kapmtls

package
v0.12.13 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package kapmtls manages credentials for the node-local KAP mTLS agent.

Index

Constants

View Source 
const (
	DefaultAgentBinaryPath = "/usr/local/bin/kaproxy-mtls-agent"
	DefaultAgentUnitPath   = "/etc/systemd/system/kaproxy-mtls-agent.service"

	AgentService  = "kaproxy-mtls-agent.service"
	AgentReadyURL = "http://127.0.0.1:8440/readyz"

	ReleasesDirectoryName     = "releases"
	CurrentSymlinkName        = "current"
	AgentEnvironmentFileName  = "agent.env"
	ClientCertificateFileName = "client.crt"
	ClientPrivateKeyFileName  = "client.key"
	GatewayCAFileName         = "gateway-ca.crt"
)

Variables

This section is empty.

Functions

This section is empty.

Types

type Credentials 

type Credentials struct {
	CertificatePEM       []byte
	PrivateKeyPEM        []byte
	GatewayCAPEM         []byte
	GatewayEndpoint      string
	ServerName           string
	ClientCAFingerprint  string
	GatewayCAFingerprint string
}

Credentials is one complete agent credential generation. Certificate and key bytes are sensitive and must not be logged.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager 

func NewManager(paths Paths) *Manager

func (*Manager) Activate 

func (m *Manager) Activate(ctx context.Context) error

Activate restarts the agent against the already selected credential release. It does not stage or rotate private key material.

func (*Manager) Status 

func (m *Manager) Status(ctx context.Context, machineID string) (*Status, error)

func (*Manager) UpdateCredentials 

func (m *Manager) UpdateCredentials(ctx context.Context, machineID string, credentials Credentials) error

UpdateCredentials commits one complete immutable generation, atomically points current at it, and restarts the agent. Restarting on each five-day certificate rotation is intentionally simpler than coordinating hot reload and rollback: agent startup validates the selected cert/key before readiness can succeed.

type Paths 

type Paths struct {
	StateDir         string
	AgentBinary      string
	AgentUnitFile    string
	AgentVersionFile string
}

func DefaultPaths 

func DefaultPaths(dataDir string) Paths

type Status 

type Status struct {
	CredentialsInstalled bool
	CertificateSerial    string
	CertificateNotAfter  time.Time
	AgentInstalled       bool
	AgentActive          bool
	AgentReady           bool
	AgentVersion         string
	GatewayEndpoint      string
	ServerName           string
	ClientCAFingerprint  string
	GatewayCAFingerprint string
}

Status contains only non-secret state used by gpud-manager reconciliation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.