Documentation
¶
Overview ¶
Package ca implements the embedded cluster certificate authority. A single ECDSA P-256 root, persisted under <data-dir>/ca/, signs the TLS certificates for the API/registry listeners and the per-node client+server certs that carry each node's identity in a URI SAN (zattera://node/<nodeID>). The API's auth layer reads that URI SAN to establish node identity from mTLS.
The root key is never regenerated: if it exists but fails to parse we fail loudly rather than mint a new CA, because a fresh CA silently invalidates every node's trust and every issued cert.
Index ¶
- Constants
- type CA
- func (c *CA) CABundlePEM() []byte
- func (c *CA) Certificate() *x509.Certificate
- func (c *CA) ClientTLSConfig(nodeCert tls.Certificate) *tls.Config
- func (c *CA) IssueNode(nodeID string, meshIP net.IP, ttl time.Duration) (*Leaf, error)
- func (c *CA) IssueServer(dnsNames []string, ips []net.IP, ttl time.Duration) (*Leaf, error)
- func (c *CA) Pool() *x509.CertPool
- func (c *CA) PrivateKeyPEM() ([]byte, error)
- func (c *CA) ServerTLSConfig(dnsNames []string, ips []net.IP) (*tls.Config, error)
- func (c *CA) SignCSR(csrPEM []byte, nodeID string, meshIP net.IP, ttl time.Duration) ([]byte, error)
- type Leaf
Constants ¶
const ( // NodeCertTTL is the default validity of a node identity cert (1 year). NodeCertTTL = 365 * 24 * time.Hour )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is the cluster certificate authority: an ECDSA P-256 root that issues leaf certs. It is safe for concurrent use (its fields are read-only after construction).
func LoadOrCreate ¶
LoadOrCreate loads the root CA from <dir>/ca.crt + ca.key, creating a fresh root (and persisting it 0600) if none exists. A present-but-unparseable key is a hard error — never silently regenerate.
func (*CA) CABundlePEM ¶
CABundlePEM returns the root certificate in PEM (the trust bundle handed to joining nodes and CLI clients).
func (*CA) Certificate ¶
func (c *CA) Certificate() *x509.Certificate
Certificate returns the parsed root certificate (used for the CA-pin hash in join tokens, T-12).
func (*CA) ClientTLSConfig ¶
func (c *CA) ClientTLSConfig(nodeCert tls.Certificate) *tls.Config
ClientTLSConfig returns a *tls.Config presenting nodeCert (a node identity leaf) and trusting the cluster root — for node→control mTLS dials.
func (*CA) IssueNode ¶
IssueNode mints a node identity cert used both as a client and a server cert (nodes speak mTLS both ways). Its identity is carried in a URI SAN zattera://node/<nodeID> plus DNS SAN node-<nodeID>.
func (*CA) IssueServer ¶
IssueServer mints a server cert for the API/registry listeners. Callers should include 127.0.0.1, the node's mesh IP, the cluster domain and localhost among dnsNames/ips.
func (*CA) PrivateKeyPEM ¶
PrivateKeyPEM returns the root CA private key in PEM (EC PRIVATE KEY). It is handed to a joining control node over the mTLS join hop (T-55) so every control node can independently sign node certs, serve its API cert, and run ACME. Guard it like any cluster secret — a leak is a full trust compromise.
func (*CA) ServerTLSConfig ¶
ServerTLSConfig returns a *tls.Config presenting a freshly issued server cert for the given SANs, requesting (not requiring) client certs so both token-bearing CLIs and mTLS nodes can share the listener.
type Leaf ¶
Leaf is one issued certificate + its private key, in PEM.
func (*Leaf) TLSCertificate ¶
func (l *Leaf) TLSCertificate(caPEM []byte) (tls.Certificate, error)
TLSCertificate builds a tls.Certificate from an issued leaf, with the CA appended so peers can build the chain.
Source Files