Documentation
¶
Overview ¶
Package tls provides tls.Config generation and certificate management.
Index ¶
- func New(opts ...ConfigOptionFunc) (*tls.Config, error)
- func WithCACertPEM(ca []byte) func(*tls.Config) error
- func WithClientAuthType(t Type) func(*tls.Config) error
- func WithClientCertificateProvider(p CertificateProvider) func(*tls.Config) error
- func WithDynamicClientCA(p CertificateProvider) func(*tls.Config) error
- func WithKeypair(cert tls.Certificate) func(*tls.Config) error
- func WithMinVersion(version uint16) func(*tls.Config) error
- func WithServerCertificateProvider(p CertificateProvider) func(*tls.Config) error
- type CertificateProvider
- type ConfigOptionFunc
- type DynamicCertificate
- func (c *DynamicCertificate) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)
- func (c *DynamicCertificate) Load() error
- func (c *DynamicCertificate) Watch(ctx context.Context, logger *zap.Logger) error
- func (c *DynamicCertificate) WatchWithRestarts(ctx context.Context, logger *zap.Logger) error
- type Generator
- type Type
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func New ¶
func New(opts ...ConfigOptionFunc) (*tls.Config, error)
New returns a new TLS Configuration modified by any provided configuration options.
func WithCACertPEM ¶
WithCACertPEM declares a PEM-encoded CA Certificate to be used.
func WithClientAuthType ¶
WithClientAuthType declares the server's policy regardling TLS Client Authentication.
func WithClientCertificateProvider ¶
func WithClientCertificateProvider(p CertificateProvider) func(*tls.Config) error
WithClientCertificateProvider declares a dynamic provider for the client certificate.
NOTE: specifying this option will CLEAR any configured Certificates, since they would otherwise override this option.
func WithDynamicClientCA ¶ added in v0.4.4
func WithDynamicClientCA(p CertificateProvider) func(*tls.Config) error
WithDynamicClientCA declares a dynamic client CA which will be updated on each client request.
This methods is for server-side TLS. For client TLS, build the new `tls.Config` on each request.
func WithKeypair ¶
func WithKeypair(cert tls.Certificate) func(*tls.Config) error
WithKeypair declares a specific TLS keypair to be used. This can be called multiple times to add additional keypairs.
func WithMinVersion ¶ added in v0.6.3
WithMinVersion sets the minimum TLS version to use.
func WithServerCertificateProvider ¶
func WithServerCertificateProvider(p CertificateProvider) func(*tls.Config) error
WithServerCertificateProvider declares a dynamic provider for the server certificate.
NOTE: specifying this option will CLEAR any configured Certificates, since they would otherwise override this option.
Types ¶
type CertificateProvider ¶
type CertificateProvider interface {
// GetCA returns the active root CA certificate(s).
GetCA() ([]byte, error)
// GetCACertPool returns the active root CA certificates as a certificate pool.
GetCACertPool() (*x509.CertPool, error)
// GetCertificate returns the current certificate matching the given client request.
GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)
// GetClientCertificate returns the current certificate to present to the server.
GetClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error)
}
CertificateProvider describes an interface by which TLS certificates may be managed.
func NewRenewingCertificateProvider ¶
func NewRenewingCertificateProvider(generator Generator, csrOptions ...talosx509.Option) (CertificateProvider, error)
NewRenewingCertificateProvider returns a new CertificateProvider which manages and updates its certificates using Generator.
type ConfigOptionFunc ¶
ConfigOptionFunc describes a configuration option function for the TLS config.
type DynamicCertificate ¶ added in v0.6.4
type DynamicCertificate struct {
// contains filtered or unexported fields
}
DynamicCertificate is a certificate that can be reloaded from disk.
func NewDynamicCertificate ¶ added in v0.6.4
func NewDynamicCertificate(certFile, keyFile string) *DynamicCertificate
NewDynamicCertificate creates a new DynamicCertificate.
func (*DynamicCertificate) GetCertificate ¶ added in v0.6.4
func (c *DynamicCertificate) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)
GetCertificate returns the current certificate.
It is suitable for use with tls.Config.GetCertificate.
func (*DynamicCertificate) Load ¶ added in v0.6.4
func (c *DynamicCertificate) Load() error
Load the initial certificate.
func (*DynamicCertificate) Watch ¶ added in v0.6.4
Watch the certificate files for changes and reload them.
func (*DynamicCertificate) WatchWithRestarts ¶ added in v0.6.4
WatchWithRestarts restarts the Watch on error.
Source Files