cert

type Bundle struct {
	Cert   []byte
	Key    []byte
	CACert []byte // CA cert bundle, optional.
}

type GenSource struct {
	Name  string   // Name is used as part of the common name
	Hosts []string // Hosts is the list of hosts to make the leaf valid for

	// Expiry is the duration that a certificate is valid for. This
	// defaults to 24 hours.
	Expiry time.Duration

	// ExpiryWithin is the duration value used for determining whether to
	// regenerate a new leaf certificate. If the old leaf certificate is
	// expiring within this value, then a new leaf will be generated. Default
	// is about 10% of Expiry.
	ExpiryWithin time.Duration
	// contains filtered or unexported fields
}

type MetaBundle struct {
	Bundle
	// WebhookConfigName is the name of the MutatingWebhookConfiguration
	// that will be updated with the CA bundle when a new CA is generated.
	WebhookConfigName string
	// SecretName is the name of the Kubernetes TLS secret that will be
	// be created/updated with the leaf certificate and it's private key when
	// a new certificate key pair are generated.
	SecretName string
	// SecretNamespace is the namespace in which the aforementioned secret
	// will be created/updated.
	SecretNamespace string
}

type Notify struct {
	// Ch is where the notifications for new bundles are sent. If this
	// blocks then the notify loop will also be blocked, so downstream
	// users should process this channel in a timely manner.
	Ch chan<- MetaBundle

	// Source is the source of certificates.
	Source Source

	// WebhookConfigName is the name of the MutatingWebhookConfiguration
	// that will be updated with the CA bundle when a new CA is generated.
	WebhookConfigName string
	// SecretName is the name of the Kubernetes TLS secret that will be
	// be created/updated with the leaf certificate and it's private key when
	// a new certificate key pair are generated.
	SecretName string
	// SecretNamespace is the namespace in which the aforementioned secret
	// will be created/updated.
	SecretNamespace string
	// contains filtered or unexported fields
}

type Source interface {
	// Certificate returns the certificates to use for the TLS listener.
	// If `last` is given, this should block until new certificates are
	// available. If last is nil, then this is an initial certificate request
	// and new certificates should be loaded.
	//
	// If this is a blocking call, a done context should cancel the result
	// and return immediately with an error (usually ctx.Err()).
	//
	// If any errors occur then an error should be returned. Higher level
	// systems should deal with safely backing off to prevent calling this
	// method too frequently.
	Certificate(ctx context.Context, last *Bundle) (Bundle, error)
}