package util

import "istio.io/istio/security/pkg/util"

Index ¶

• func GetAud(token string) ([]string, error)
• func InsertDataToConfigMap(client corev1.ConfigMapsGetter, meta metav1.ObjectMeta, data map[string]string) error
• func IsJwtExpired(token string, now time.Time) (bool, error)
• func IsK8SUnbound(jwt string) bool
• func UpdateDataInConfigMap(client corev1.ConfigMapsGetter, cm *v1.ConfigMap, data map[string]string) error
• type CertUtil
• type CertUtilImpl
• func NewCertUtil(gracePeriodPercentage int) CertUtilImpl
• func (cu CertUtilImpl) GetWaitTime(certBytes []byte, now time.Time, minGracePeriod time.Duration) (time.Duration, error)

Package Files ¶

certutil.go configutil.go jwtutil.go

func GetAud ¶ Uses

func GetAud(token string) ([]string, error)

GetAud returns the claim `aud` from the token. Returns nil if not found.

func InsertDataToConfigMap ¶ Uses

func InsertDataToConfigMap(client corev1.ConfigMapsGetter, meta metav1.ObjectMeta, data map[string]string) error

InsertDataToConfigMap inserts a data to a configmap in a namespace. client: the k8s client interface. namespace: the namespace of the configmap. value: the value of the data to insert. configName: the name of the configmap. dataName: the name of the data in the configmap.

func IsJwtExpired ¶ Uses

func IsJwtExpired(token string, now time.Time) (bool, error)

IsJwtExpired checks if the JWT token is expired compared with the given time, without validating it.

func IsK8SUnbound ¶ Uses

func IsK8SUnbound(jwt string) bool

IsK8SUnbound detects if the token is a K8S unbound token. It is a regular JWT with no audience and expiration, which can be exchanged with bound tokens with audience.

This is used to determine if we check audience in the token. Clients should not use unbound tokens except in cases where bound tokens are not possible.

func UpdateDataInConfigMap ¶ Uses

func UpdateDataInConfigMap(client corev1.ConfigMapsGetter, cm *v1.ConfigMap, data map[string]string) error

type CertUtil ¶ Uses

type CertUtil interface {
    // GetWaitTime returns the waiting time before renewing the certificate.
    GetWaitTime([]byte, time.Time, time.Duration) (time.Duration, error)
}

CertUtil is an interface for utility functions on certificate.

type CertUtilImpl ¶ Uses

type CertUtilImpl struct {
    // contains filtered or unexported fields
}

CertUtilImpl is the implementation of CertUtil, for production use.

func NewCertUtil ¶ Uses

func NewCertUtil(gracePeriodPercentage int) CertUtilImpl

NewCertUtil returns a new CertUtilImpl

func (CertUtilImpl) GetWaitTime ¶ Uses

func (cu CertUtilImpl) GetWaitTime(certBytes []byte, now time.Time, minGracePeriod time.Duration) (time.Duration, error)

GetWaitTime returns the waititng time before renewing the cert, based on current time, the timestamps in cert and graceperiod.

Directories ¶