identity

package

v0.5.0 Latest Latest Go to latest Published: Sep 1, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Details

Package identity creates and validates Podmin agent certificates.

View Source

const (
	// ClusterCAPathSuffix is the reserved cluster CA parameter suffix.
	ClusterCAPathSuffix = "/_system/cluster-ca"
)

This section is empty.

func Generate(cluster string) ([]byte, error)

Generate creates a long-lived Ed25519 cluster CA as a versioned JSON secret.

type Authority struct {
	// contains filtered or unexported fields
}

Authority is a validated cluster certificate authority.

func Load(value []byte, cluster string) (*Authority, error)

Load parses and validates a cluster CA secret, including its key match and CA constraints.

func (a *Authority) TLSConfigs(cluster, nodeID, nodeGroup string, address netip.Addr) (*tls.Config, *tls.Config, error)

TLSConfigs returns distinct TLS 1.3 client and server configurations with an automatically renewed in-memory node certificate.

type NodeIdentity struct {
	NodeID    string
	NodeGroup string
}

NodeIdentity is an authenticated Podmin node identity.

func IdentityFromContext(ctx context.Context, cluster string) (NodeIdentity, error)

IdentityFromContext extracts a node identity from a verified gRPC TLS peer and exact cluster trust domain.