Documentation
¶
Overview ¶
Package machinecredential stores the credential of an enrolled machine as one configuration value and signs client assertions with it. It must not import pkg/auth or pkg/workflow: pkg/auth depends on it.
Index ¶
- Constants
- Variables
- func CheckStorage(ctx context.Context, config configuration.Configuration) error
- func Clear(ctx context.Context, config configuration.Configuration) error
- func Publish(config configuration.Configuration, credential Credential) error
- func Save(ctx context.Context, config configuration.Configuration, credential Credential) error
- func SecretTerms(config configuration.Configuration) []string
- type AuthenticationError
- type Credential
- type Signer
Constants ¶
const CONFIG_KEY_DEVICE_TOKEN = "device-token"
CONFIG_KEY_DEVICE_TOKEN is the configuration key of the single-use device token that machine.enroll takes as its --device-token flag. It lives here so that log scrubbing can redact it without importing the workflow.
const CONFIG_KEY_MACHINE_IDENTITY_STORAGE = "INTERNAL_MACHINE_IDENTITY_STORAGE"
CONFIG_KEY_MACHINE_IDENTITY_STORAGE holds the JSON encoded credential of the enrolled machine.
Variables ¶
var ErrNotEnrolled = errors.New("this machine is not enrolled")
ErrNotEnrolled is returned by Load when no credential is stored.
Functions ¶
func CheckStorage ¶
func CheckStorage(ctx context.Context, config configuration.Configuration) error
CheckStorage checks that the credential's storage can be locked, read and written, by writing the stored credential back unchanged. A missing file is usable: the write creates it. The write-back rewrites the file (sorted keys, mode 0600, new mtime) even when nothing changed.
func Clear ¶
func Clear(ctx context.Context, config configuration.Configuration) error
Clear removes the stored credential. Like Save it writes through the storage under its lock, so a failure is returned; the in-memory view is only cleared once the stored value is gone.
func Publish ¶
func Publish(config configuration.Configuration, credential Credential) error
Publish makes an already saved credential visible in config's in-memory view without writing the storage. Hosts use it for configurations other than the one Save was given, such as the engine's own, which workflows do not run on.
func Save ¶
func Save(ctx context.Context, config configuration.Configuration, credential Credential) error
Save persists credential as a single configuration value. It writes through the storage directly, because Configuration.Set drops storage errors, and only then updates the in-memory view.
func SecretTerms ¶
func SecretTerms(config configuration.Configuration) []string
SecretTerms returns the values of the stored credential that must not appear in logs: the PEM of the key and each of its lines. The client id is deliberately left out. It reads the stored value without validating it, so it also covers a credential Load rejects.
Types ¶
type AuthenticationError ¶
type AuthenticationError struct {
Err error
}
AuthenticationError means an enrolled machine cannot authenticate as itself, so no authenticated request may be sent.
func (*AuthenticationError) Error ¶
func (e *AuthenticationError) Error() string
func (*AuthenticationError) Unwrap ¶
func (e *AuthenticationError) Unwrap() error
type Credential ¶
Credential is what an enrolled machine authenticates with.
func Load ¶
func Load(config configuration.Configuration) (Credential, error)
Load reads the stored credential, or returns ErrNotEnrolled when there is none.
Source Files