls.Certificate) ([]byte, []byte)
EncodeX509KeyPair encodes a TLS Certificate into its pem encoded format for storage
func EncodeX509KeyPairString ¶ added in v0.5.3
func EncodeX509KeyPairString(cert tls.Certificate) (string, string)
EncodeX509KeyPairString encodes a TLS Certificate into its pem encoded string format
func GenerateHealthCheckClientCert ¶ added in v1.8.8
func GenerateHealthCheckClientCert() (*tls.Certificate, error)
GenerateHealthCheckClientCert generates an ephemeral self-signed CA and a leaf certificate pair for use by the repo-server liveness probe self-connection.
func GenerateX509KeyPair ¶
func GenerateX509KeyPair(opts CertOptions) (*tls.Certificate, error)
GenerateX509KeyPair generates a X509 key pair
func LoadX509Cert ¶ added in v1.8.8
func LoadX509Cert(path string) (*x509.Certificate, error)
LoadX509Cert loads PEM data from a file and returns the resulting Certificate
Types ¶
type CertOptions ¶
type CertOptions struct {
// Hostnames and IPs to generate a certificate for
Hosts []string
// Name of organization in certificate
Organization string
// Creation date
ValidFrom time.Time
// Duration that certificate is valid for
ValidFor time.Duration
// whether this cert should be its own Certificate Authority
IsCA bool
// Size of RSA key to generate. Ignored if --ecdsa-curve is set
RSABits int
// ECDSA curve to use to generate a key. Valid values are P224, P256 (recommended), P384, P521
ECDSACurve string
// ExtKeyUsage overrides the default ExtKeyUsage list on the generated certificate.
// If nil, defaults to []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}.
ExtKeyUsage []x509.ExtKeyUsage
}
type ConfigCustomizer ¶ added in v0.9.0
type Configuration ¶ added in v1.8.8
type Configuration struct {
// Whether to disable TLS for connections
DisableTLS bool
// Whether to enforce strict validation of TLS certificates
StrictValidation bool
// List of certificates to validate the peer against (if StrictCerts is true)
Certificates *x509.CertPool
// ClientCertFile is the path to the client certificate file
ClientCertFile string
// ClientCertKeyFile is the path to the client certificate key file
ClientCertKeyFile string
// ClientCertificates are the client certificates to be used for TLS
ClientCertificates []tls.Certificate
}
Configuration describes parameters for TLS configuration to be used by a repo server API client
Source Files