workload

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 13, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Overview

Package workload issues short-lived workload identities from the workload CA.

Index

Constants

View Source
const (
	// VolumeName is the name of the Podmin workload identity volume.
	VolumeName = "podmin-identity"
	// MountPath is the workload identity volume mount path.
	MountPath = manifest.IdentityMountPath
	// CertificateFilename is the leaf certificate filename.
	CertificateFilename = "tls.crt"
	// PrivateKeyFilename is the leaf private key filename.
	PrivateKeyFilename = "tls.key"
	// CABundleFilename is the CA trust bundle filename.
	CABundleFilename = "ca.crt"
	// CAStateKey is the durable workload CA state object key.
	CAStateKey = "identity/ca.json"
)

Variables

This section is empty.

Functions

func DecodeKey

func DecodeKey(encoded []byte) ([]byte, error)

DecodeKey decodes the base64 workload CA key stored by infrastructure.

func NeedsRenewal

func NeedsRenewal(notAfter, now time.Time) bool

NeedsRenewal reports whether an identity expires within the six-hour renewal window.

Types

type Authority

type Authority struct {
	// contains filtered or unexported fields
}

Authority issues workload certificates from the stable workload CA key.

func New

func New(cluster string, key []byte, storage s3lect.Storage) (*Authority, error)

New validates configuration and creates a cluster identity authority.

func (*Authority) Ensure

func (a *Authority) Ensure(ctx context.Context, now time.Time) error

Ensure creates or rotates the durable CA state using bounded compare-and-swap retries.

func (*Authority) Issue

func (a *Authority) Issue(namespace, pod, service string, now time.Time) (Material, error)

Issue creates a short-lived workload identity for a Pod and optional Service.

func (*Authority) Revision

func (a *Authority) Revision() uint64

Revision returns a local revision which changes whenever a new durable state is installed.

func (*Authority) Sync

func (a *Authority) Sync(ctx context.Context, now time.Time) error

Sync validates and installs the current durable CA state.

type Material

type Material struct {
	Certificate []byte
	PrivateKey  []byte
	CABundle    []byte
	NotAfter    time.Time
	SPIFFEID    string
}

Material contains a newly issued workload identity and its trust bundle.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL