Documentation
¶
Overview ¶
Package apigwtls is the api gateway's TLS material: the rules a connection's mTLS keypair and CA bundle have to satisfy, and the *tls.Config its outbound transport is built with.
It is a seam of pkg/toolkits/apigateway, extracted when that package reached its size budget. Nothing here knows what an API connection is -- it takes the four values one carries -- which is why X.509 parsing, key-strength policy and PEM handling sit together rather than beside operation discovery. The messages keep their "apigateway:" prefix: an operator sees them when a connection is refused, and the prefix names that subsystem.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Build ¶
Build returns a *tls.Config wired with this connection's client certificate (when configured) and an extended root CA pool (when a bundle is configured). Returns nil when neither is set so the http.Transport falls back to its default tls.Config behavior (system roots, no client cert).
The returned config is safe for concurrent use across all outbound requests on this connection's transport. A connection reload rebuilds the transport in place, so cert rotation does not require a process restart.
Validation has already run via the connection's own Validate; this function does not re-check key strength or bundle parseability. It does still surface tls.X509KeyPair errors so a programmatic caller that bypassed validation gets a clear failure instead of a nil-deref.
func RootPool ¶
RootPool appends the operator's CA bundle to the system root pool. Substituting (rather than appending) would silently break upstreams that legitimately use public CAs alongside the private one; that is a footgun we do not give the operator. When the system pool cannot be loaded (rare, e.g., a minimal distroless base without a CA cert bundle) we fall back to an empty pool plus the operator's bundle, which preserves the operator's intent without crashing.
func Validate ¶
Validate enforces the mTLS and CA-trust rules. Three independent checks:
Cert + key are mutually required when either is set. A connection with only a cert (and no key) cannot complete a TLS handshake; refusing here surfaces the misconfiguration at admin write time instead of as a runtime error on the first outbound call.
When mTLS material is present, the cert and key must parse as PEM, the key must match the cert (tls.X509KeyPair checks via signature), and the key algorithm must clear the minimum-strength bar (RSA >= minRSABits, ECDSA P-256/P-384/P-521, or Ed25519). Weaker keys are rejected.
The CA bundle must be a parseable PEM bundle with at least one certificate when set. Empty string means "no extra CAs", which is the existing default.
Types ¶
type Material ¶
type Material struct {
ClientCertPEM string
ClientKeyPEM string
CABundlePEM string
ClientPairRequired bool
}
Material is the TLS material one connection carries: the client keypair it presents, the extra CA bundle it trusts, and whether that keypair is the connection's credential (auth_mode=mtls) rather than an addition to it. The caller resolves ClientPairRequired from the auth mode.
Source Files