Documentation
¶
Overview ¶
Package spec holds the names the deploy libraries give AWS resources and the checks of the values an installation hands them, without the Pulumi SDK.
An installation's own tooling needs both before anything exists: a key policy names a role that another stack creates, a render writes a bucket name into a document, and a configuration file is refused before a preview rather than half way through an apply. This package is that knowledge in one place, importable by code that must not link a cloud provider SDK.
The rules are the ones `deploy/pulumi` applies; the library's tests hold the two equal.
Index ¶
- Constants
- Variables
- func BucketName(prefix, accountID, region string) string
- func CheckBucketPrefix(prefix, region string) error
- func CheckCloudflareRotation(lifetime, rotation string) error
- func CheckFunctionName(name string) error
- func CheckInstance(instance string) error
- func CheckKeyAlias(alias string) error
- func CheckVerifyKey(pemText, alg string) error
- func FunctionRoleARN(accountID, function string) string
- func KubernetesRoleName(prefix string) string
- func RoleARN(accountID, path, name string) string
- type ChartSecret
Constants ¶
const ( AlgES384 = "ES384" AlgRS256 = "RS256" )
The two signing algorithms deploy tooling names for a verify-only key; the issuer accepts others too (ES256, ES512), and CheckVerifyKey follows it.
const KubernetesRoleSuffix = "-sluis"
KubernetesRoleSuffix ends the role of the Kubernetes installation's pod: `<role name prefix>-sluis`.
Variables ¶
var ( // InstancePattern is an instance name: lower-case letters, digits and // dashes, at most 32, starting and ending with a letter or digit. InstancePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$`) // FunctionNamePattern is a Lambda function's name, and so its role's. FunctionNamePattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`) // AliasPattern is a KMS alias. AliasPattern = regexp.MustCompile(`^alias/[A-Za-z0-9/_-]{1,250}$`) // BucketPrefixPattern is the start of a bucket name that BucketName // completes. BucketPrefixPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{2,40}$`) )
Functions ¶
func BucketName ¶
BucketName is a bucket named for one account and region: `<prefix>-<account id>-<region>`, unique without coordination.
func CheckBucketPrefix ¶
CheckBucketPrefix refuses a prefix that is not the start of a bucket name, or that makes a name longer than S3 allows in this region with any 12-digit account.
func CheckCloudflareRotation ¶
CheckCloudflareRotation holds a Cloudflare preset's token lifetime and rotation to what the module accepts at load: both between one minute and 24 hours, the rotation shorter, so a reader always has the difference to pick up the replacement.
func CheckFunctionName ¶
CheckFunctionName refuses a Lambda function name the library refuses.
func CheckInstance ¶
CheckInstance refuses an instance name the library refuses.
func CheckKeyAlias ¶
CheckKeyAlias refuses anything but a customer KMS alias: a key is named by alias, never by ARN or key id, and never by an AWS managed alias.
func CheckVerifyKey ¶
CheckVerifyKey holds one verify-only key, and the algorithm it is for, to what the running issuer accepts: it IS the issuer's own parser (issuer.ParseVerifyOnlyKey), so the deploy check and the issuer cannot disagree about a key. alg may be empty (the key's own algorithm), and the key may be a PEM or a JWK. A private key is refused whatever its encoding, and an error never carries key material.
func FunctionRoleARN ¶
FunctionRoleARN is a Lambda function's role: the library names the role after the function, at path `/`.
func KubernetesRoleName ¶
KubernetesRoleName is the Kubernetes installation's pod role, named from the installation's role name prefix.
Types ¶
type ChartSecret ¶
type ChartSecret struct {
// Name is the secret's name as the service reads it (`clients/<id>/secret`).
Name string `yaml:"name"`
// SecretName and Key are the Kubernetes Secret and its key.
SecretName string `yaml:"secretName"`
Key string `yaml:"key"`
}
ChartSecret is one entry of the sluis chart's `secrets` value: the secret the service reads by Name, projected from one key of a Kubernetes Secret.
Source Files