Documentation
¶
Overview ¶
Package workload issues short-lived workload identities from the workload CA.
Index ¶
Constants ¶
View Source
const ( // VolumeName is the name of the Podmin workload identity volume. VolumeName = "podmin-identity" // MountPath is the workload identity volume mount path. MountPath = manifest.IdentityMountPath // CertificateFilename is the leaf certificate filename. CertificateFilename = "tls.crt" // PrivateKeyFilename is the leaf private key filename. PrivateKeyFilename = "tls.key" // CABundleFilename is the CA trust bundle filename. CABundleFilename = "ca.crt" // CAStateKey is the durable workload CA state object key. CAStateKey = "identity/ca.json" )
Variables ¶
This section is empty.
Functions ¶
func NeedsRenewal ¶
NeedsRenewal reports whether an identity expires within the six-hour renewal window.
Types ¶
type Authority ¶
type Authority struct {
// contains filtered or unexported fields
}
Authority issues workload certificates from the stable workload CA key.
func (*Authority) Ensure ¶
Ensure creates or rotates the durable CA state using bounded compare-and-swap retries.
func (*Authority) Issue ¶
Issue creates a short-lived workload identity for a Pod and optional Service.
Click to show internal directories.
Click to hide internal directories.