Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertificateAuthority ¶
type CertificateAuthority interface {
// Sign generates a certificate for a workload or CA, from the given CSR and cert opts.
Sign(csrPEM []byte, opts ca.CertOpts) ([]byte, error)
// SignWithCertChain is similar to Sign but returns the leaf cert and the entire cert chain.
SignWithCertChain(csrPEM []byte, opts ca.CertOpts) ([]string, error)
// GetCAKeyCertBundle returns the KeyCertBundle used by CA.
GetCAKeyCertBundle() *util.KeyCertBundle
}
CertificateAuthority contains methods to be supported by a CA.
type ClusterNodeAuthorizer ¶
type ClusterNodeAuthorizer struct {
// contains filtered or unexported fields
}
func NewClusterNodeAuthorizer ¶
func NewClusterNodeAuthorizer(client kube.Client, trustedNodeAccounts sets.Set[types.NamespacedName]) *ClusterNodeAuthorizer
func (*ClusterNodeAuthorizer) Close ¶
func (na *ClusterNodeAuthorizer) Close()
func (*ClusterNodeAuthorizer) HasSynced ¶
func (na *ClusterNodeAuthorizer) HasSynced() bool
type MulticlusterNodeAuthorizor ¶
type MulticlusterNodeAuthorizor struct {
// contains filtered or unexported fields
}
MulticlusterNodeAuthorizor is is responsible for maintaining an index of ClusterNodeAuthenticators, one per cluster (https://docs.google.com/document/d/10uf4EvUVif4xGeCYQydaKh9Yaz9wpysao7gyLewJY2Q). Node authorizations from one cluster will be forwarded to the ClusterNodeAuthenticators for the same cluster.
func NewMulticlusterNodeAuthenticator ¶
func NewMulticlusterNodeAuthenticator( trustedNodeAccounts sets.Set[types.NamespacedName], controller multicluster.ComponentBuilder, ) *MulticlusterNodeAuthorizor
type SaNode ¶
type SaNode struct {
ServiceAccount types.NamespacedName
Node string
}
type Server ¶
type Server struct {
pb.UnimplementedIstioCertificateServiceServer
Authenticators []security.Authenticator
// contains filtered or unexported fields
}
Server implements IstioCAService and IstioCertificateService and provides the services on the specified port.
func New ¶
func New( ca CertificateAuthority, ttl time.Duration, authenticators []security.Authenticator, controller multicluster.ComponentBuilder, ) (*Server, error)
New creates a new instance of `IstioCAServiceServer`
func (*Server) CreateCertificate ¶
func (s *Server) CreateCertificate(ctx context.Context, request *pb.IstioCertificateRequest) ( *pb.IstioCertificateResponse, error, )
CreateCertificate handles an incoming certificate signing request (CSR). It does authentication and authorization. Upon validated, signs a certificate that: the SAN is the identity of the caller in authentication result. the subject public key is the public key in the CSR. the validity duration is the ValidityDuration in request, or default value if the given duration is invalid. it is signed by the CA signing key.
Source Files
Directories