package chiron

import "istio.io/istio/security/pkg/k8s/chiron"

Index ¶

• Constants
• func GenCsrName() string
• func GenKeyCertK8sCA(certClient certclient.CertificateSigningRequestInterface, dnsName, secretName, secretNamespace, caFilePath string) ([]byte, []byte, []byte, error)
• func SignCSRK8s(certClient certclient.CertificateSigningRequestInterface, csrName string, csrSpec *cert.CertificateSigningRequestSpec, dnsName, caFilePath string, appendCaCert bool) ([]byte, []byte, error)
• type WebhookController
• func NewWebhookController(gracePeriodRatio float32, minGracePeriod time.Duration, core corev1.CoreV1Interface, admission admissionv1beta1.AdmissionregistrationV1beta1Interface, certClient certclient.CertificatesV1beta1Interface, k8sCaCertFile string, secretNames, dnsNames, serviceNamespaces []string) (*WebhookController, error)
• func (wc *WebhookController) Run(stopCh <-chan struct{})
• type WebhookType

Package Files ¶

controller.go utils.go

Constants ¶

const (
    // The Istio DNS secret annotation type
    IstioDNSSecretType = "istio.io/dns-key-and-cert"
)

#nosec: disable gas linter

func GenCsrName ¶ Uses

func GenCsrName() string

GenCsrName : Generate CSR Name for K8s system

func GenKeyCertK8sCA ¶ Uses

func GenKeyCertK8sCA(certClient certclient.CertificateSigningRequestInterface, dnsName,
    secretName, secretNamespace, caFilePath string) ([]byte, []byte, []byte, error)

GenKeyCertK8sCA : Generates a key pair and gets public certificate signed by K8s_CA Options are meant to sign DNS certs 1. Generate a CSR 2. Call SignCSRK8sCA to finish rest of the flow

func SignCSRK8s ¶ Uses

func SignCSRK8s(certClient certclient.CertificateSigningRequestInterface,
    csrName string, csrSpec *cert.CertificateSigningRequestSpec,
    dnsName, caFilePath string, appendCaCert bool) ([]byte, []byte, error)

SignCSRK8sCA generates a certificate from CSR using the K8s CA 1. Submit a CSR 2. Approve a CSR 3. Read the signed certificate 4. Clean up the artifacts (e.g., delete CSR)

type WebhookController ¶ Uses

type WebhookController struct {

    // Current CA certificate
    CACert []byte
    // contains filtered or unexported fields
}

WebhookController manages the service accounts' secrets that contains Istio keys and certificates.

func NewWebhookController ¶ Uses

func NewWebhookController(gracePeriodRatio float32, minGracePeriod time.Duration,
    core corev1.CoreV1Interface, admission admissionv1beta1.AdmissionregistrationV1beta1Interface,
    certClient certclient.CertificatesV1beta1Interface, k8sCaCertFile string,
    secretNames, dnsNames, serviceNamespaces []string) (*WebhookController, error)

NewWebhookController returns a pointer to a newly constructed WebhookController instance.

func (*WebhookController) Run ¶ Uses

func (wc *WebhookController) Run(stopCh <-chan struct{})

Run starts the WebhookController until stopCh is notified.

type WebhookType ¶ Uses

type WebhookType int