Help us shape the future of Go! Take the 2026 Go Developer Survey

rotator

package
v0.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 9, 2026 License: Apache-2.0 Imports: 30 Imported by: 51

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AddRotator

func AddRotator(mgr manager.Manager, cr *CertRotator) error

AddRotator adds the CertRotator and ReconcileWH to the manager.

func ValidCert

func ValidCert(caCert, cert, key []byte, dnsName string, keyUsages *[]x509.ExtKeyUsage, at time.Time) (bool, error)

Types

type CertRotator

type CertRotator struct {
	SecretKey      types.NamespacedName
	CertDir        string
	CAName         string
	CAOrganization string
	DNSName        string
	ExtraDNSNames  []string
	IsReady        chan struct{}
	Webhooks       []WebhookInfo
	// FieldOwner is the optional fieldmanager of the webhook updated fields.
	FieldOwner             string
	RestartOnSecretRefresh bool
	ExtKeyUsages           *[]x509.ExtKeyUsage
	// RequireLeaderElection should be set to true if the CertRotator needs to
	// be run in the leader election mode.
	RequireLeaderElection bool
	// CaCertDuration sets how long a CA cert will be valid for.
	CaCertDuration time.Duration
	// ServerCertDuration sets how long a server cert will be valid for.
	ServerCertDuration time.Duration
	// RotationCheckFrequency sets how often the rotation is executed
	RotationCheckFrequency time.Duration
	// LookaheadInterval sets how long before the certificate is renewed
	LookaheadInterval time.Duration
	// CertName and Keyname override certificate path
	CertName string
	KeyName  string

	// EnableReadinessCheck if true, reconcilation loop will wait for controller-runtime's
	// runnable to finish execution.
	EnableReadinessCheck bool

	// ControllerName allows registering multiple cert-rotator controllers.
	// Use the default value unless rotating multiple certificate secrets.
	ControllerName string
	// contains filtered or unexported fields
}

CertRotator contains cert artifacts and a channel to close when the certs are ready.

func (*CertRotator) CreateCACert

func (cr *CertRotator) CreateCACert(begin, end time.Time) (*KeyPairArtifacts, error)

CreateCACert creates the self-signed CA cert and private key that will be used to sign the server certificate.

func (*CertRotator) CreateCertPEM

func (cr *CertRotator) CreateCertPEM(ca *KeyPairArtifacts, begin, end time.Time) ([]byte, []byte, error)

CreateCertPEM takes the results of CreateCACert and uses it to create the PEM-encoded public certificate and private key, respectively.

func (*CertRotator) NeedLeaderElection added in v0.5.0

func (cr *CertRotator) NeedLeaderElection() bool

func (*CertRotator) Start

func (cr *CertRotator) Start(ctx context.Context) error

Start starts the CertRotator runnable to rotate certs and ensure the certs are ready.

type KeyPairArtifacts

type KeyPairArtifacts struct {
	Cert    *x509.Certificate
	Key     *rsa.PrivateKey
	CertPEM []byte
	KeyPEM  []byte
}

KeyPairArtifacts stores cert artifacts.

type ReconcileWH

type ReconcileWH struct {
	// contains filtered or unexported fields
}

ReconcileWH reconciles a validatingwebhookconfiguration, making sure it has the appropriate CA cert.

func (*ReconcileWH) Reconcile

func (r *ReconcileWH) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error)

Reconcile reads that state of the cluster for a validatingwebhookconfiguration object and makes sure the most recent CA cert is included.

type SyncingReader

type SyncingReader interface {
	client.Reader
	WaitForCacheSync(ctx context.Context) bool
}

SyncingReader is a reader that needs syncing prior to being usable.

type WebhookInfo

type WebhookInfo struct {
	// Name is the name of the webhook for a validating or mutating webhook, or the CRD name in case of a CRD conversion webhook
	Name string
	Type WebhookType
}

WebhookInfo is used by the rotator to receive info about resources to be updated with certificates.

type WebhookType

type WebhookType int

WebhookType it the type of webhook, either validating/mutating webhook, a CRD conversion webhook, or an extension API server.

const (
	// Validating indicates the webhook is a ValidatingWebhook.
	Validating WebhookType = iota
	// Mutating indicates the webhook is a MutatingWebhook.
	Mutating
	// CRDConversion indicates the webhook is a conversion webhook.
	CRDConversion
	// APIService indicates the webhook is an extension API server.
	APIService
	// ExternalDataProvider indicates the webhook is a Gatekeeper External Data Provider.
	ExternalDataProvider
)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL