Documentation
¶
Overview ¶
Package identity is the single definition of workload identity as it appears in credentials. A workload identity is a control-plane-assigned UUID; in an issued certificate it is carried as exactly one URI subject alternative name of the form
innerwall://workload/<uuid>
Every component that formats or parses that URI goes through this package. Nothing else in the repository builds or inspects the string, so the representation can only ever change in one place (ADR-0016).
Index ¶
Constants ¶
const Scheme = "innerwall"
Scheme is the URI scheme of a workload identity.
Variables ¶
var ErrAmbiguousIdentity = errors.New("identity: certificate carries more than one URI SAN")
ErrAmbiguousIdentity is returned when a certificate carries more than one URI SAN. A credential names exactly one principal; anything else is a malformed credential, not a choice to make.
var ErrNoIdentity = errors.New("identity: certificate carries no workload identity")
ErrNoIdentity is returned when a certificate carries no workload identity.
Functions ¶
This section is empty.
Types ¶
type WorkloadID ¶
type WorkloadID struct {
// contains filtered or unexported fields
}
WorkloadID is the control-plane-assigned identity of a workload.
func FromCertificate ¶
func FromCertificate(cert *x509.Certificate) (WorkloadID, error)
FromCertificate extracts the workload identity a certificate binds. The certificate must carry exactly one URI SAN and it must parse; the subject, common name, and every other field are ignored, because the URI SAN is the only place identity lives (ADR-0016).
func FromUUID ¶
func FromUUID(u uuid.UUID) WorkloadID
FromUUID wraps an existing UUID, for values read back from the store.
func NewWorkloadID ¶
func NewWorkloadID() (WorkloadID, error)
NewWorkloadID generates a fresh workload identity. Version 7 UUIDs are time-ordered, which keeps the primary key of the workloads table append friendly without revealing anything an enrollee could influence.
func ParseURI ¶
func ParseURI(u *url.URL) (WorkloadID, error)
ParseURI parses a workload identity URI. It accepts exactly the form produced by URI: any other scheme, host, path shape, query, fragment, or user information is rejected rather than tolerated.
func ParseURIString ¶
func ParseURIString(s string) (WorkloadID, error)
ParseURIString parses the textual form of a workload identity URI.
func ParseWorkloadID ¶
func ParseWorkloadID(s string) (WorkloadID, error)
ParseWorkloadID parses the canonical textual UUID form.
func (WorkloadID) IsZero ¶
func (w WorkloadID) IsZero() bool
IsZero reports whether the identity is unset.
func (WorkloadID) String ¶
func (w WorkloadID) String() string
String returns the canonical textual UUID form.
func (WorkloadID) URI ¶
func (w WorkloadID) URI() *url.URL
URI returns the identity as the URI carried in a certificate SAN.
func (WorkloadID) UUID ¶
func (w WorkloadID) UUID() uuid.UUID
UUID returns the underlying UUID, for the store.
Source Files