azureimds

package

v1.15.2 Latest Latest Go to latest Published: Jul 9, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/spiffe/spire

Links

Documentation ¶

Index ¶

Constants
func BuiltIn() catalog.BuiltIn
type IMDSAttestorConfig
type IMDSAttestorPlugin
- func New() *IMDSAttestorPlugin
type NetworkInterface
type SecretAuthConfig
type SecurityGroup
type Subnet
type TenantConfig
type TokenAuthConfig
type VMSSInfo
type VirtualMachine

Constants ¶

View Source

const (
	// Default metadata domain for commercial Azure
	DefaultMetadataDomain = "metadata.azure.com"

	// Expected microsoft issuer host for intermediate certificate fetching
	MicrosoftIntermediateIssuerHost = "www.microsoft.com"
)

View Source

const (
	// DigiCert Global Root G2
	// Valid until: 15/Jan/2038
	// downloaded from https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
	DigiCertGlobalRootG2Pem = `` /* 1293-byte string literal not displayed */

	// DigiCert Global Root CA
	// Valid until: 10/Nov/2031
	// downloaded from https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
	DigiCertGlobalRootCAPem = `` /* 1337-byte string literal not displayed */

	// Microsoft TLS RSA Root G2 (self-signed)
	// Valid until: 10/Apr/2040
	// downloaded from https://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2.crt
	MicrosoftTLSRSARootG2SelfSignedPem = `` /* 1967-byte string literal not displayed */

	// Microsoft TLS RSA Root G2 (cross-signed by DigiCert Global Root G2)
	// Valid until: 19/Jun/2029
	// downloaded from http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
	// This is the cross-signed version needed for validating the 3-level certificate chains
	// used by newer Azure IMDS certificates (e.g., Microsoft TLS G2 RSA CA OCSP XX)
	MicrosoftTLSRSARootG2CrossSignedPem = `` /* 1979-byte string literal not displayed */

)

Variables ¶

This section is empty.

Functions ¶

func BuiltIn ¶

func BuiltIn() catalog.BuiltIn

Types ¶

type IMDSAttestorConfig ¶

type IMDSAttestorConfig struct {
	Tenants                map[string]*TenantConfig `hcl:"tenants" json:"tenants"`
	AgentPathTemplate      string                   `hcl:"agent_path_template" json:"agent_path_template"`
	AllowedMetadataDomains []string                 `hcl:"allowed_metadata_domains" json:"allowed_metadata_domains"`
}

type IMDSAttestorPlugin ¶

type IMDSAttestorPlugin struct {
	nodeattestorbase.Base
	nodeattestorv1.UnsafeNodeAttestorServer
	configv1.UnsafeConfigServer
	// contains filtered or unexported fields
}

func New ¶

func New() *IMDSAttestorPlugin

func (*IMDSAttestorPlugin) Attest ¶

func (p *IMDSAttestorPlugin) Attest(stream nodeattestorv1.NodeAttestor_AttestServer) error

func (*IMDSAttestorPlugin) Configure ¶

func (p *IMDSAttestorPlugin) Configure(_ context.Context, req *configv1.ConfigureRequest) (*configv1.ConfigureResponse, error)

func (*IMDSAttestorPlugin) SetLogger ¶

func (p *IMDSAttestorPlugin) SetLogger(log hclog.Logger)

func (*IMDSAttestorPlugin) Validate ¶

func (p *IMDSAttestorPlugin) Validate(_ context.Context, req *configv1.ValidateRequest) (*configv1.ValidateResponse, error)

type NetworkInterface ¶

type NetworkInterface struct {
	Name          string        `json:"name"`
	SecurityGroup SecurityGroup `json:"securityGroup"`
	Subnets       []Subnet      `json:"subnets"`
}

type SecretAuthConfig ¶

type SecretAuthConfig struct {
	AppID     string `hcl:"app_id" json:"app_id"`
	AppSecret string `hcl:"app_secret" json:"app_secret"`
}

type SecurityGroup ¶

type SecurityGroup struct {
	ResourceGroup string `json:"resourceGroup"`
	Name          string `json:"name"`
}

type Subnet ¶

type Subnet struct {
	VNet       string `json:"vnet"`
	SubnetName string `json:"name"`
}

type TenantConfig ¶

type TenantConfig struct {
	AuthType                string            `hcl:"auth_type" json:"auth_type"`
	SecretAuth              *SecretAuthConfig `hcl:"secret_auth" json:"secret_auth"`
	TokenAuth               *TokenAuthConfig  `hcl:"token_auth" json:"token_auth"`
	AllowedTags             []string          `hcl:"allowed_vm_tags" json:"allowed_vm_tags"`
	RestrictToSubscriptions []*string         `hcl:"restrict_to_subscriptions" json:"restrict_to_subscriptions"`
}

type TokenAuthConfig ¶

type TokenAuthConfig struct {
	TokenPath string `hcl:"token_path" json:"token_path"`
	AppID     string `hcl:"app_id" json:"app_id"`
}

type VMSSInfo ¶

type VMSSInfo struct {
	ID             string `json:"id"`
	Name           string `json:"name"`
	Location       string `json:"location"`
	ResourceGroup  string `json:"resourceGroup"`
	SubscriptionID string `json:"subscriptionId"`
}

type VirtualMachine ¶

type VirtualMachine struct {
	ID            string              `json:"id"`
	Name          string              `json:"name"`
	Location      string              `json:"location"`
	Tags          map[string]any      `json:"tags"`
	VMID          string              `json:"vmId"`
	ResourceGroup string              `json:"resourceGroup"`
	Interfaces    []*NetworkInterface `json:"interfaces"`
}

VirtualMachine is a subset of the fields returned by the Resource Graph API

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL