cas

func NewCASCertProvider ¶

func NewCASCertProvider(capool string, ol []grpc.DialOption) (*casCertProvider, error)

NewCASCertProvider create a client for Google CAS.

capool is in format: projects/*/locations/*/caPools/*

Should default based on the config project and the location of the config cluster.

Files: if running as root, will create the well-known files: -

In GKE, if "--enable-mesh-certificates" cluster option and and the annotation

"security.cloud.google.com/use-workload-certificates" will automatically

create the files and this is not needed. As such the file should be checked first. The config in GKE is based on WorkloadCertificateConfig - this file is attempting to emulate it.

See: https://cloud.google.com/traffic-director/docs/security-proxyless-setup?hl=en